joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010bf0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
sub rsp, 0x38
cmp dword [rcx + 0x5c], 1
mov rbp, r8
mov rbx, rcx
je 0x180010c0c
xor al, al
add rsp, 0x38
pop rbp
pop rbx
ret
mov qword [rsp + 0x58], rsi
mov esi, dword [rcx + 0x30]
mov ecx, dword [rcx + 0x18]
mov qword [rsp + 0x60], rdi
sub ecx, 1
je 0x180010c42
sub ecx, 1
je 0x180010c3b
sub ecx, 1
je 0x180010c34
cmp ecx, 1
je 0x180010c3b
xor edi, edi
jmp 0x180010c47
mov edi, 1
jmp 0x180010c47
mov edi, 4
jmp 0x180010c47
mov edi, 3
imul edi, dword [rbx + 0x1c]
mov eax, edi
cmp rax, qword [rbx + 0x28]
jne 0x180010c57
imul edi, dword [rbx + 0x20]
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x30], r15
test esi, esi
je 0x180010d13
mov r15d, edi
lea r14, [rbx + 0x90]
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx + 0x68]
xor r9d, r9d
mov r8d, edi
mov qword [rsp + 0x20], r14
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180010d06
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x180010cdb
nop dword [rax]
xor edx, edx
mov rcx, rbx
call fcn.1800106b0
test al, al
je 0x180010cdb
mov rcx, qword [rbx + 0xa8]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x180010ce7
cmp eax, 0x102
je 0x180010cb0
mov rcx, rbx
call fcn.180010060
xor al, al
jmp 0x180010d15
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x50]
xor r9d, r9d
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x180010cdb
cmp dword [rsp + 0x50], esi
jne 0x180010cdb
sub esi, edi
add rbp, r15
test esi, esi
jne 0x180010c80
mov al, 1
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x38
pop rbp
pop rbx
ret

Function at 0x1800145f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180067dc0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1800146c3
cmp byte [rcx + 0x71], 0
je 0x1800146c3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800146bf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180014684
sub eax, 1
je 0x180014688
cmp eax, 2
jne 0x1800146bf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004a020
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1800146b6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1800146bf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18001466c
xor al, al
jmp 0x18001466c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004a020
add rsp, 0x60
pop rbx
ret
Function at 0x180014890
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180067dc0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x1800148bd
xor eax, eax
jmp 0x180014a26
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x1800148fd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x1800148fd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x180014a1e
cmp qword [rdi + 0x80], 0
je 0x180014a19
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x180014937
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x180014962
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x180014a1e
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800149d1
sub eax, 1
je 0x1800149d1
cmp eax, 2
jne 0x180014a19
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x180014a1e
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x1800149ff
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x180014a19
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x180014a1e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18004a020
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180015170
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x1800151a1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1800151bf
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x180015209
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x180015281
mov rcx, rbp
call fcn.180014700
cmp rbx, 0xfff
jbe 0x180015261
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x1800152a2
cmp rbx, rax
ja 0x180015230
test rdi, rdi
je 0x180015281
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x180015284
Function at 0x1800152b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1800152d8
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x18001534c
test rax, rax
jle 0x18001532c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x18001534c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18001534c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x18002d0a0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movzx esi, r8b
mov r14, rdx
xor r15d, r15d
xor r8d, r8d
xor edx, edx
xor r9d, r9d
mov ebx, r15d
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
movsxd rdi, eax
test eax, eax
je 0x18002d14d
mov rcx, rdi
add rcx, rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x18002d14d
xor r9d, r9d
mov r8, rax
mov edx, edi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
inc eax
cmp edi, eax
jne 0x18002d14d
mov eax, r15d
lea ebp, [r15 + 0x5c]
mov edi, r15d
test rax, rax
je 0x18002d11d
mov word [rax], r15w
inc edi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18002d176
test sil, sil
je 0x18002d13e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x18002d176
mov edx, ebp
mov rcx, rbx
call sub.VCRUNTIME140.dll_wcsrchr
test rax, rax
jne 0x18002d117
xor sil, sil
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x40]
movzx eax, sil
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov sil, 1
nop dword [rax]
test edi, edi
je 0x18002d1b7
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x18002d190
xor edx, edx
mov word [rbx + rax*2], bp
mov rcx, rbx
dec edi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne sil
test eax, eax
jne 0x18002d180
test sil, sil
je 0x18002d150
mov rdx, rbx
mov rcx, r14
call fcn.18002d3f0
jmp 0x18002d150
Function at 0x18002d1d0
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x2e8
mov rax, qword [0x180067dc0]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
xor ebx, ebx
mov qword [rsp + 0x28], r8
test edx, edx
mov r13d, ebx
mov rsi, 0xffffffffffffffff
mov rdi, rcx
cmovns r13d, edx
mov rax, rsi
movsxd rcx, r13d
inc rax
cmp word [rdi + rax*2], bx
jne 0x18002d213
lea r15, [rcx + 1]
add r15, rax
lea rcx, [r15 + r15]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
mov r12, rax
setne byte [rsp + 0x20]
test rax, rax
je 0x18002d3b3
mov qword [rsp + 0x338], rbp
mov rbp, rsi
mov qword [rsp + 0x2e0], r14
inc rbp
cmp word [rdi + rbp*2], bx
jne 0x18002d254
mov r8, rdi
mov rdx, r15
mov rcx, r12
mov r14d, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
movsxd r15, r13d
test r13d, r13d
jle 0x18002d28c
movsxd rax, ebp
mov ecx, 0x3f
lea rdi, [r12 + rax*2]
movzx eax, cx
mov rcx, r15
rep stosw word [rdi], ax
mov eax, r13d
lea rdx, [rsp + 0x30]
add eax, ebp
movsxd rcx, eax
mov word [r12 + rcx*2], bx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, rsi
je 0x18002d305
nop
lea rcx, [rsp + 0x5c]
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x18002d2c0
cmp r13d, eax
jg 0x18002d2ea
movsxd rcx, eax
lea rax, [rsp + 0x5c]
sub rcx, r15
lea rcx, [rax + rcx*2]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
cmp r14d, eax
cmovl r14d, eax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18002d2b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r9d, 0xa
lea ecx, [r14 + 1]
lea rdx, [rsp + 0x280]
lea r8d, [r9 + 0x17]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow_s]
mov r14, qword [rsp + 0x2e0]
test r13d, r13d
jle 0x18002d343
movsxd rax, ebp
mov ecx, 0x30
lea rdi, [r12 + rax*2]
movzx eax, cx
mov rcx, r15
rep stosw word [rdi], ax
movsxd rdi, r13d
test r13d, r13d
jle 0x18002d39e
lea rax, [rsp + 0x280]
inc rsi
cmp word [rax + rsi*2], bx
jne 0x18002d353
movsxd r8, esi
mov rcx, rdi
sub rcx, r8
movsxd rax, ebp
add rcx, rax
lea rax, [rsp + 0x280]
lea rdx, [rsp + r8*2 + 0x27e]
lea r9, [rcx + rcx]
sub r9, rax
add r9, r12
cmp rbx, r8
jge 0x18002d39e
movzx eax, word [rdx]
inc rbx
mov word [r9 + rdx], ax
sub rdx, 2
cmp rbx, rdi
jl 0x18002d385
mov rcx, qword [rsp + 0x28]
mov rdx, r12
call fcn.18002d3f0
mov rbp, qword [rsp + 0x338]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.18004a020
add rsp, 0x2e8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x18002e9d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x180067dc0]
xor rax, rsp
mov qword [rbp - 0x18], rax
movzx eax, byte [rbp + 0x60]
mov rbx, rcx
movzx ecx, byte [rbp + 0x58]
add al, 2
mov byte [rbp - 0x26], al
movzx r15d, cl
movzx esi, cl
mov byte [rbp - 0x2c], cl
movzx ecx, byte [rbp + 0x70]
and r15b, 7
movzx r14d, r8w
and cl, 0xf
movzx edi, r9w
lea r8, [0x180050ad8]
movzx eax, r14w
shr sil, 3
shr ax, 8
mov byte [rbp - 0x2f], al
movzx eax, di
shr ax, 8
mov byte [rbp - 0x2d], al
movzx eax, byte [rbp + 0x78]
shl al, 5
or cl, al
mov word [rbp - 0x28], 0
mov byte [rbp - 0x2b], cl
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x25], 0
mov byte [rbp - 0x1d], 0
mov byte [rbp - 0x30], r14b
mov byte [rbp - 0x2e], dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov r9, qword [rbp - 0x38]
test r9, r9
je 0x18002eb2d
mov edx, 1
lea rcx, [rbp - 0x28]
lea r8d, [rdx + 0xb]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rbp - 0x38]
lea rcx, [rbp - 0x30]
mov edx, 1
lea r8d, [rdx + 5]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea eax, [rsi + 1]
test r15b, r15b
movzx ecx, al
mov r8d, r14d
movzx eax, sil
cmove ecx, eax
movzx r9d, cl
movsxd rcx, dword [rbp + 0x68]
mov eax, r9d
imul eax, r14d
cmp eax, ecx
jne 0x18002eaf5
mov eax, edi
mov edx, 1
imul eax, r9d
mov rcx, rbx
mov r9, qword [rbp - 0x38]
imul eax, r8d
movsxd r8, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov al, 1
jmp 0x18002eb2f
xor edx, edx
cmp dx, di
jae 0x18002eb1f
mov esi, eax
mov r14, rcx
mov r9, qword [rbp - 0x38]
mov r8, rsi
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rbx, r14
sub rdi, 1
jne 0x18002eb01
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov al, 1
jmp 0x18002eb2f
xor al, al
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.18004a020
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18003c5f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov esi, r9d
mov edi, r8d
mov r14, rdx
mov rbp, rcx
cmp r9d, r8d
jl 0x18003c673
lea ebx, [r8 + r9]
xor r8d, r8d
sar ebx, 1
lea edx, [rdx + rbx*8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18003c673
mov r9, rbp
lea edx, [rax + 4]
lea r8d, [rax + 1]
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
jne 0x18003c673
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x60], eax
jne 0x18003c652
mov eax, ebx
jmp 0x18003c678
jle 0x18003c659
lea esi, [rbx - 1]
jmp 0x18003c65c
lea edi, [rbx + 1]
mov r9d, esi
mov dword [rsp + 0x20], eax
mov r8d, edi
mov rdx, r14
mov rcx, rbp
call fcn.18003c5f0
jmp 0x18003c678
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180042500
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, rdx
mov r14, rcx
xor ebp, ebp
mov dword [rcx], ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], rbp
lea edx, [rbp + 2]
call sub.MSVCP140.dll__Mtx_init_in_situ
nop
lea rbx, [r14 + 0x50]
mov qword [rsp + 0x80], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], rbp
lea ecx, [rbp + 0x10]
call fcn.180049f4c
mov qword [rax + 8], rbp
mov qword [rbx], rax
mov qword [rax], rbx
lea rcx, [r14 + 0x78]
call sub.MSVCP140.dll__Cnd_init_in_situ
nop
mov byte [r14 + 0xc0], bpl
lea rbx, [r14 + 0xc8]
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
test rdi, rdi
je 0x1800425af
lea r8, [rsp + 0x80]
mov rdx, rdi
mov rcx, rbx
call fcn.180041f80
mov rsi, rbp
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
sar rax, 4
test rax, rax
je 0x18004265d
mov rdi, rbp
lea r15, [0x180044950]
mov ecx, 0x10
call fcn.180049f4c
test rax, rax
je 0x1800425e8
mov qword [rax], r14
mov qword [rax + 8], r15
jmp 0x1800425eb
mov rax, rbp
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x180041f50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180042678
mov rax, qword [rbx]
cmp dword [rdi + rax + 8], 0
jne 0x180042671
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rdi + rax], xmm1
cmp dword [rsp + 0x38], 0
jne 0x180042671
inc rsi
add rdi, 0x10
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
sar rax, 4
cmp rsi, rax
jb 0x1800425d0
mov rax, r14
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1800466e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rbx, rcx
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 1
mov qword [rcx + 0x20], rdx
mov qword [rcx + 0x28], rdi
mov dword [rcx + 0x30], edi
add rcx, 0x38
mov dword [rcx], edi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], rdi
lea edx, [rdi + 2]
call sub.MSVCP140.dll__Mtx_init_in_situ
nop
lea rcx, [rbx + 0x88]
call sub.MSVCP140.dll__Cnd_init_in_situ
nop
xorps xmm0, xmm0
movups xmmword [rbx + 0xd0], xmm0
mov byte [rbx + 0xe0], dil
mov qword [rbx + 0xe8], rdi
mov qword [rbx + 0xf0], rdi
lea ecx, [rdi + 0x18]
call fcn.180049f4c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 0xe8], rax
mov rax, qword [rbx + 0x20]
lock inc dword [rax + 8]
lea ecx, [rdi + 0x10]
call fcn.180049f4c
test rax, rax
je 0x1800467a3
mov qword [rax], rbx
lea rcx, [0x1800483d0]
mov qword [rax + 8], rcx
jmp 0x1800467a6
mov rax, rdi
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x180041f50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180046801
cmp dword [rbx + 0xd8], 0
jne 0x1800467fa
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx + 0xd0], xmm1
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x38], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x2fc4d85a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d9680
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d8fa2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fb108]
test eax, eax
je 0x2fc4d903a
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fb110]
mov qword [rbp - 8], rax
jmp 0x2fc4d901e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d9012
cmp qword [rbp - 0x10], 0
je 0x2fc4d9012
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d8fd8
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d903b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d9140
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d9168
mov eax, 0
jmp 0x2fc4d91b6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d9191
mov eax, 0
jmp 0x2fc4d91b6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d91b1
mov eax, 0
jmp 0x2fc4d91b6
mov eax, 1
add rsp, 0x20
pop rbp
ret