joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400107cd
Capabilities:
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rdi, rcx
call sym.__pth_gpointer_locked
mov rbx, rax
test rax, rax
je 0x140010974
mov rcx, qword [rax + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140010974
lea rbp, [rsp + 0x20]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140010974
lea rsi, [rbx + 0x38]
mov rcx, rsi
call sym.pthread_mutex_lock
call sym.pthread_self
cmp rax, rdi
mov al, byte [rbx + 0x40]
jne 0x140010880
test al, 3
jne 0x140010893
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock inc dword [0x1400a1d48]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140010850
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x140010967
and eax, 0xfffffffe
mov rcx, rsi
mov dword [rbx + 0x44], eax
mov al, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
mov edx, dword [rbx + 0x44]
and edx, 3
cmp edx, 3
jne 0x140010940
test al, 0xc
je 0x1400108ac
mov rcx, rsi
call sym.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
jne 0x140010974
xor eax, eax
jmp 0x140010979
test al, 0xf
jne 0x140010974
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140010967
mov rcx, qword [rbx + 0x28]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rbp
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov al, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock inc dword [0x1400a1d48]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001092c
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call sym.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140010967
test al, 3
jne 0x140010893
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock inc dword [0x1400a1d48]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140010967
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call sym.pthread_mutex_unlock
jmp 0x1400108a5
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140010985
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140073158]
mov rsi, rcx
mov rcx, rdi
mov ebx, edx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
test rax, rax
je 0x1400109d2
cmp qword [rax + 0x1d8], rsi
jne 0x1400109d2
test byte [rax + 0x40], 0xc
jne 0x1400109d2
cmp dword [rax + 0xbc], 0
jne 0x1400109d2
mov rax, qword [rax + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
jbe 0x1400109e1
mov rcx, rdi
mov ebx, 3
call sym.pthread_mutex_unlock
jmp 0x140010a09
mov rcx, rdi
call sym.pthread_mutex_unlock
test ebx, ebx
je 0x140010a09
sub ebx, 2
cmp ebx, 0x15
ja 0x140010a04
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov ebx, 0x16
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140010bd0
Capabilities:
Create thread
Resume thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, rcx
mov rsi, rdx
mov rbp, r8
mov r12, r9
call sym.pop_pthread_mem
mov rbx, rax
test rax, rax
je 0x140010cb6
test rdi, rdi
je 0x140010c08
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
xor r11d, r11d
mov qword [rbx + 8], r12
mov r13, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [rbx + 0xbc], r11d
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov qword [rbx + 0x10], rbp
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call r13
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140010c71
test ebp, ebp
jne 0x140010c62
xor ecx, ecx
mov ebp, 1
call r12
jmp 0x140010c39
inc ebp
mov ecx, 0x14
call r12
cmp ebp, 5
jne 0x140010c39
mov qword [rbx + 0x38], 0xffffffffffffffff
lea r12, [rbx + 0x68]
mov rcx, r12
call sym.replace_spin_keys.constprop.0
xor r10d, r10d
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xc0], r10d
mov dword [rbx + 0xb8], r10d
jne 0x140010cc0
test rdi, rdi
je 0x140010cae
xor r9d, r9d
mov qword [rdi], r9
mov rcx, rbx
call sym.push_pthread_mem
mov eax, 0xb
jmp 0x140010dc3
xor ebp, ebp
test rsi, rsi
je 0x140010cec
mov eax, dword [rsi]
mov rbp, qword [rsi + 0x10]
mov dword [rbx + 0x44], eax
test al, 8
je 0x140010ce7
call sym.__pthread_self_lite
mov eax, dword [rax + 0xc0]
mov dword [rbx + 0xc0], eax
jmp 0x140010cec
mov eax, dword [rsi + 0x18]
jmp 0x140010cdf
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov r9, rbx
mov edx, ebp
mov qword [rsp + 0x28], r8
xor ecx, ecx
lea r8, [sym.pthread_create_wrapper]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x140010d4c
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140010d2c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call sym.pthread_mutex_destroy
mov rcx, r12
call sym.replace_spin_keys.constprop.0
xor ecx, ecx
mov qword [rbx + 0x30], rcx
mov qword [rbx + 0x28], rcx
jmp 0x140010ca3
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jl 0x140010d7a
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x140010d7a
mov edx, 0xf
cmp eax, 0xe
jg 0x140010d7a
mov edx, 2
cmp eax, edx
cmovle edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
je 0x140010db0
xor edx, edx
mov rcx, rsi
mov qword [rbx + 0x28], rdx
call rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140010db9
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140015c40
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
or edx, 0xffffffff
test rax, rax
jle 0x140015c6a
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x14004e2f0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov rcx, rbx
call method.std::__basic_file_char_.fd__
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd rbp, eax
inc eax
jne 0x14004e328
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 4
je 0x14004e301
mov rax, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14005a1e0
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x14005a200
mov rcx, qword [rcx]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp rax
mov esi, 4
lea rdi, [rsp + 0x2c]
mov ecx, dword [rbx + 0x10]
mov r8d, esi
mov rdx, rdi
call sym.read
test eax, eax
jle 0x14005a232
cdqe
add rdi, rax
sub rsi, rax
jne 0x14005a20a
mov eax, dword [rsp + 0x2c]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
inc eax
je 0x14005a242
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 4
je 0x14005a20a
jmp 0x14005a236
Function at 0x14005ec70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx]
mov rbx, rdx
mov eax, ecx
and ax, 0x101
cmp ax, 0x101
jne 0x14005ec92
add dword [rdx + 8], 0xc
mov r9b, byte [rsi]
test r9b, r9b
jns 0x14005ecbd
xor edx, edx
test byte [rsi + 1], 2
je 0x14005ecaf
mov eax, dword [rbx + 0x14]
mov r8d, 0x64
cdq
idiv r8d
mov eax, dword [rsi + 4]
sub eax, 0x13
imul eax, eax, 0x64
add eax, edx
mov dword [rbx + 0x14], eax
and cx, 0x402
cmp cx, 0x400
jne 0x14005ed61
mov eax, r9d
and eax, 0x18
cmp al, 0x18
je 0x14005ed45
test r9b, 4
je 0x14005ed45
mov eax, dword [rbx + 0x14]
lea r11, [0x14007b6c0]
xor r10d, r10d
lea ecx, [rax + 0x76c]
call method.std._anonymous_namespace_::is_leap_int_
mov ecx, dword [rbx + 0x1c]
movzx r8d, al
imul r8, r8, 0x1a
add r8, r11
movzx edi, word [r8 + r10*2]
mov rdx, r10
lea r10, [r10 + 1]
cmp edi, ecx
jle 0x14005ed03
test r9b, 8
jne 0x14005ed21
lea r8d, [rdx - 1]
mov dword [rbx + 0x10], r8d
and r9b, 0x10
jne 0x14005ed42
movzx eax, al
dec edx
imul rax, rax, 0xd
movsxd rdx, edx
add rax, rdx
movzx eax, word [r11 + rax*2]
sub ecx, eax
inc ecx
mov dword [rbx + 0xc], ecx
or byte [rsi], 0x18
mov edx, dword [rbx + 0x10]
test byte [rsi], 8
jne 0x14005ed52
cmp edx, 0xb
ja 0x14005ed61
mov ecx, dword [rbx + 0x14]
mov r8d, dword [rbx + 0xc]
call method.std._anonymous_namespace_::day_of_the_week_int__int__int_
mov dword [rbx + 0x18], eax
mov eax, dword [rsi]
mov dil, byte [rsi]
and ax, 0x404
cmp ax, 0x400
jne 0x14005edad
movsxd r9, dword [rbx + 0x10]
test dil, 8
jne 0x14005ed80
cmp r9d, 0xb
ja 0x14005edad
mov eax, dword [rbx + 0x14]
lea ecx, [rax + 0x76c]
call method.std._anonymous_namespace_::is_leap_int_
lea rcx, [0x14007b6c0]
mov edx, dword [rbx + 0xc]
movzx eax, al
imul rax, rax, 0xd
add rax, r9
movzx eax, word [rcx + rax*2]
lea eax, [rdx + rax - 1]
mov dword [rbx + 0x1c], eax
test dil, 0x60
je 0x14005ee88
test dil, 2
je 0x14005ee88
mov ebp, dword [rbx + 0x14]
test dil, 4
jne 0x14005ee1c
mov r12d, edi
mov r8d, 1
xor edx, edx
mov ecx, ebp
call method.std._anonymous_namespace_::day_of_the_week_int__int__int_
shr r12b, 5
mov r8d, 7
xor r12d, 1
and r12d, 1
sub eax, r12d
mov edx, eax
mov eax, r8d
sub eax, edx
cdq
idiv r8d
mov al, byte [rsi + 2]
and eax, 0x3f
dec eax
imul eax, eax, 7
lea ecx, [rdx + rax]
mov eax, dword [rbx + 0x18]
sub eax, r12d
add eax, 7
cdq
idiv r8d
add ecx, edx
mov dword [rbx + 0x1c], ecx
mov eax, edi
and eax, 0x18
cmp al, 0x18
je 0x14005ee88
lea ecx, [rbp + 0x76c]
lea r10, [0x14007b6c0]
xor r9d, r9d
call method.std._anonymous_namespace_::is_leap_int_
mov ecx, dword [rbx + 0x1c]
movzx r8d, al
imul r8, r8, 0x1a
add r8, r10
movzx r11d, word [r8 + r9*2]
mov rdx, r9
lea r9, [r9 + 1]
cmp r11d, ecx
jle 0x14005ee48
test dil, 8
jne 0x14005ee67
lea r8d, [rdx - 1]
mov dword [rbx + 0x10], r8d
and dil, 0x10
jne 0x14005ee88
movzx eax, al
dec edx
imul rax, rax, 0xd
movsxd rdx, edx
add rax, rdx
movzx eax, word [r10 + rax*2]
sub ecx, eax
inc ecx
mov dword [rbx + 0xc], ecx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400018ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001936
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001936
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001936
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001936
cmp dword [rcx + 0x84], 0xe
jbe 0x140001936
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001938
xor al, al
add rsp, 0x28
ret
Function at 0x140003a60
Capabilities:
Create http request
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x970
mov rax, qword [0x14004e080]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.Mozilla_5.0
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x130]
call fcn.140007780
nop
cmp qword [rsp + 0x38], 0
je 0x140003c5b
mov rcx, qword [rsp + 0x988]
call fcn.140007250
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140003c5b
lea r9, [rsp + 0x128]
mov r8d, 0x7d0
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [rsp + 0x128]
mov r8d, eax
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x130]
call fcn.140007330
lea rax, [rsp + 0x190]
mov rdi, rax
xor eax, eax
mov ecx, 0x7d0
rep stosb byte [rdi], al
cmp dword [rsp + 0x128], 0
jne 0x140003b0e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [0x14004777c]
lea rcx, [rsp + 0x88]
call fcn.140007650
nop
lea rdx, [0x140047780]
lea rcx, [rsp + 0x68]
call fcn.140007650
nop
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x48]
call fcn.1400077d0
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x68]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x150]
call fcn.1400039a0
nop
lea rcx, [rsp + 0x68]
call fcn.140007520
nop
lea rcx, [rsp + 0x88]
call fcn.140007520
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x980]
call fcn.140007550
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x150]
call fcn.140007520
nop
lea rcx, [rsp + 0x130]
call fcn.140007520
nop
mov rcx, qword [rsp + 0x988]
call fcn.140007520
mov rax, qword [rsp + 0x980]
jmp 0x140003d43
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [0x140047784]
lea rcx, [rsp + 0xc8]
call fcn.140007650
nop
lea rdx, [0x140047788]
lea rcx, [rsp + 0xa8]
call fcn.140007650
nop
lea rax, [rsp + 0x108]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x58]
call fcn.1400077d0
mov qword [rsp + 0x60], rax
lea r9, [rsp + 0xc8]
lea r8, [rsp + 0xa8]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x170]
call fcn.1400039a0
nop
lea rcx, [rsp + 0xa8]
call fcn.140007520
nop
lea rcx, [rsp + 0xc8]
call fcn.140007520
lea rdx, [rsp + 0x170]
mov rcx, qword [rsp + 0x980]
call fcn.140007550
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x170]
call fcn.140007520
nop
lea rcx, [rsp + 0x130]
call fcn.140007520
nop
mov rcx, qword [rsp + 0x988]
call fcn.140007520
mov rax, qword [rsp + 0x980]
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.140011fd0
add rsp, 0x970
pop rdi
ret
Function at 0x1400046e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
jne 0x140004743
lea rdx, str.Tool_helper_cannot_be_created
lea rcx, [0x14004f790]
call fcn.14000d330
lea rdx, [0x14000d700]
mov rcx, rax
call fcn.140006f60
mov byte [rsp + 0x20], 0
mov rcx, qword [rsp + 0x50]
call fcn.140007520
movzx eax, byte [rsp + 0x20]
jmp 0x14000482f
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x140004792
lea rdx, str.Tool_helper_cannot_retrieve_the_first_entry_of_process_list
lea rcx, [0x14004f790]
call fcn.14000d330
lea rdx, [0x14000d700]
mov rcx, rax
call fcn.140006f60
mov byte [rsp + 0x21], 0
mov rcx, qword [rsp + 0x50]
call fcn.140007520
movzx eax, byte [rsp + 0x21]
jmp 0x14000482f
mov rax, qword [rsp + 0x58]
add rax, 0x2c
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call fcn.14000d750
movzx eax, al
test eax, eax
je 0x1400047e6
cmp qword [rsp + 0x30], 0
je 0x1400047c8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x24], eax
jmp 0x1400047d0
mov dword [rsp + 0x24], 0
mov byte [rsp + 0x22], 1
mov rcx, qword [rsp + 0x50]
call fcn.140007520
movzx eax, byte [rsp + 0x22]
jmp 0x14000482f
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140004792
cmp qword [rsp + 0x30], 0
je 0x140004813
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x28], eax
jmp 0x14000481b
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x23], 0
mov rcx, qword [rsp + 0x50]
call fcn.140007520
movzx eax, byte [rsp + 0x23]
add rsp, 0x48
ret

Function at 0x140004840
Capabilities:
Manipulate console buffer

Disassembly:
sub rsp, 0x78
mov rax, qword [0x14004e080]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov word [rsp + 0x30], ax
xor eax, eax
mov word [rsp + 0x32], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx eax, word [rsp + 0x48]
movsx ecx, word [rsp + 0x4a]
imul eax, ecx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x30]
mov r8d, eax
mov dl, 0x20
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
movsx eax, word [rsp + 0x48]
movsx ecx, word [rsp + 0x4a]
imul eax, ecx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rsp + 0x30]
mov r8d, eax
mov dx, 7
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140011fd0
add rsp, 0x78
ret
Function at 0x140005ae0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14004e080]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x80], 0
jg 0x140005b14
xor eax, eax
jmp 0x140005cc0
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x140005b3c
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.140006810
jmp 0x140005cc0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
call fcn.1400093b0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x140005bd8
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.140005ce0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x70]
call fcn.140009570
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.14000a970
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call fcn.1400094d0
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x140005cb0
mov rcx, qword [rsp + 0x70]
call fcn.140008e40
mov qword [rsp + 0x38], 0xfff
cmp qword [rsp + 0x40], 0xfff
jbe 0x140005c78
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.14001bec0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x28], 0xfff
je 0x140005c76
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x140005cc0
jmp 0x140005bfe
cmp qword [rsp + 0x40], 0
jbe 0x140005cb0
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.14001bec0
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140011fd0
add rsp, 0x68
ret
Function at 0x140020e9c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140020c98

Function at 0x14002422c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140024242
mov al, 1
jmp 0x1400242a2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140024253
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400242a0
mov ecx, dword [rcx + 0x18]
nop
call fcn.14002ef64
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400242a0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400242a0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400242a0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400242a2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140028f34
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140012640
sub rsp, rax
mov rax, qword [0x14004e080]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14002410c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140028f83
mov rax, rbp
jmp 0x14002908b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x50640]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14002a998
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x50640]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140029087
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140029087
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14002a998
test rax, rax
js 0x140029087
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140029087
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140029079
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140029079
cmp byte [rcx], 0xd
jne 0x14002905f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14002906e
cmp byte [rcx + 1], 0xa
jne 0x14002906e
inc rcx
jmp 0x14002906e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x4e480]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140029041
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14002908b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140011fd0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret