joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4382c0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x004cda98]
mov edi, edx
test rcx, rcx
je 0x4383a0
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x4382fa
mov rsi, qword [rax + 0x1c8]
cmp rsi, rbx
je 0x438320
mov rcx, qword [0x004cda98]
test rcx, rcx
je 0x438370
mov ebx, 3
call sym.pthread_mutex_unlock
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
test byte [rax + 0x40], 0xc
jne 0x4382fa
mov ebx, dword [rax + 0xb4]
test ebx, ebx
jne 0x4382fa
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x4382fa
mov rcx, qword [0x004cda98]
test rcx, rcx
je 0x4383c7
call sym.pthread_mutex_unlock
test edi, edi
je 0x438310
sub edi, 2
mov ebx, 0x16
cmp edi, 0x15
ja 0x438310
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov rcx, rax
mov qword [0x004cda98], rax
jmp 0x438306
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov rcx, rax
mov qword [0x004cda98], rax
jmp 0x4382dc
lea rcx, str.mtx_pthr_locked_shmem
lea r8, [sym.__shmem_winpthreads_init_mtx_pthr_locked_shmem]
mov edx, 8
call sym.__shmem_winpthreads_grab
mov rcx, rax
mov qword [0x004cda98], rax
jmp 0x43834a
Function at 0x43cd80
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___terminate_handler_sh]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x43cda0
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [sym.__shmem_init___unexpected_handler_sh]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp dbg.__shmem_grab

Function at 0x43e060
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
test rax, rax
jle 0x43e091
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
mov dword [rbx + 0x48], 0xffffffff
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x43e9e0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x004a2090], 0
jne 0x43eaa7
mov byte [0x004a2090], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x43eb3a
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov rsi, qword [sym.imp.msvcrt.dll___iob_func]
mov rdi, rax
call rsi
lea rcx, str.terminate_called_after_throwing_an_instance_of_
lea r9, [rax + 0x60]
mov r8d, 0x30
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x43ea97
call rsi
lea rdx, [rax + 0x60]
mov rcx, rbx
call sym.fputs
call rsi
lea rcx, [0x004a8fb1]
lea r9, [rax + 0x60]
mov r8d, 2
mov edx, 1
call sym.fwrite
cmp dword [rsp + 0x2c], 0
je 0x43eacd
call sym.__cxa_rethrow
call rsi
lea rdx, [rax + 0x60]
mov rcx, rdi
call sym.fputs
jmp 0x43ea6e
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_recursively_n
lea r9, [rax + 0x60]
mov r8d, 0x1d
mov edx, 1
call sym.fwrite
call sym.abort
mov rcx, rdi
call sym.free
jmp 0x43ea92
call sym.abort
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, str.terminate_called_without_an_active_exception_n
lea r9, [rax + 0x60]
mov r8d, 0x2d
mov edx, 1
call sym.fwrite
jmp 0x43eb35

Function at 0x46cf20
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
mov rcx, rbp
call method.std::__basic_file_char_.fd__
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sym.read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x46cf70
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x46cf3a
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140001093
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
nop
cpuid
nop
mov eax, 1
nop
cpuid
nop
movabs r9, 0xb2d05e00
nop
cpuid
nop
rdtsc
nop
shl rdx, 0x20
nop
or rax, rdx
nop
mov rcx, rax
nop
fldpi
nop
frndint
nop
rdtsc
nop
shl rdx, 0x20
nop
or rax, rdx
nop
sub rax, rcx
nop
cmp rax, r9
nop
jb 0x1400010c0
nop
nop
push rbp
nop
mov rbp, rsp
nop
sub rsp, 8
nop
mov r10, 0xa
nop
mov rcx, 0xffffffff9f345678
nop
dec rcx
nop
xor r9, r9
nop
mov rax, rcx
nop
jne 0x1400010f9
nop
xor rax, rax
nop
mov rax, rbx
nop
add rax, rdx
nop
dec r10
nop
xor r11, r11
nop
jne 0x1400010f0
nop
xor rax, rax
mov rax, 0xa
nop
dec rax
nop
add rsp, 8
pop rbp
ret
Function at 0x140004110
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
xor edi, edi
mov rsi, r9
mov dword [rsp + 0x48], edi
mov r14, r8
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
mov ecx, edi
mov eax, dword [rsp + 0x48]
mov qword [rsp + 0x40], rcx
cmp eax, 3
jl 0x140004173
mov rcx, qword [rbx + 8]
lea rdx, str._runtime
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmp eax, 5
jl 0x14000418e
mov rcx, qword [rbx + 0x18]
lea rdx, str._runtime
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x140004230
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x20a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
lea r8, str.Adobe_AIRVersions1.0Adobe_AIR.dll
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.140004030
test al, al
jne 0x1400041dc
mov eax, 4
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140004215
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 3
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x140004230
lea eax, [rcx + 3]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsi], rax
test rax, rax
je 0x1400041c9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsi]
lea rdx, str.CaptiveAppEntryWinMain
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x50]
mov ecx, 4
test rax, rax
mov qword [r14], rax
cmove edi, ecx
mov eax, edi
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140004290
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx r8d, ax
lea r10, [0x140019910]
xor eax, eax
mov r9d, r8d
mov edx, eax
nop dword [rax]
mov ecx, edx
shl rcx, 5
cmp r9d, dword [rcx + r10 + 8]
je 0x1400042c4
inc edx
cmp edx, 0x11
jb 0x1400042b0
cmp edx, 0x11
jne 0x140004301
mov edx, 0x3ff
and r8w, dx
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
shl rcx, 5
movzx ecx, word [rcx + r10 + 8]
and cx, dx
cmp r8w, cx
je 0x140004303
inc eax
cmp eax, 0x10
jb 0x1400042e0
mov eax, edx
add rsp, 0x28
ret
Function at 0x140019540
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.1400437c0
sub rsp, rax
mov rax, qword [0x14005b040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140019602
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003734c
cmp rax, 1
jne 0x14001965e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x1400195df
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x1400195d3
cmp rcx, 1
jb 0x14001965e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400195a0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140019633
lea rcx, [rsp + 0x80]
call fcn.14003888c
jmp 0x140019635
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140028910
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14002c040
int3

Function at 0x140019670
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14005b040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebp, ebp
lea rsi, str.NUITKA_PYTHONPATH
mov word [rsp + 0x30], bp
lea rbx, [rsp + 0x30]
mov edi, 0x28
mov al, 0x4e
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.14003734c
cmp rax, 1
jne 0x140019755
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x1400196fc
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x1400196f0
cmp rcx, 1
jb 0x140019755
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400196c0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140028910
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14002c040
int3
Function at 0x1400233c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x1400600ae], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x140023443
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140060080], rax
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x140060080], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x140060080], rdx
call fcn.140021740
cmp eax, ebx
jne 0x1400235ad
mov byte [0x1400600ae], 1
lea rdx, [0x14004e430]
mov rcx, rsi
call fcn.140043980
test eax, eax
je 0x1400234ce
cmp byte [0x1400600af], 1
je 0x1400234ce
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1400607c0], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140060c88], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x1400604f0], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140060448], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140060d00], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140060578], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140060c90], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x140060ca8], rax
mov byte [0x1400600af], 1
mov r8, qword [0x140060080]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
nop
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x1400234f7
inc rax
test cl, cl
jne 0x1400234e0
mov ecx, r9d
jmp 0x1400234fc
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x140023503
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x140023568
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x140023545
inc rax
test cl, cl
jne 0x140023530
mov ecx, r9d
jmp 0x14002354a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x140023551
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x140023520
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x140023598
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140022440
add rdi, 8
sub rbx, 1
jne 0x140023580
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.140033e7c
call fcn.14002c040
int3

Function at 0x1400292e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140029332
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140029332
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140029332
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140029332
cmp dword [rcx + 0x84], 0xe
jbe 0x140029332
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140029334
xor al, al
add rsp, 0x28
ret
Function at 0x14002c19c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002c20b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002c20b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002c20b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002c20b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002c20b
cmp dword [rcx + 0x84], 0xe
jbe 0x14002c20b
cmp dword [rcx + 0xf8], 0
je 0x14002c20b
mov ecx, ebx
call fcn.14002c2bc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002c098
nop
cmp dword [rbp + 0x20], 0
je 0x14002c259
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002c264
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002c19c

Function at 0x14002c3a0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002c20b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002c20b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002c20b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002c20b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002c20b
cmp dword [rcx + 0x84], 0xe
jbe 0x14002c20b
cmp dword [rcx + 0xf8], 0
je 0x14002c20b
mov ecx, ebx
call fcn.14002c2bc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002c098
nop
cmp dword [rbp + 0x20], 0
je 0x14002c259
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002c264
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002c19c
Function at 0x14003d2a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14003d327
mov rsi, rbx
cmp word [rax], bp
je 0x14003d2e6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14003d2d0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14003d2cc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14003aea8
mov rdi, rax
test rax, rax
je 0x14003d314
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140043e20
mov rbp, rdi
xor ecx, ecx
call fcn.140038ef8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003fa2c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003fa42
mov al, 1
jmp 0x14003faa2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003fa53
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003faa0
mov ecx, dword [rcx + 0x18]
nop
call fcn.14003da44
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003faa0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003faa0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003faa0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003faa2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400436d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400436f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400436f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001c10
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x1400e6f00]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
mov rdi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x140001c42
mov rcx, qword [rdx]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
cmp qword [rbx + 0x18], 0xf
jbe 0x140001c64
mov rbx, qword [rbx]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x22
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140006b80
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x2c], edx
cmp qword [rsp + 0xb8], 0
je 0x140001cfc
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
sub r8, rdx
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x38]
call fcn.140006ac0
test rax, rax
jne 0x140001cfc
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rsp + 0x30]
call fcn.140001d30
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400b2640
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x140005af0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140005b11
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140005b3e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140005b40
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005b99
test ecx, ecx
jle 0x140005b79
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005b99
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005b99
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
invalid
Function at 0x140005bc0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140005be2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140005bf1
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140005c14
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140005c16
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005c52
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140005cee
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140005c8d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140005cce
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140005cee
cmp rbx, rax
ja 0x140005ca0
test rbx, rbx
je 0x140005cee
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
push rbp
mov cl, 0x76
mov ebp, 0x7cf29a99
ret