joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a0d0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, qword [0x140597530]
mov eax, edx
and eax, 0x1f
cmp byte [rbx + rax + 0x3756], 0
je 0x14003a199
mov esi, edx
mov rdi, rcx
mov r14, qword [rbx + 0x3ea0]
cmp eax, 0xa
ja 0x14003a11b
add eax, 0x81
lea rax, [rax + rax*2]
cmp byte [rbx + rax*4 + 0x3f50], 0
jne 0x14003a199
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140025d80
test al, al
je 0x14003a199
test rdi, rdi
je 0x14003a1ca
mov rax, qword [r14 + 0xf0]
movsxd rcx, dword [r14 + 0xe8]
mov ebx, dword [rax + rcx*4 - 4]
movzx r8d, byte [rdi]
test r8b, r8b
je 0x14003a1a7
not ebx
lea rax, [rdi + 2]
lea rcx, [0x140166ca0]
mov edx, ebx
jmp 0x14003a17d
movzx r8d, r8b
movzx r10d, dl
shr edx, 8
xor r10d, r8d
xor edx, dword [rcx + r10*4]
inc rax
mov r8d, r9d
test r9b, r9b
je 0x14003a1a3
movzx r9d, byte [rax - 1]
cmp r8b, 0x23
jne 0x14003a160
cmp r9b, 0x23
jne 0x14003a160
cmp byte [rax], 0x23
cmove edx, ebx
mov r9b, reloc.WLDAP32.dll_Ordinal_35
jmp 0x14003a160
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
not edx
mov ebx, edx
mov rax, qword [0x140597530]
cmp dword [rax + 0x3ee8], ebx
jne 0x14003a1d0
mov ecx, ebx
mov edx, ntohl
mov r8, rdi
xor r9d, r9d
call fcn.1400253a0
jmp 0x14003a1d0
mov ebx, dword [rbx + 0x473c]
mov ecx, ebx
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400397e0

Function at 0x14003afc0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
lea r14, [rcx + 0x5c18]
cmp qword [rcx + 0x5c10], 0
je 0x14003b0c9
mov rsi, rcx
cmp dword [rcx + 0x5c1c], 0
jns 0x14003b06d
mov rax, qword [0x140597530]
test rax, rax
je 0x14003b004
inc dword [rax + 0xf4]
mov rdx, qword [0x140597540]
xor ecx, ecx
call qword [0x1401ab6a8]
mov r15, rax
mov rdx, qword [rsi + 0x5c20]
test rdx, rdx
je 0x14003b05c
movsxd r8, dword [rsi + 0x5c18]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsi + 0x5c20]
test rcx, rcx
je 0x14003b04f
mov rax, qword [0x140597530]
test rax, rax
je 0x14003b04f
dec dword [rax + 0xf4]
mov rdx, qword [0x140597540]
call qword [0x1401ab6b0]
mov qword [rsi + 0x5c20], r15
mov dword [rsi + 0x5c1c], 0
mov dword [rsi + 0x5c18], 0
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.14001fda0
mov r9, qword [rsi + 0x5c10]
mov eax, dword [rsi + 0x5c18]
xor ecx, ecx
sub eax, 1
cmovb eax, ecx
movsxd r8, eax
mov rax, qword [rsi + 0x5c20]
test rax, rax
lea rcx, [0x140597538]
cmovne rcx, rax
mov edx, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14001fda0
sahf
or eax, esi
nop
invalid
Function at 0x14003b0f0
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r14, qword [0x140597530]
lea rdx, [0x14017ac7e]
call sub.VCRUNTIME140.dll_strstr
mov rsi, rax
test rax, rax
cmove rsi, rdi
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
movsxd r15, dword [r14 + 0x5b98]
and eax, 0xfffffffc
lea r12d, [rax + r15]
add r12d, 0x18
mov ebp, eax
add ebp, 0x18
mov eax, dword [r14 + 0x5b9c]
cmp eax, r12d
jge 0x14003b1e8
test eax, eax
je 0x14003b168
mov r13d, eax
shr r13d, 0x1f
add r13d, eax
sar r13d, 1
add r13d, eax
jmp 0x14003b16e
mov r13d, 8
cmp r13d, r12d
cmovle r13d, r12d
cmp eax, r13d
jge 0x14003b1e8
movsxd rcx, r13d
inc dword [r14 + 0xf4]
mov rdx, qword [0x140597540]
call qword [0x1401ab6a8]
mov rbx, rax
mov rdx, qword [r14 + 0x5ba0]
test rdx, rdx
je 0x14003b1da
movsxd r8, dword [r14 + 0x5b98]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r14 + 0x5ba0]
test rcx, rcx
je 0x14003b1cd
mov rax, qword [0x140597530]
test rax, rax
je 0x14003b1cd
dec dword [rax + 0xf4]
mov rdx, qword [0x140597540]
call qword [0x1401ab6b0]
mov qword [r14 + 0x5ba0], rbx
mov dword [r14 + 0x5b9c], r13d
mov dword [r14 + 0x5b98], r12d
mov rax, qword [r14 + 0x5ba0]
mov dword [rax + r15], ebp
mov rax, qword [r14 + 0x5ba0]
lea rbx, [rax + r15]
add rbx, 4
xorps xmm0, xmm0
movups xmmword [rax + r15 + 4], xmm0
test rdi, rdi
je 0x14003b282
lea rax, [rdi - 1]
lea rcx, [rsi + 2]
mov edx, 0xffffffff
lea r8, [0x140166ca0]
mov r10d, 0xffffffff
jmp 0x14003b262
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r11d
xor r9d, dword [r8 + r10*4]
inc rcx
mov r10d, r9d
add rax, 0xffffffffffffffff
jae 0x14003b2f7
movzx r11d, byte [rcx - 2]
cmp r11d, 0x23
jne 0x14003b240
cmp rax, 2
jb 0x14003b240
cmp byte [rcx - 1], 0x23
jne 0x14003b240
cmp byte [rcx], 0x23
cmove r10d, edx
jmp 0x14003b240
movzx r8d, byte [rsi]
test r8b, r8b
je 0x14003b2f1
lea rax, [rsi + 2]
mov ecx, 0xffffffff
lea rdx, [0x140166ca0]
mov r10d, 0xffffffff
jmp 0x14003b2d4
movzx r8d, r8b
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r8d
xor r9d, dword [rdx + r10*4]
inc rax
mov r8d, r11d
mov r10d, r9d
test r11b, r11b
je 0x14003b2f7
movzx r11d, byte [rax - 1]
cmp r8b, 0x23
jne 0x14003b2b0
cmp r11b, 0x23
jne 0x14003b2b0
cmp byte [rax], 0x23
cmove r10d, ecx
mov r11b, reloc.WLDAP32.dll_Ordinal_35
jmp 0x14003b2b0
mov r9d, 0xffffffff
not r9d
mov dword [rbx], r9d
lea rcx, [rbx + 0x10]
inc rdi
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140067a40
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x38
movss xmm2, dword [0x14059d778]
movss xmm1, dword [0x14059d774]
movss xmm0, dword [0x1401abc90]
lea rax, [0x14059d788]
mov qword [rsp + 0x28], rax
lea rax, [0x14059d784]
mov qword [rsp + 0x20], rax
lea r9, [0x14059d780]
call fcn.14001f890
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x14059d78c]
cmp eax, ecx
je 0x140067aca
cmp dword [0x14059d790], ecx
je 0x140067abe
movss xmm0, dword [0x1401abc94]
mulss xmm0, dword [0x140170d24]
addss xmm0, dword [0x14059d780]
movss dword [0x14059d780], xmm0
mov dword [0x14059d790], ecx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14059d78c], eax
movss xmm0, dword [0x14059d780]
xorps xmm1, xmm1
ucomiss xmm1, xmm0
jbe 0x140067aea
addss xmm0, dword [0x140167ce0]
movss dword [0x14059d780], xmm0
movss xmm2, dword [0x14059d788]
movss xmm1, dword [0x14059d784]
lea rax, [0x14059d778]
mov qword [rsp + 0x28], rax
lea rax, [0x14059d774]
mov qword [rsp + 0x20], rax
lea r9, [0x1401abc90]
call fcn.14001f950
nop
add rsp, 0x38
ret
Function at 0x1400b72a0
Capabilities:
Create process on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov r8, qword [rcx + 0x10]
mov rax, qword [rcx + 0x18]
mov rdx, rax
sub rdx, r8
cmp rdx, 3
mov qword [rbp + 0x30], rcx
jae 0x1400b72fc
lea rax, [0x14017ae36]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
mov edx, 3
xor r9d, r9d
call fcn.14000ab10
jmp 0x1400b737d
lea rdx, [r8 + 3]
mov qword [rcx + 0x10], rdx
mov rsi, rcx
cmp rax, 0x10
jb 0x1400b7310
mov rsi, qword [rcx]
lea rax, [0x14017ae39]
mov edi, 3
mov ebx, 3
cmp rsi, rax
jae 0x1400b7340
lea rcx, [rsi + r8]
lea rax, [0x14017ae36]
cmp rcx, rax
jb 0x1400b7340
mov rbx, rsi
sub rbx, rax
ja 0x1400b7340
xor ebx, ebx
inc r8
lea rcx, [rsi + 3]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
lea r14, [0x14017ae36]
mov rcx, rsi
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
sub rdi, rbx
lea rdx, [rbx + r14]
add rdx, 3
add rsi, rbx
mov rcx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp - 0x18], xmm0
movabs rax, 0x4000000070
mov qword [rbp - 0x48], rax
movups xmmword [rbp - 0x40], xmm0
lea rax, str.cmd.exe
mov qword [rbp - 0x30], rax
mov rsi, qword [rbp + 0x30]
cmp qword [rsi + 0x18], 0x10
mov rax, rsi
jb 0x1400b73be
mov rax, qword [rsi]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x10], 0
lea rcx, [rbp - 0x48]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x1400b73ef
mov rcx, qword [rbp + 0x20]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jb 0x1400b7441
mov rcx, qword [rsi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400b743c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400b7462
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400bda40
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
lea rsi, [rbp + 0x18]
mov rdi, qword [rbp + 0x18]
mov qword [rbp + 0x18], 0
call sym.Geforce_Now.exe_interception_create_context
mov qword [0x14059ddd8], rax
test rax, rax
je 0x1400bdb7b
lea rdx, [sym.Geforce_Now.exe_interception_is_mouse]
mov rcx, rax
mov r8w, 0x1000
call sym.Geforce_Now.exe_interception_set_filter
mov rcx, qword [0x14059ddd8]
call sym.Geforce_Now.exe_interception_wait
mov dword [0x14059dde0], eax
test eax, eax
je 0x1400bdb7b
lea rsi, [0x14059ddc0]
nop
mov rcx, qword [0x14059ddd8]
call sym.Geforce_Now.exe_interception_wait
mov dword [0x14059dde0], eax
mov rcx, qword [0x14059ddd8]
mov edx, eax
mov r8, rsi
mov r9d, 1
call sym.Geforce_Now.exe_interception_receive
test eax, eax
jle 0x1400bdb0b
mov ecx, dword [0x14059dde0]
call sym.Geforce_Now.exe_interception_is_mouse
test eax, eax
je 0x1400bdab0
mov edx, dword [0x14059dde0]
mov rcx, qword [0x14059ddd8]
lea r8, [0x14059ddc0]
mov r9d, 1
call sym.Geforce_Now.exe_interception_send
mov qword [rbp - 0x10], rdi
mov ecx, 8
call fcn.140127dec
mov rsi, rax
lea rax, [0x140065a30]
mov qword [rsi], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1400c1980]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x1400bdb88
cmp dword [rbp - 0x18], 0
lea rsi, [rbp + 0x18]
mov rdi, qword [rbp - 0x10]
je 0x1400bdb9d
movups xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400bdba7
mov al, 1
jmp 0x1400bdb7d
xor eax, eax
mov qword [rsi], rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x28], rsi
mov dword [rbp - 0x18], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x1400bdc50
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov ecx, 8
call fcn.140127dec
mov rsi, rax
lea rax, [0x1400c2510]
mov qword [rsi], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1400c1980]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x1400bdccf
cmp dword [rbp - 8], 0
je 0x1400bdce4
movups xmm0, xmmword [rbp - 0x10]
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400bdcee
mov eax, 1
add rsp, 0x68
pop rsi
pop rbp
ret
mov qword [rbp - 0x18], rsi
mov dword [rbp - 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400bdd50
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov ecx, 8
call fcn.140127dec
mov rsi, rax
lea rax, [0x1400c3fb0]
mov qword [rsi], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1400c1980]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x1400bddcf
cmp dword [rbp - 8], 0
je 0x1400bdde4
movups xmm0, xmmword [rbp - 0x10]
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400bddee
mov eax, 1
add rsp, 0x68
pop rsi
pop rbp
ret
mov qword [rbp - 0x18], rsi
mov dword [rbp - 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x1400bde50
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov ecx, 8
call fcn.140127dec
mov rsi, rax
lea rax, [0x1400c5810]
mov qword [rsi], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1400c1980]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x1400bdecf
cmp dword [rbp - 8], 0
je 0x1400bdee4
movups xmm0, xmmword [rbp - 0x10]
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400bdeee
mov eax, 1
add rsp, 0x68
pop rsi
pop rbp
ret
mov qword [rbp - 0x18], rsi
mov dword [rbp - 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400bdf50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea r15, [rbp + 0x38]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
lea rdi, [rbp - 0x40]
lea rbx, [rbp - 0x10]
jmp 0x1400bdfc5
mov byte [r14 + 0x3730], 1
movss xmm0, dword [r14 + 0xdf8]
movss dword [r14 + 0x36e0], xmm0
mov al, 1
mov byte [r14 + 0xdfc], al
mov rcx, rsi
call fcn.1400c5d70
cmp dword [rbp - 0x38], 0x12
je 0x1400be0fc
mov rcx, qword [0x14059d9b0]
mov rax, qword [r15]
mov qword [rbp - 8], rax
mov qword [r15], 0
call qword [0x14059d110]
mov rax, qword [rbp - 8]
lea rdx, [rbp + 0x38]
mov qword [rdx], rax
mov rcx, qword [0x14059d9b0]
mov qword [rdx], 0
mov edx, 5
call qword [0x14059d0f8]
mov rax, qword [rbp - 8]
lea rcx, [rbp + 0x38]
mov qword [rcx], rax
mov rdx, qword [0x14059d9b0]
mov qword [rcx], 0
mov rax, qword [0x14059d0c8]
mov dword [rsp + 0x20], 1
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call rax
mov rcx, qword [rbp - 8]
lea r15, [rbp + 0x38]
mov qword [r15], rcx
test eax, eax
je 0x1400be078
mov qword [r15], 0
mov rcx, rdi
call qword [0x14059d0d0]
lea rax, [rbp + 0x38]
mov qword [rax], 0
mov rcx, rdi
call qword [0x14059d0d8]
mov rax, qword [rbp - 8]
lea rcx, [rbp + 0x38]
mov qword [rcx], rax
mov r15, rcx
call fcn.140026380
mov r14, rax
mov rax, qword [0x14059d9b0]
mov qword [r14 + 0xc8], rax
mov dword [r14 + 0x10], 0x3c888889
mov rax, qword [r15]
mov qword [rbp - 8], rax
mov qword [r15], 0
mov rcx, rbx
call qword [0x14059d068]
lea rax, [rbp + 0x38]
mov rcx, qword [rbp - 8]
mov qword [rax], rcx
movsd xmm0, qword [rbp - 0x10]
cvtdq2ps xmm0, xmm0
movlps qword [r14 + 0xdf4], xmm0
mov rcx, qword [rax]
mov qword [rbp - 8], rcx
mov qword [rax], 0
mov ecx, 1
call qword [0x14059d0b0]
lea r15, [rbp + 0x38]
mov rcx, qword [rbp - 8]
mov qword [r15], rcx
test ax, ax
jne 0x1400bdf90
xor eax, eax
jmp 0x1400bdfac
call fcn.1400534b0
call fcn.1400536b0
xor ecx, ecx
call fcn.1400232e0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400be120
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400be120
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400be155
test r8d, r8d
je 0x1400be120
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
movzx ebx, byte [rax + rsi]
test bl, bl
je 0x1400be150
add rsi, r10
mov edi, 0x811c9dc5
nop
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
movzx ebx, byte [rsi]
inc rsi
test bl, bl
jne 0x1400be170
cmp edi, 0x94c486dd
jne 0x1400be150
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, qword [0x14059d9b0]
call rdx
mov al, 1
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x1400bec10
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x140596f00]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x1400bed3d
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x1400bec6d
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x1400bec6d
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x1400bed82
cmp qword [rdi + 0x80], 0
je 0x1400bed41
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x1400beca7
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x1400bed48
mov byte [rsp + 0x5f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5f]
mov r8, rbx
call qword [r10 + gethostname]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x1400bed61
mov r15, qword [rsp + 0x48]
sub r15, r14
je 0x1400bed2d
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x1400bed80
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rbx
mov eax, 0xffffffff
jmp 0x1400bed7b
xor esi, esi
jmp 0x1400bed82
mov esi, 0xffffffff
jmp 0x1400bed82
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x1400bed82
cmp eax, 3
jne 0x1400bed80
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140128080
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400bf1f0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x1400bf22b
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je case.default.0x1400bf224
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor esi, esi
jmp 0x1400bf329
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400bf285
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x1400bf285
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x1400bf296
jmp 0x1400bf326
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x1400bf326
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x1400bf2c2
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
nop dword [rax]
cmp r14, 0x1000
jb 0x1400bf301
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call r15
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x1400bf2d0
jmp 0x1400bf326
test r14, r14
je 0x1400bf323
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub r14, rax
jmp 0x1400bf326
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
invalid
Function at 0x1400bf340
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je case.default.0x1400bf36f
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400bf3c3
test rsi, rsi
jle 0x1400bf3c3
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x1400bf3c3
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x1400bf3cb
jmp 0x1400bf3eb
mov r14, rsi
test r14, r14
jle 0x1400bf3eb
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x1400bf3eb
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
sbb dword [rdx], ebp
sub eax, 0xa82850d3
or ebp, dword [rdi + 0x36db6194]
pop rsi
mov esp, 0x39b2fd14
cmp dword [rax + 0x55], edx
jp 0x140315286
ror byte [rax - 0x7baad7ad], cl
outsb dx, byte [rsi]
invalid
jp 0x1403152c0
scasb al, byte [rdi]
movsd dword [edi], dword [esi]
int 0x9b
loope 0x1403152d4
adc bh, byte [rax]
mov dword [rax + 0x70d56a63], ecx
mov edi, 0x803bbba4
lahf
lodsd eax, dword [rsi]
xbegin 0x199762863
cmpsd dword [rsi], dword [rdi]
invalid
stosd dword [rdi], eax
out dx, eax
stc
invalid
leave
invalid

Function at 0x1400bf7e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x140596f00]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x1400bf88a
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x1400bf88a
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1400bf888
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x1400bf8a1
cmp eax, 1
je 0x1400bf857
test eax, eax
jne 0x1400bf888
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x1400bf87e
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x1400bf888
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x1400bf88a
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140128080
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x1400bf88a