joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003d70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003e43
cmp byte [rcx + 0x71], 0
je 0x140003e43
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140003e3f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003e04
sub eax, 1
je 0x140003e08
cmp eax, 2
jne 0x140003e3f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004a40
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003e36
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140003e3f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140003dec
xor al, al
jmp 0x140003dec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004a40
add rsp, 0x60
pop rbx
ret

Function at 0x1400053c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000540a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000540a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000540a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000540a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000540a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000540c
xor al, al
add rsp, 0x28
ret
Function at 0x14001128a
Capabilities:
Terminate process

Disassembly:
jmp 0x1400171a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011339
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400184f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140018510
xor al, al
jmp 0x140018591
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018523
xor al, al
jmp 0x140018591
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001854d
xor al, al
jmp 0x140018591
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018561
xor al, al
jmp 0x140018591
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018573
xor al, al
jmp 0x140018591
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001858f
xor al, al
jmp 0x140018591
mov al, 1
add rsp, 0x38
ret
Function at 0x1400291db
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
jmp 0x140060b90
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x238]
mov rax, qword [0x1400a7058]
xor rax, rbp
mov qword [rbp + 0x1e8], rax
lea rcx, [0x1400b77f2]
call fcn.14002a969
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, 0xb
call fcn.14002a2cf
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xc0000004
jne 0x140060c5b
cmp qword [rbp + 8], 0
je 0x140060c23
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 0x24]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 8], rax
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 8]
mov ecx, 0xb
call fcn.14002a2cf
mov dword [rbp + 0x44], eax
jmp 0x140060c01
cmp dword [rbp + 0x44], 0
jge 0x140060c81
cmp qword [rbp + 8], 0
je 0x140060c7a
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140060db8
mov rax, qword [rbp + 8]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140060c97
xor eax, eax
jmp 0x140060db8
mov dword [rbp + 0x84], 0
jmp 0x140060cb1
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
mov rax, qword [rbp + 0x68]
mov eax, dword [rax]
cmp dword [rbp + 0x84], eax
jae 0x140060da4
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x68]
lea rax, [rcx + rax + 8]
mov ecx, dword [rbp + 0x84]
imul rcx, rcx, 0x128
mov rdx, qword [rbp + 0x68]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140029b86
mov rcx, qword [rbp + 0x210]
call fcn.1400292b2
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0xa8]
call fcn.1400292b2
mov qword [rbp + 0x1e0], rax
mov rdx, qword [rbp + 0x1d8]
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x140060d93
mov eax, dword [rbp + 0x84]
imul rax, rax, 0x128
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx + rax + 0x18]
mov qword [rbp + 0xe8], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1c8], rax
lea rcx, [rbp + 0xa8]
call fcn.14002950f
mov rax, qword [rbp + 0x1c8]
jmp 0x140060db8
lea rcx, [rbp + 0xa8]
call fcn.14002950f
jmp 0x140060ca3
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400997e0]
call fcn.14002a4e1
mov rax, rdi
mov rcx, qword [rbp + 0x1e8]
xor rcx, rbp
call fcn.140029c5d
lea rsp, [rbp + 0x1f8]
pop rdi
pop rbp
ret
Function at 0x1400292d5
Capabilities:
Write file on windows

Disassembly:
jmp 0x14004a4b0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400b7135]
call fcn.14002a969
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14004a507
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14004a613
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14004a5ac
cmp qword [rbp + 0x28], 0
jle 0x14004a5ac
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14004a54c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.14002a7a7
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14004a602
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14004a602
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14002972b
Capabilities:
Get common file path

Disassembly:
jmp 0x1400609a0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x1400a7058]
xor rax, rbp
mov qword [rbp + 0x410], rax
mov dword [rbp + 0x3f4], 0
lea rcx, [0x1400b77f2]
call fcn.14002a969
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rbp + 0x10]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
je 0x140060a2d
cmp dword [rbp + 0x234], 0x105
jbe 0x140060a86
lea rdx, str.____Failed_to_get_temp_path
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140029d1b
mov qword [rbp + 0x408], rax
lea rdx, [0x140029c7b]
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x14009256c]
mov rcx, qword [rbp + 0x440]
call fcn.14002987a
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
jmp 0x140060af8
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcslen]
movzx eax, word [rbp + rax*2 + 0xe]
cmp eax, 0x5c
jne 0x140060ad2
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcslen]
lea rax, [rax + rax - 2]
mov qword [rbp + 0x3d8], rax
cmp qword [rbp + 0x3d8], 0x20a
jae 0x140060abf
jmp 0x140060ac4
call fcn.14002a24d
xor eax, eax
mov rcx, qword [rbp + 0x3d8]
mov word [rbp + rcx + 0x10], ax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x440]
call fcn.14002987a
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140099600]
call fcn.14002a4e1
mov rax, rdi
mov rcx, qword [rbp + 0x410]
xor rcx, rbp
call fcn.140029c5d
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret

Function at 0x140029e51
Capabilities:
Terminate process

Disassembly:
jmp 0x1400783b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140029e83
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140060820
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x1400b77f2]
call fcn.14002a969
mov rcx, qword [rbp + 0x180]
call fcn.140029b72
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x188]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rbp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x64], 0
jmp 0x14006089b
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 6]
cmp dword [rbp + 0x64], eax
jae 0x140060943
mov eax, dword [rbp + 0x64]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x180]
mov rcx, rax
call fcn.140029992
test eax, eax
jne 0x14006093e
mov rax, qword [rbp + 0x88]
mov rcx, rax
call fcn.140029b72
cmp qword [rbp + 8], rax
jne 0x14006093e
mov rax, qword [rbp + 0x88]
cmp dword [rax + 0xc], 0
jne 0x140060908
xor eax, eax
jmp 0x140060945
cmp qword [rbp + 0x190], 0
je 0x140060925
mov rax, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x88]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
jmp 0x140060945
jmp 0x140060893
xor eax, eax
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x14002a081
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400731a0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1400731dd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14002a94b
add rsp, 0x58
ret
Function at 0x14002a199
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400799a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400799c0
xor al, al
jmp 0x140079a41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400799d3
xor al, al
jmp 0x140079a41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400799fd
xor al, al
jmp 0x140079a41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140079a11
xor al, al
jmp 0x140079a41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140079a23
xor al, al
jmp 0x140079a41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140079a3f
xor al, al
jmp 0x140079a41
mov al, 1
add rsp, 0x38
ret
Function at 0x14002a658
Capabilities:
Parse pe header

Disassembly:
jmp 0x14005c420
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400b754f]
call fcn.14002a969
mov rax, qword [rbp + 0x120]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14005c45c
xor eax, eax
jmp 0x14005c489
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x4550
je 0x14005c485
xor eax, eax
jmp 0x14005c489
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14002a900
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400451a0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x1400a7058]
xor rax, rbp
mov qword [rbp + 0x1a8], rax
lea rcx, [0x1400b7135]
call fcn.14002a969
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x140045206
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14004520d
mov al, 1
jmp 0x14004537f
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x198], rax
call fcn.14002973f
mov dword [rbp + 0x1a0], eax
mov edx, dword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x1d0]
call qword [rbp + 0x198]
mov dword [rbp + 0x164], eax
call fcn.14002973f
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.14002a522
movzx eax, al
test eax, eax
je 0x140045272
xor al, al
jmp 0x14004537f
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1d0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x198], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x198]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x1a0], eax
cmp dword [rbp + 0x1a0], 0
je 0x1400452e5
cmp dword [rbp + 0x1a0], 1
je 0x1400452f0
cmp dword [rbp + 0x1a0], 3
je 0x14004536e
jmp 0x14004537d
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140045340
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140045340
xor al, al
jmp 0x14004537f
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14004535b
mov dword [rbp + 0x194], 1
jmp 0x140045365
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x14004537f
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14004537f
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140091090]
call fcn.14002a4e1
mov rax, rdi
mov rcx, qword [rbp + 0x1a8]
xor rcx, rbp
call fcn.140029c5d
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x14002aa0e
Capabilities:
Print debug messages

Disassembly:
jmp 0x14007670c
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.14002a310
and qword [rdi + 0x50], 0
lea rax, [0x140000000]
and dword [rdi + 0x58], 0
lea rcx, [rdi + 0x28]
and dword [rdi + 0x5c], 0
xor r8d, r8d
mov qword [rdi + 0x10], rax
xor edx, edx
mov qword [rdi + 8], rax
lea rax, [0x14009a2d0]
mov qword [rdi + 0x20], rax
mov dword [rdi], 0x60
mov dword [rdi + 0x18], 0xe00
call fcn.140029bf9
test eax, eax
jne 0x1400767a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x1400767a3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14007679c
lea rcx, str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [0x1400aa300], 1
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1400225f4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140022622
xor eax, eax
jmp 0x140022708
cmp qword [rcx + 0x68], 0
je 0x140022633
call fcn.14000c800
jmp 0x140022708
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14002264a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002264c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002267e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14004cdb0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140022702
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400226b5
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400226de
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1400339b4
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140022702
cmp rsi, rbx
ja 0x1400226bc
test rsi, rsi
je 0x140022702
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1400339b4
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140025498
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400254e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400254e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400254e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400254e2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400254e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400254e4
xor al, al
add rsp, 0x28
ret

Function at 0x140036160
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140035f5c
Function at 0x14003e020
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140024f30
sub rsp, rax
mov rax, qword [0x140068040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14003a250
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14003e06f
mov rax, rbp
jmp 0x14003e177
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x6a860]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14003f308
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x6a860]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14003e173
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003e173
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14003f308
test rax, rax
js 0x14003e173
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14003e173
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14003e165
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14003e165
cmp byte [rcx], 0xd
jne 0x14003e14b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14003e15a
cmp byte [rcx + 1], 0xa
jne 0x14003e15a
inc rcx
jmp 0x14003e15a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x68460]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14003e12d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14003e177
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140024720
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14003e494
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003e4aa
mov al, 1
jmp 0x14003e50a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003e4bb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003e508
mov ecx, dword [rcx + 0x18]
nop
call fcn.140041b14
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003e508
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003e508
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003e508
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003e50a
xor al, al
add rsp, 0x20
pop rbx
ret