joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400144d0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400144dd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400144ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400144d5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140014505
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400144f2
sub eax, 3
jb 0x14001451f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140014556
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140014546
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140014544
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140014533
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140014492
jmp 0x1400144dd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x7a00
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400145a2
cmp rsi, rcx
jae 0x1400145aa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140014589
cmp al, 0x8f
ja 0x140014589
cmp byte [rsi - 2], 0xf
je 0x14001458f
sub al, 0xe8
cmp al, 1
ja 0x140014573
cmp rsi, rcx
jae 0x1400145aa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140014579
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400145aa
lodsb al, byte [rsi]
jmp 0x140014589
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x12000]
mov eax, dword [rdi]
or eax, eax
je 0x140014607
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x14000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400145b7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140014601
mov qword [rbx], rax
add rbx, 8
jmp 0x1400145d7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140014641
cmp al, 0xef
ja 0x140014633
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140014613
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140014622
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1400146c0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1400146c0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400146b0
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x1800016e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov r10d, dword [rsp + 0x58]
lea eax, [rcx - 0x35df]
mov ebx, dword [rsp + 0x50]
mov edx, r10d
xor edx, 0x2e7e
xor r10d, 0x1bda
xor eax, 0x3fc9
lea r11d, [rbx + 0x11ab]
cmp edx, eax
jg 0x180001919
mov eax, ebx
xor eax, 0x3e7
add eax, 0x85
cmp edx, eax
jg 0x1800018d3
mov edx, dword [0x1800590a0]
add edx, 0x15e6
add edx, dword [r9 + 0x10]
mov dword [r9 + 0x64], edx
mov eax, dword [r9 + 0x80]
sub eax, dword [0x1800590ec]
add eax, 0x10a
add eax, edx
mov dword [r9 + 0x64], eax
mov rax, qword [section..data]
add dword [rax + 0x64], 0x123
mov eax, 0xfcfcd8ff
sub eax, dword [r9 + 0x6c]
sub eax, dword [0x18005906c]
add dword [r9 + 0x64], eax
cmp dword [r9 + 0x6c], 0x4860
mov rcx, qword [section..data]
je 0x18000179c
mov eax, 0xbab76
sub eax, dword [rcx + 0x130]
add dword [0x180059074], eax
cmp dword [r9 + 0x1c], 0x12675
jb 0x1800017b4
lea rax, str.__G_v
mov qword [rcx + 0xa0], rax
xor r10d, r10d
nop word [rax + rax]
movsxd rcx, dword [0x180059078]
mov rax, qword [r9 + 0xa0]
mov r8d, dword [rax + r10]
add r10, 4
imul r8d, dword [r9 + 0x64]
mov rax, qword [r9 + 0xa8]
mov edx, r8d
shr edx, 0x10
mov byte [rcx + rax], dl
inc dword [0x180059078]
mov ecx, dword [r9 + 0xd0]
mov eax, dword [r9 + 0x50]
xor ecx, 2
imul eax, ecx
mov dword [r9 + 0x50], eax
mov rdx, qword [section..data]
mov ecx, dword [rdx + 0x104]
mov eax, dword [rdx + 0x34]
inc ecx
imul eax, ecx
mov dword [rdx + 0x34], eax
mov rdx, qword [section..data]
mov eax, dword [0x180059158]
inc eax
mov ecx, dword [rdx + 0x10]
imul ecx, eax
mov dword [rdx + 0x10], ecx
mov edx, r8d
mov rax, qword [0x1800590b8]
movsxd rcx, dword [r9 + 0x68]
shr edx, 8
mov byte [rcx + rax], dl
inc dword [r9 + 0x68]
mov eax, dword [r9 + 0xec]
xor eax, 0x1bd89d
add dword [0x1800590a0], eax
mov rax, qword [section..data]
movsxd rdx, dword [r9 + 0x68]
mov rcx, qword [rax + 0xa8]
mov byte [rdx + rcx], r8b
inc dword [r9 + 0x68]
mov eax, dword [r9 + 0xdc]
mov ecx, dword [r9 + 0xc4]
add eax, 0xff0c5a58
mov rdx, qword [section..data]
add ecx, eax
or dword [rdx + 0x10], ecx
mov rax, qword [section..data]
mov ecx, dword [r9 + 0x140]
sub ecx, dword [rax + 0x90]
xor ecx, 0xffee0a9e
sub dword [r9 + 0x134], ecx
cmp r10, 0x14b0
jl 0x1800017c0
lea eax, [rbx + 0x591]
add rsp, 0x20
pop rbx
ret
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x10c]
xor eax, 0x2e7e
cmp dword [0x180059094], eax
jb 0x180001919
mov r8d, dword [0x1800590f8]
mov edx, dword [r9 + 0x130]
imul r8d, r10d
and edx, r11d
or r10d, 0x35c7
xor r8d, dword [rcx + 0x148]
mov ecx, r10d
call qword [sym.imp.KERNEL32.dll_OpenThread]
lea eax, [rbx + 0x591]
add rsp, 0x20
pop rbx
ret
Function at 0x180001bd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
lea r10d, [r8 + 0xa02]
mov r9, qword [rsp + 0x68]
mov r11d, ecx
xor r11d, 0x10a1
mov esi, r8d
lea edx, [rax + 0x4e9]
lea ebx, [rax - 0x1ae]
lea edi, [rdx - 0x47c]
lea eax, [r8 - 0x749]
cmp eax, edi
jg 0x180001d91
lea eax, [r10 + 0xc]
cmp ebx, eax
jg 0x180001d59
mov qword [rsp + 0x40], r14
xor r14d, r14d
mov rdx, qword [section..data]
mov ecx, dword [0x180059060]
mov eax, dword [rdx + 0x130]
sub eax, 0xb9fca
imul ecx, eax
mov dword [0x180059060], ecx
mov eax, dword [r9 + 0xbc]
xor eax, 0x1b8e3e
add dword [rdx + 0x104], eax
mov rax, qword [r9 + 0xa0]
movsxd rcx, dword [0x180059078]
mov r8d, dword [r14 + rax]
add r14, 4
imul r8d, dword [0x180059074]
mov eax, dword [0x1800590ec]
sub dword [0x1800590d4], eax
mov rax, qword [r9 + 0xa8]
mov edx, r8d
shr edx, 0x10
mov byte [rcx + rax], dl
inc dword [0x180059078]
mov rdx, qword [section..data]
mov ecx, dword [rdx + 0x50]
mov eax, dword [rdx + 0x2c]
xor ecx, 0xfff3d0fa
imul eax, ecx
mov dword [rdx + 0x2c], eax
mov edx, r8d
mov eax, dword [r9 + 0xec]
mov ecx, dword [r9 + 0x18]
inc ecx
shr edx, 8
imul eax, ecx
movsxd rcx, dword [r9 + 0x68]
mov dword [r9 + 0xec], eax
mov rax, qword [r9 + 0xa8]
mov byte [rcx + rax], dl
inc dword [r9 + 0x68]
movsxd rcx, dword [r9 + 0x68]
mov rax, qword [0x1800590b8]
mov byte [rcx + rax], r8b
mov eax, 1
sub eax, dword [r9 + 0x10c]
inc dword [r9 + 0x68]
sub eax, dword [0x180059028]
mov rcx, qword [section..data]
add dword [rcx + 0x34], eax
mov eax, dword [r9 + 0xc4]
xor eax, 0xf3a5a8
sub dword [0x180059090], eax
cmp r14, 0x22950
jl 0x180001c31
mov rdx, qword [section..data]
mov r14, qword [rsp + 0x40]
mov eax, dword [rdx + 0x148]
add eax, 0x35931
mov dword [0x180059074], eax
jmp 0x180001d98
xor edx, 0x3bc2
cmp dword [0x18005906c], edx
jb 0x180001d91
mov eax, dword [r9 + 0x60]
sub eax, dword [r9 + 0x124]
add eax, ebx
cmp r11d, eax
jae 0x180001d91
mov ecx, dword [r9 + 0x5c]
or ecx, dword [0x180059030]
xor ecx, dword [r9 + 0x5c]
xor ecx, 0x2e92
mov dword [r9 + 0x5c], ecx
mov rdx, qword [section..data]
cmp r10d, edi
je 0x180001ddd
cmp dword [rdx + 0x104], 0x15ead
jae 0x180001db8
mov eax, 0xffffe7d3
sub eax, dword [0x180059158]
add dword [r9 + 0x64], eax
add ebx, 0x256
mov dword [rsp + 0x20], edi
lea r8d, [r10 - 0xfd2]
lea edx, [rsi + 0x459]
lea ecx, [r10 - 0x11d0]
call sym.iixfgec031pc.dll_NIBPcz441G
jmp 0x180001de8
mov ecx, ebx
xor ecx, r11d
sub dword [rdx + 0x148], ecx
mov rsi, qword [rsp + 0x50]
xor ebx, 0x1b4d
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180002700
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x40
mov r15d, dword [rsp + 0x80]
lea r12d, [rdx + 0x2fd]
mov esi, dword [rsp + 0x88]
xor r15d, 0x33af
mov ebp, r8d
mov r14d, edx
xor ebp, 0x1435
xor r14d, 0x1435
add esi, 0x459
lea eax, [r15 + 0x3862]
cmp r14d, eax
mov rax, qword [rsp + 0x90]
jg 0x18000278d
cmp dword [rax + 0x80], 0x12283
je 0x180002843
mov rdx, qword [section..data]
mov eax, 0x1325cc
mov ecx, dword [rdx + 0xbc]
xor ecx, dword [rdx + 0x10]
sub eax, ecx
add dword [rdx + 0x2c], eax
jmp 0x180002843
mov edx, dword [0x180059108]
mov qword [rsp + 0x60], rbx
mov ebx, dword [rax + 0x5c]
mov eax, edx
or eax, 0x3ebf
cmp ebx, eax
je 0x18000283e
mov rcx, qword [section..data]
and ebp, 0x3fd5
mov qword [rsp + 0x68], rdi
nop dword [rax]
cmp dword [rcx + 0x2c], ebp
jb 0x18000282c
mov r8d, dword [rcx + 0x28]
mov eax, r15d
mov edi, dword [0x18005911c]
or eax, 0x2ff7
mov r9d, dword [0x180059104]
sub eax, r14d
mov ecx, dword [rcx + 0x10]
mov r11d, esi
movsxd r10, eax
and edi, esi
imul r11d, r14d
lea eax, [r14 + 0x3862]
mov dword [rsp + 0x30], edi
add r9d, 0xffffc79e
mov qword [rsp + 0x28], r10
sub ecx, 0x3862
imul r8d, r12d
movsxd rdx, eax
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CallNamedPipeA]
mov rcx, qword [section..data]
mov edx, dword [0x180059108]
mov eax, edx
inc ebx
or eax, 0x3ebf
cmp ebx, eax
jne 0x1800027c0
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
lea eax, [rsi - 0x441]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x18000afc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, dword [rsp + 0x60]
lea esi, [r8 + 0xbcb]
mov edx, ecx
lea ebx, [r8 + 0x392]
xor edx, 0x2df9
xor ecx, 0x3c4
lea edi, [rax - 0x35a4]
lea r11d, [rax + 0xa31]
cmp edi, esi
jg 0x18000b08b
cmp dword [r9 + 0x140], 0x4d5
je 0x18000b01d
add dword [0x180059074], 0xfffffcf2
jmp 0x18000b03d
mov rdx, qword [section..data]
mov ecx, dword [r9 + 0x1c]
sub ecx, 0x26bf7
mov eax, dword [rdx + 0x140]
imul eax, ecx
mov dword [rdx + 0x140], eax
cmp dword [0x1800590fc], 0xc5c4
jae 0x18000b06f
mov eax, dword [r9 + 0xd0]
mov ecx, dword [r9 + 0x1c]
sub ecx, dword [0x180059144]
add ecx, dword [0x180059050]
imul eax, ecx
mov dword [r9 + 0xd0], eax
jmp 0x18000b0fd
mov rax, qword [section..data]
mov ecx, dword [rax + 0x60]
sub ecx, dword [rax + 0x148]
sub ecx, 0x13e9ab
xor dword [r9 + 0x64], ecx
jmp 0x18000b0fd
mov eax, dword [r9 + 0x70]
or eax, edi
cmp edx, eax
jne 0x18000b0fd
mov eax, dword [r9 + 0xdc]
mov r8, qword [section..data]
or eax, ebx
and eax, 0x2e7e
cmp dword [r8 + 0x5c], eax
jbe 0x18000b104
add ecx, dword [0x180059034]
mov r10d, dword [r8 + 0x50]
sub edi, ecx
sub r11d, dword [r8 + 0x148]
mov ecx, dword [r8 + 0xd0]
imul r11d, dword [r8 + 0x18]
and ecx, ebx
mov r9d, dword [r9 + 0x28]
add r10d, dword [0x180059060]
add r9d, edx
sub ecx, dword [0x180059110]
movsxd rdx, esi
mov r8d, r11d
mov qword [rsp + 0x20], r10
or rdx, 0x35c7
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8, qword [section..data]
lea eax, [rbx + 0x1ae]
cmp edi, eax
jge 0x18000b11d
mov eax, dword [r8 + 0x10]
xor eax, 0xf2
sub dword [0x180059074], eax
mov rsi, qword [rsp + 0x48]
lea eax, [rbx + 0xc40]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140002500
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140002521
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000254e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002550
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400025a9
test ecx, ecx
jle 0x140002589
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400025a9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400025a9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
and al, 0xc0
add dword [rax], eax
add byte [rax - 0x75], cl
ror dword [rax - 0x7f], 0xfa
add byte [rax], dl
add byte [rax], al
jb 0x14000ea7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ed87
call 0x14002791c
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x14000eac7
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
adc byte [rax], al
add byte [rdx + 0x19], dh
call qword [0x14002a780]
int3
Function at 0x1400025d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400025f2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140002601
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002624
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002626
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002662
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400026fe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000269d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400026de
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400026fe
cmp rbx, rax
ja 0x1400026b0
test rbx, rbx
je 0x1400026fe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
jb 0x14000ea1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ed25
call 0x14002791c
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1b8], 0xf
mov byte [rsp + 0x1a0], 0
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 0x10
jb 0x14000ea84
inc rdx
mov rcx, qword [rsp + 0x1c0]
and al, 0xc0
add dword [rax], eax
add byte [rax - 0x75], cl
ror dword [rax - 0x7f], 0xfa
add byte [rax], dl
add byte [rax], al
call qword [0x14002a780]
int3
Function at 0x140002b20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002b4d
xor eax, eax
jmp 0x140002caa
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140002b78
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140002b78
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140002caa
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002c9d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140002bbb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002be6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002ca2
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002c55
sub eax, 1
je 0x140002c55
cmp eax, 2
jne 0x140002c9d
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002ca2
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002c83
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002c9d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002ca2
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400041c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002fd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400030a3
cmp byte [rcx + 0x71], 0
je 0x1400030a3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000309f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003064
sub eax, 1
je 0x140003068
cmp eax, 2
jne 0x14000309f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400041c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003096
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000309f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000304c
xor al, al
jmp 0x14000304c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400041c0
add rsp, 0x60
pop rbx
ret

Function at 0x140004c28
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004c72
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004c72
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004c72
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004c72
cmp dword [rcx + 0x84], 0xe
jbe 0x140004c72
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004c74
xor al, al
add rsp, 0x28
ret
Function at 0x140002e30
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140049058]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov dword [rsp + 0x58], 3
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rbx, r8
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov qword [rsp + 0x50], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0x20007
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000c2e0
add rsp, 0x70
pop rbx
ret
Function at 0x1400082b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400082d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000834c
mov rdi, r14
mov rcx, rbx
call fcn.140009a90
test rax, rax
jle 0x140008324
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14000e1a0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000833c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140008344
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400082e6
sub r14, rdi
jmp 0x14000842f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140008363
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140008365
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140008397
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14000e1a0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000842c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400083d2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000840d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140018998
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000842c
cmp rbp, rax
ja 0x1400083e0
test rbp, rbp
je 0x14000842c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140018998
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret