joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001a90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
lea rdx, [0x14002c7a4]
add rcx, 0x70
mov esi, 0xffffffff
call fcn.1400031a0
mov rdi, rax
test rax, rax
je 0x140001c79
mov rax, qword [0x14002ea08]
lea r8d, [rsi + 9]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
shr rax, 0x18
mov rcx, rdi
add al, 0xc
mov qword [rsp + 0x48], rbp
mov byte [rsp + 0x23], al
call fcn.1400074c0
mov rbp, rax
test rax, rax
je 0x140001c6c
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.1400102a4
test eax, eax
jns 0x140001b34
lea rdx, [0x14002c938]
lea rcx, [0x14002c81c]
call fcn.140001fc0
jmp 0x140001c6c
mov edx, 0x58
lea rcx, [rbx + 0x18]
mov r9, rdi
lea r8d, [rdx - 0x57]
call fcn.14000ff6c
cmp rax, 1
jae 0x140001b67
lea rdx, [0x14002c960]
lea rcx, [0x14002c75c]
call fcn.140001fc0
jmp 0x140001c6c
mov ecx, dword [rbx + 0x20]
xor r8d, r8d
mov eax, dword [rbx + 0x24]
bswap eax
mov dword [rbx + 0x24], eax
mov eax, dword [rbx + 0x28]
bswap eax
mov dword [rbx + 0x28], eax
mov eax, dword [rbx + 0x2c]
bswap ecx
mov ecx, ecx
sub rbp, rcx
mov dword [rbx + 0x20], ecx
bswap eax
mov dword [rbx + 0x2c], eax
add rbp, 0x58
mov qword [rbx], rbp
mov rcx, rdi
mov dword [rbx + 0x5078], 0
mov dword [0x14003fd04], eax
mov edx, dword [rbx + 0x24]
add rdx, qword [rbx]
call fcn.1400102a4
movsxd rcx, dword [rbx + 0x28]
call fcn.14001575c
mov qword [rbx + 8], rax
test rax, rax
jne 0x140001bde
lea rdx, [0x14002c978]
lea rcx, [0x14002c644]
call fcn.140001fc0
jmp 0x140001c6c
movsxd rdx, dword [rbx + 0x28]
mov r9, rdi
mov r8d, 1
mov rcx, rax
call fcn.14000ff6c
cmp rax, 1
jae 0x140001c0e
lea rdx, [0x14002c9a0]
lea rcx, [0x14002c75c]
call fcn.140001fc0
jmp 0x140001c6c
movsxd rax, dword [rbx + 0x28]
mov rcx, rdi
add rax, qword [rbx + 8]
mov qword [rbx + 0x10], rax
call fcn.14000fce0
test eax, eax
je 0x140001c34
lea rcx, [0x14002c9c0]
call fcn.140002000
jmp 0x140001c6c
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jae 0x140001c6a
nop
mov ecx, dword [rax + 4]
mov edx, dword [rax]
bswap ecx
mov dword [rax + 4], ecx
mov ecx, dword [rax + 8]
bswap ecx
mov dword [rax + 8], ecx
mov ecx, dword [rax + 0xc]
bswap ecx
mov dword [rax + 0xc], ecx
bswap edx
mov dword [rax], edx
movsxd rcx, edx
add rax, rcx
cmp rax, qword [rbx + 0x10]
jb 0x140001c40
xor esi, esi
mov rcx, rdi
call fcn.14000fc1c
mov rbp, qword [rsp + 0x48]
mov eax, esi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14000b2e0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140006630
Capabilities:
Create directory
Query environment variable

Disassembly:
push rdi
mov eax, 0x4030
call fcn.14000b280
sub rsp, rax
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.1400080b0
mov rdi, rax
test rax, rax
jne 0x140006679
lea rcx, [0x14002ea10]
call fcn.140002000
xor eax, eax
jmp 0x140006788
mov r8d, 0x1000
mov qword [rsp + 0x4048], rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
mov ebx, eax
call fcn.140015748
test ebx, ebx
jne 0x1400066b6
lea rcx, [0x14002ea50]
call fcn.140002000
xor eax, eax
jmp 0x140006780
lea rcx, [rsp + 0x20]
call fcn.140007d30
test eax, eax
je 0x1400066d0
lea rcx, [rsp + 0x20]
call fcn.140018238
jmp 0x1400066e2
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
xor ecx, ecx
call fcn.140016b48
mov rbx, rax
test rax, rax
jne 0x1400066fd
lea rcx, [0x14002eaa0]
call fcn.140002000
xor eax, eax
jmp 0x140006780
xor edx, edx
lea rcx, [rsp + 0x2020]
mov r8d, 0x2000
call fcn.14002b640
mov edx, 0x5c
mov rcx, rbx
call fcn.14000c1a8
mov rdi, rax
test rax, rax
je 0x140006772
nop word [rax + rax]
mov r8, rdi
lea rcx, [rsp + 0x2020]
sub r8, rbx
mov rdx, rbx
sar r8, 1
inc r8
call fcn.1400182bc
xor edx, edx
lea rcx, [rsp + 0x2020]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x5c
lea rcx, [rdi + 2]
call fcn.14000c1a8
mov rdi, rax
test rax, rax
jne 0x140006730
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, rbx
mov rbx, qword [rsp + 0x4048]
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.14000b2e0
add rsp, 0x4030
pop rdi
ret
Function at 0x1400067b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2040
call fcn.14000b280
sub rsp, rax
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov rbx, rdx
mov qword [rsp + 0x2078], rbp
lea rdx, [0x14002c7a4]
mov rbp, r8
call fcn.1400031a0
mov r9, rbx
mov qword [rsp + 0x28], rbp
lea r8, [0x14002c874]
mov dword [rsp + 0x20], 0x5c
mov edx, 0x1000
lea rcx, [rsp + 0x30]
mov rdi, rax
call fcn.140001ee0
cmp eax, 0x1000
jl 0x140006826
xor esi, esi
mov ebx, esi
jmp 0x1400068dc
lea rcx, [rsp + 0x30]
call fcn.140003130
xor esi, esi
cmp eax, 1
jne 0x1400068b4
mov eax, dword [0x14003f004]
cmp eax, 0xffffffff
jne 0x140006883
lea rcx, [0x14002eb40]
call fcn.140006d70
mov r8, rax
test rax, rax
je 0x14000689d
movzx edx, byte [rax]
sub edx, 0x30
jne 0x140006868
movzx edx, byte [rax + 1]
movzx ecx, sil
sub edx, ecx
mov eax, esi
test edx, edx
mov rcx, r8
setne al
mov dword [0x14003f004], eax
call fcn.140015748
mov eax, dword [0x14003f004]
test eax, eax
je 0x1400068a3
lea rdx, [rsp + 0x30]
lea rcx, [0x14002eb68]
call fcn.140002000
mov rbx, rsi
jmp 0x1400068dc
mov dword [0x14003f004], esi
lea rdx, [rsp + 0x30]
lea rcx, [0x14002eb98]
call fcn.140002000
mov rdx, rbp
mov rcx, rbx
call fcn.1400069d0
test eax, eax
jns 0x1400068c8
mov rbx, rsi
jmp 0x1400068dc
lea rdx, [0x14002ebcc]
lea rcx, [rsp + 0x30]
call fcn.1400031a0
mov rbx, rax
mov rbp, qword [rsp + 0x2078]
test rdi, rdi
je 0x140006999
mov rcx, rdi
test rbx, rbx
je 0x1400069a1
call fcn.14000fcb4
test eax, eax
jne 0x140006985
nop word [rax + rax]
mov r9, rdi
lea rcx, [rsp + 0x1030]
mov edx, 1
mov r8d, 0x1000
call fcn.14000ff6c
test rax, rax
jne 0x140006941
mov rcx, rdi
call fcn.14000fce0
test eax, eax
je 0x14000696a
mov rcx, rdi
jmp 0x14000697b
mov r9, rbx
lea rcx, [rsp + 0x1030]
mov r8, rax
mov edx, 1
call fcn.1400106ac
test rax, rax
je 0x140006978
mov rcx, rbx
call fcn.14000fce0
test eax, eax
jne 0x140006978
mov rcx, rdi
call fcn.14000fcb4
test eax, eax
je 0x140006910
jmp 0x140006985
mov rcx, rbx
call fcn.140019354
mov esi, 0xffffffff
mov rcx, rdi
call fcn.14000fc1c
mov rcx, rbx
call fcn.14000fc1c
mov eax, esi
jmp 0x1400069ab
test rbx, rbx
je 0x1400069a6
mov rcx, rbx
call fcn.14000fc1c
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.14000b2e0
add rsp, 0x2040
pop rdi
pop rsi
pop rbx
ret
Function at 0x140006b60
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2050
call fcn.14000b280
sub rsp, rax
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x2040], rax
xor edi, edi
mov rbp, rdx
mov r15, rcx
mov esi, edi
test rdx, rdx
je 0x140006bed
lea rcx, [0x14002eae4]
call fcn.140006d70
mov rcx, rbp
mov rsi, rax
call fcn.140006630
mov r14, rax
test rax, rax
je 0x140006cbf
mov rdx, rax
lea rcx, [0x14002eae8]
call fcn.140018680
mov rcx, r14
mov ebx, eax
call fcn.140015748
test ebx, ebx
je 0x140006bed
lea rcx, [0x14002eaf0]
call fcn.140002000
xor eax, eax
jmp 0x140006d48
lea rdx, [rsp + 0x40]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.KERNEL32.dll_GetCurrentProcessId
mov r9d, eax
lea r8, [0x14002eb28]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140007770
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140019338
mov rcx, rax
mov rbx, rax
call fcn.140007e90
test eax, eax
je 0x140006cc6
mov rcx, rbx
call fcn.140015748
inc edi
cmp edi, 5
jl 0x140006c20
test rbp, rbp
je 0x140006cbf
xor r8d, r8d
lea rdx, [0x14002eae4]
xor ecx, ecx
call fcn.1400080b0
test rsi, rsi
je 0x140006ca9
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.1400080b0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140018680
mov rcx, rdi
call fcn.140015748
mov rcx, rbx
call fcn.140015748
mov rcx, rsi
call fcn.140015748
xor eax, eax
jmp 0x140006d48
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.140015748
xor eax, eax
jmp 0x140006d48
mov r8d, 0x1000
mov rdx, rbx
mov rcx, r15
call fcn.1400081c0
mov rcx, rbx
call fcn.140015748
test rbp, rbp
je 0x140006d43
xor r8d, r8d
lea rdx, [0x14002eae4]
xor ecx, ecx
call fcn.1400080b0
test rsi, rsi
je 0x140006d2d
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.1400080b0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140018680
mov rcx, rdi
call fcn.140015748
mov rcx, rbx
call fcn.140015748
mov rcx, rsi
jmp 0x140006d3e
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.140015748
mov eax, 1
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.14000b2e0
mov rbx, qword [rsp + 0x2090]
add rsp, 0x2050
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007290
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2110
call fcn.14000b280
sub rsp, rax
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x2100], rax
mov rdx, rcx
xor edi, edi
lea rcx, [rsp + 0x100]
mov dword [rsp + 0x50], edi
mov r8d, 0x1000
call fcn.1400080b0
mov ebx, 1
lea rcx, [0x140006610]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x58], 0x18
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], ebx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xorps xmm0, xmm0
mov qword [rsp + 0x98], rdi
xor ecx, ecx
movdqa xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0xcc], 0x101
mov word [rsp + 0xd0], bx
call fcn.140015ac0
mov rcx, rax
call fcn.14001b2a4
mov ecx, eax
call fcn.140018ec4
cmp rax, 0xffffffffffffffff
mov ecx, ebx
cmove rax, rdi
mov qword [rsp + 0xe0], rax
call fcn.140015ac0
mov rcx, rax
call fcn.14001b2a4
mov ecx, eax
call fcn.140018ec4
cmp rax, 0xffffffffffffffff
lea ecx, [rdi + 2]
cmove rax, rdi
mov qword [rsp + 0xe8], rax
call fcn.140015ac0
mov rcx, rax
call fcn.14001b2a4
mov ecx, eax
call fcn.140018ec4
cmp rax, 0xffffffffffffffff
cmove rax, rdi
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x100]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140007410
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x50]
jmp 0x140007428
lea rdx, [0x14002ebd0]
lea rcx, [0x14002ebf0]
call fcn.140002060
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2100]
xor rcx, rsp
call fcn.14000b2e0
mov rbx, qword [rsp + 0x2128]
add rsp, 0x2110
pop rdi
ret
Function at 0x1400074c0
Capabilities:
Read file on windows

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rcx
mov rsi, r8
mov ecx, 0x2000
mov r14, rdx
xor r13d, r13d
call fcn.14001575c
mov r15, rax
test rax, rax
je 0x1400075d3
xor edx, edx
lea r8d, [r13 + 2]
mov rcx, r12
call fcn.1400102a4
test eax, eax
js 0x1400075d3
mov rcx, r12
mov qword [rsp + 0x50], rbx
call fcn.140019904
mov rbx, rax
cmp rax, rsi
jb 0x1400075ce
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
nop dword [rax]
cmp rbx, 0x2000
lea rbp, [rbx - 0x2000]
cmovb rbp, r13
sub rbx, rbp
cmp rbx, rsi
jb 0x1400075c4
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
call fcn.1400102a4
test eax, eax
js 0x1400075c4
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.14000ff6c
cmp rax, rbx
jne 0x1400075c4
sub rbx, rsi
add rbx, 1
je 0x1400075ab
lea rdi, [r15 - 1]
add rdi, rbx
nop dword [rax]
nop dword [rax + rax]
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.14002b540
test eax, eax
je 0x1400075bd
dec rdi
sub rbx, 1
jne 0x140007590
lea rbx, [rsi - 1]
add rbx, rbp
test rbp, rbp
jne 0x140007530
jmp 0x1400075c4
lea r13, [rbp - 1]
add r13, rbx
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, r15
call fcn.140015748
mov rax, r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret

Function at 0x140007e90
Capabilities:
Create directory

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140040fb0]
test rax, rax
jne 0x140007eb6
lea rcx, [0x14002eea0]
call fcn.140002000
mov eax, 0xffffffff
add rsp, 0x48
ret
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x18
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x48
ret
Function at 0x180001050
Capabilities:
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rcx, qword [str.KERNEL32.dll]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [0x1800be868]
mov rdi, rax
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rsi
xor edx, edx
mov rcx, rax
mov r8d, ebx
mov rbx, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rbx
mov ecx, dword [0x1800be868]
mov rbp, rax
lea rdx, [rax + rcx]
test rcx, rcx
je 0x1800010b1
mov byte [rax], 0
add rax, 1
cmp rax, rdx
jne 0x1800010a5
xor ecx, ecx
mov r8d, 0x104
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [rbp], 0
mov r9, qword [str.podium.cfg]
je 0x180001390
xor edx, edx
jmp 0x1800010e2
mov edx, eax
lea ecx, [rdx + 1]
cmp word [rbp + rcx*2], 0
mov rax, rcx
jne 0x1800010e0
mov ecx, edx
add rcx, rcx
cmp word [rbp + rcx], 0x5c
jne 0x180001105
jmp sym.sqlite3.dll_sqlite3_column_database_name
mov edx, r8d
lea r8d, [rdx - 1]
xor ecx, ecx
mov word [rbp + rax*2], cx
cmp word [rbp + r8*2], 0x5c
mov eax, edx
jne 0x180001102
movabs rcx, 0x1fffffffe
xor eax, eax
mov edx, 0xffffffff
jmp qword [rsi - 0x7d]
jl 0x1800013b2
add byte [rdi + rcx - 0x7b], bl
pop rax
std
invalid
invalid
nop dword [rax]
Function at 0x180001170
Capabilities:
Get file size
Read file on windows

Disassembly:
movsx ax, byte [r9]
xor ecx, ecx
test al, al
je 0x18000114a
nop word cs:[rax + rax]
lea r8d, [rdx + rcx]
mov word [rbp + r8*2], ax
lea eax, [rcx + 1]
mov rcx, rax
movsx ax, byte [r9 + rax]
test al, al
jne 0x180001130
xor r9d, r9d
mov edx, 1
mov rcx, rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
and al, 0x28
add byte [rax], 0
add byte [rcx - 0x48], al
add dword [rax], eax
add byte [rax], al
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x180001353
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [0x1800be898]
mov r12d, eax
call rsi
xor edx, edx
mov rcx, rax
mov r8d, ebp
call rbx
mov ecx, dword [0x1800be898]
mov rbp, rax
lea rdx, [rax + rcx]
test rcx, rcx
je 0x1800011cc
nop dword [rax]
mov byte [rax], 0
add rax, 1
cmp rax, rdx
jne 0x1800011c0
mov dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
mov r8d, r12d
mov rdx, rbp
mov qword [rsp + 0x20], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001353
mov edx, dword [0x1800be894]
mov r12d, dword [rsp + 0x58]
add rdx, rbp
mov r8d, dword [rdx]
lea rax, [rdx + 8]
mov ecx, dword [rdx + 4]
test r8d, r8d
je 0x18000122b
sub r8d, 1
lea r8, [rdx + r8*4 + 0xc]
nop
add dword [rax], ecx
add rax, 4
cmp rax, r8
jne 0x180001220
mov ebx, dword [0x1800be838]
mov rcx, rdi
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rbx, rdx
lea rdx, [rbx + 1]
call rsi
test rax, rax
mov r13, rax
je 0x180001353
movsx rdx, byte [rbx]
mov rcx, rdi
add rbx, rdx
lea rdx, [rbx + 1]
call rsi
test rax, rax
mov rdi, rax
je 0x180001353
movsx rax, byte [rbx]
add rbx, rax
lea rcx, [rbx + 1]
call r13
test rax, rax
je 0x180001353
movsx rdx, byte [rbx]
lea r15, [rsp + 0x5c]
mov dword [rsp + 0x5c], 0
mov r8d, 0x40
mov r9, r15
add rbx, rdx
movsxd rdx, dword [rax + 0x3c]
mov esi, dword [rbx + 4]
mov r13d, dword [rbx + 8]
mov dword [rsp + 0x48], esi
mov esi, dword [rax + rdx + 0x2c]
mov dword [rsp + 0x4c], r13d
lea r14, [rbx + r13 + 0xc]
mov rdx, r13
add rsi, rax
mov rcx, rsi
call rdi
mov r10d, dword [rsp + 0x4c]
xor eax, eax
lea ecx, [r10 - 1]
test r10d, r10d
jne 0x180001373
nop dword [rax]
mov r9, r15
mov rdx, r13
mov rcx, rsi
mov r8d, dword [rsp + 0x5c]
call rdi
mov r15d, dword [rsp + 0x48]
add rbp, r12
xor edx, edx
mov rax, qword [str.griddlecake.bmp]
add rsi, r15
cmp byte [rax], 0
je 0x1800013b7
nop dword [rax]
mov rcx, qword [str.griddlecake.bmp]
movsx cx, byte [rcx + rdx]
mov word [rbp + rdx*2], cx
mov rcx, qword [str.griddlecake.bmp]
add rdx, 1
cmp byte [rcx + rdx], 0
jne 0x180001310
lea rax, [rbp + rdx*2]
lea rcx, [rsp + 0x60]
xor edx, edx
mov word [rax], dx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x70], 1
call rsi
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, rdx
movzx edx, byte [rbx + rax + 0xc]
cmp rax, rcx
mov byte [rsi + rax], dl
lea rdx, [rax + 1]
jne 0x180001370
jmp 0x1800012e0
mov edx, eax
jmp 0x18000111b
mov rax, rbp
jmp 0x180001337
Function at 0x1800013b0
Capabilities:
Get file size
Read file on windows

Disassembly:
movsx ax, byte [r9]
xor ecx, ecx
test al, al
je 0x18000114a
nop word cs:[rax + rax]
lea r8d, [rdx + rcx]
mov word [rbp + r8*2], ax
lea eax, [rcx + 1]
mov rcx, rax
movsx ax, byte [r9 + rax]
test al, al
jne 0x180001130
xor r9d, r9d
mov edx, 1
mov rcx, rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
and al, 0x28
add byte [rax], 0
add byte [rcx - 0x48], al
add dword [rax], eax
add byte [rax], al
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x180001353
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [0x1800be898]
mov r12d, eax
call rsi
xor edx, edx
mov rcx, rax
mov r8d, ebp
call rbx
mov ecx, dword [0x1800be898]
mov rbp, rax
lea rdx, [rax + rcx]
test rcx, rcx
je 0x1800011cc
nop dword [rax]
mov byte [rax], 0
add rax, 1
cmp rax, rdx
jne 0x1800011c0
mov dword [rsp + 0x58], 0
lea r9, [rsp + 0x58]
mov r8d, r12d
mov rdx, rbp
mov qword [rsp + 0x20], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001353
mov edx, dword [0x1800be894]
mov r12d, dword [rsp + 0x58]
add rdx, rbp
mov r8d, dword [rdx]
lea rax, [rdx + 8]
mov ecx, dword [rdx + 4]
test r8d, r8d
je 0x18000122b
sub r8d, 1
lea r8, [rdx + r8*4 + 0xc]
nop
add dword [rax], ecx
add rax, 4
cmp rax, r8
jne 0x180001220
mov ebx, dword [0x1800be838]
mov rcx, rdi
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rbx, rdx
lea rdx, [rbx + 1]
call rsi
test rax, rax
mov r13, rax
je 0x180001353
movsx rdx, byte [rbx]
mov rcx, rdi
add rbx, rdx
lea rdx, [rbx + 1]
call rsi
test rax, rax
mov rdi, rax
je 0x180001353
movsx rax, byte [rbx]
add rbx, rax
lea rcx, [rbx + 1]
call r13
test rax, rax
je 0x180001353
movsx rdx, byte [rbx]
lea r15, [rsp + 0x5c]
mov dword [rsp + 0x5c], 0
mov r8d, 0x40
mov r9, r15
add rbx, rdx
movsxd rdx, dword [rax + 0x3c]
mov esi, dword [rbx + 4]
mov r13d, dword [rbx + 8]
mov dword [rsp + 0x48], esi
mov esi, dword [rax + rdx + 0x2c]
mov dword [rsp + 0x4c], r13d
lea r14, [rbx + r13 + 0xc]
mov rdx, r13
add rsi, rax
mov rcx, rsi
call rdi
mov r10d, dword [rsp + 0x4c]
xor eax, eax
lea ecx, [r10 - 1]
test r10d, r10d
jne 0x180001373
nop dword [rax]
mov r9, r15
mov rdx, r13
mov rcx, rsi
mov r8d, dword [rsp + 0x5c]
call rdi
mov r15d, dword [rsp + 0x48]
add rbp, r12
xor edx, edx
mov rax, qword [str.griddlecake.bmp]
add rsi, r15
cmp byte [rax], 0
je 0x1800013b7
nop dword [rax]
mov rcx, qword [str.griddlecake.bmp]
movsx cx, byte [rcx + rdx]
mov word [rbp + rdx*2], cx
mov rcx, qword [str.griddlecake.bmp]
add rdx, 1
cmp byte [rcx + rdx], 0
jne 0x180001310
lea rax, [rbp + rdx*2]
lea rcx, [rsp + 0x60]
xor edx, edx
mov word [rax], dx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], r14
mov byte [rsp + 0x70], 1
call rsi
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, rdx
movzx edx, byte [rbx + rax + 0xc]
cmp rax, rcx
mov byte [rsi + rax], dl
lea rdx, [rax + 1]
jne 0x180001370
jmp 0x1800012e0
mov edx, eax
jmp 0x18000111b
mov rax, rbp
jmp 0x180001337
Function at 0x180022ad0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.18000e620
sub rsp, rax
mov rax, qword [0x180040280]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.180021580
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x180022b1f
mov rax, rbp
jmp 0x180022c27
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x42870]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.180023bf0
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x42870]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x180022c23
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180022c23
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.180023bf0
test rax, rax
js 0x180022c23
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x180022c23
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180022c15
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180022c15
cmp byte [rcx], 0xd
jne 0x180022bfb
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x180022c0a
cmp byte [rcx + 1], 0xa
jne 0x180022c0a
inc rcx
jmp 0x180022c0a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x406b0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180022bdd
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x180022c27
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.18000e0b0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180050d81
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x6d709f02
pushf
not eax
add eax, 0xd7eb1b60
xor eax, 0x92718328
rol eax, 0xd3
popf
pushf
not eax
add eax, 0x94da34c1
xor eax, 0xbb283a2c
rol eax, 9
popf
pushf
not eax
add eax, 0xe3e1a349
xor eax, 0xdf450904
rol eax, 0xf5
popf
cmp eax, 2
jne 0x180050dd1
popf
pop rax
jmp 0x180050ef1
cmp eax, 0
jne 0x180050de0
popf
pop rax
jmp 0x180050dfe
cmp eax, 3
jne 0x180050def
popf
pop rax
jmp 0x180050f2a
cmp eax, 1
jne 0x180050dfe
popf
pop rax
jmp 0x180050ee8
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1c2dcc239]
pushf
sub r9, 0x42d9a481
popf
mov edi, ecx
lea rdx, [0x1c3be0a72]
pushf
sub rdx, 0x43baecba
popf
mov ecx, 0xeb611a08
pushf
not ecx
add ecx, 0xb4643ff1
xor ecx, 0xd0003660
rol ecx, 0xf1
popf
pushf
not ecx
add ecx, 0xbea1ad4c
xor ecx, 0x9b917b45
rol ecx, 0x66
popf
lea r8, [0x1f7cce54e]
pushf
sub r8, 0x77c9c79e
popf
call fcn.1800132bc
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x180050eb4
push rax
pushf
mov eax, 0x7798a595
pushf
not eax
add eax, 0xc1aa569c
xor eax, 0x886a8a37
rol eax, 0x47
popf
pushf
not eax
add eax, 0xfa164327
xor eax, 0x9c78aa45
rol eax, 0x83
popf
jmp 0x180050dc2
push rax
pushf
mov eax, 0x8c19f879
pushf
not eax
add eax, 0x89665caf
xor eax, 0xeb97ad98
rol eax, 0x1e
popf
pushf
not eax
add eax, 0xec138d29
xor eax, 0x865c9abd
rol eax, 0xa4
popf
jmp 0x180050dc2
call qword [0x18002f408]
jmp 0x180050f2a
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0xacc1d587
pushf
not eax
add eax, 0x9ca0b845
xor eax, 0xb9f3e90b
rol eax, 0x9d
popf
pushf
not eax
add eax, 0x86bb35c9
xor eax, 0xbbf5f452
rol eax, 0x73
popf
jmp 0x180050dc2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret