joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7d2870d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x40], rbp
lea r9, [rsp + 0x50]
mov r8d, 0x80000
mov qword [rsp + 0x20], 0
mov rbp, rcx
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test eax, eax
je 0x7d287137
mov r8d, dword [rsp + 0x50]
test r8d, r8d
je 0x7d28712e
cmp r8d, 0x80000
jb 0x7d287137
mov rdx, qword [str.Manifest_Length___d_]
mov ecx, 0x89d
call sym.imfsbDll.dll_SbieApi_Log
mov edi, 0x36b4
xor ebx, ebx
jmp 0x7d28713f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x40]
test ebx, ebx
je 0x7d28716b
mov eax, dword [rsp + 0x50]
mov byte [rax + rsi], 0
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x7d287500
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r8, qword [0x7d2ad820]
xor esi, esi
mov rdi, rdx
mov rbx, rcx
test r8, r8
jne 0x7d287532
lea ecx, [rsi + 0x20]
call fcn.7d221988
mov r8, rax
mov qword [rax + 0x18], rsi
test rdi, rdi
je 0x7d287543
movups xmm0, xmmword [rdi]
movups xmmword [r8], xmm0
or qword [r8 + 0x18], 1
test rbx, rbx
je 0x7d287551
or qword [r8 + 0x18], 2
mov qword [r8 + 0x10], rbx
movzx eax, byte [r8 + 0x18]
and al, 3
cmp al, 3
jne 0x7d28759e
mov r9, r8
mov qword [rsp + 0x28], rsi
lea r8, [0x7d2875f0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x7d287587
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x7d2ad820], rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov qword [0x7d2ad820], r8
add rsp, 0x30
pop rdi
ret

Function at 0x7d287980
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
jmp 0x7d287980
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, 0x2000
mov r14, rcx
mov dword [rsp + 0x30], eax
xor edi, edi
mov ecx, eax
call fcn.7d2212da
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, 5
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
test eax, eax
jns 0x7d287a01
mov rcx, rsi
call fcn.7d221938
xor esi, esi
cmp ebx, 0x80000005
je 0x7d2879ed
cmp ebx, 0xc0000004
je 0x7d2879ed
cmp ebx, 0xc0000023
jne 0x7d287a01
mov eax, dword [rsp + 0x30]
inc edi
add eax, 0x40
mov dword [rsp + 0x30], eax
cmp edi, 5
jb 0x7d2879a3
jmp 0x7d287a05
mov eax, dword [rsp + 0x30]
test r14, r14
je 0x7d287a0d
mov dword [r14], eax
mov rbx, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x7d289000
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov edx, ecx
xor ecx, ecx
add rdx, 8
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
test rax, rax
jne 0x7d289030
xor edx, edx
mov ecx, 0x901
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [str.sbox5.40]
mov qword [rcx], rax
lea rax, [rcx + 8]
add rsp, 0x28
ret

Function at 0x7d28a790
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x7d28a790
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp rcx, qword [0x7d2abf48]
mov rdi, rcx
jne 0x7d28a850
lea rdx, str.GetAppliedGPOListInternalW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
lea r8, [0x7d28a6c0]
lea rcx, str.GetAppliedGPOList
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad8b0], rax
test rax, rax
je 0x7d28a843
lea rdx, str.GetVersionExW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetVersionExA
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x7d28a730]
mov rdx, rbx
lea rcx, str.GetVersionExW
mov rdi, rax
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad8b8], rax
test rax, rax
je 0x7d28a843
lea r8, [0x7d28a6e0]
mov rdx, rdi
lea rcx, str.GetVersionExA
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad8c0], rax
test rax, rax
jne 0x7d28a8c2
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, str.RegisterGPNotification
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnregisterGPNotification
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x7d28a920]
mov rdx, rbx
lea rcx, str.RegisterGPNotification
mov rdi, rax
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad8a0], rax
test rax, rax
je 0x7d28a843
lea r8, [0x7d28a940]
mov rdx, rdi
lea rcx, str.UnregisterGPNotification
call sym.imfsbDll.dll_SbieDll_Hook
mov qword [0x7d2ad8a8], rax
test rax, rax
jne 0x7d28a8c2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001340
Capabilities:
Create thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rcx, str._nNon_synced__dkB_writes:_n
call sub.libintl_8.dll_libintl_gettext
mov edx, 8
mov rcx, rax
call fcn.140004b00
lea rdx, str.write
lea rcx, str.__________30s
call fcn.140004b00
call qword [sym.imp.MSVCR120.dll___iob_func]
lea rcx, [rax + 0x30]
call qword [sym.imp.MSVCR120.dll_fflush]
xor edi, edi
lea r8, [0x140002200]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov byte [0x14000c0d4], 0
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, 0xffffffffffffffff
jne 0x1400013dd
lea rcx, str.Could_not_create_thread_for_alarm_n
call sub.libintl_8.dll_libintl_gettext
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140004ad0
lea ecx, [rdi + 1]
call qword [sym.imp.MSVCR120.dll_exit]
int3
lea rcx, [0x14100c0e8]
xor edx, edx
call fcn.140006780
cmp byte [0x14000c0d4], dil
jne 0x140001452
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [str.._pg_test_fsync.out]
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCR120.dll__open]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140001508
mov rdx, qword [0x14100c0e0]
mov r8d, 0x2000
mov ecx, eax
call qword [sym.imp.MSVCR120.dll__write]
cmp eax, 0x2000
jne 0x1400014fb
mov ecx, ebx
call qword [sym.imp.MSVCR120.dll__close]
inc edi
cmp byte [0x14000c0d4], 0
je 0x140001400
lea rcx, [0x14100c0f0]
xor edx, edx
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
call fcn.140006780
mov rcx, qword [0x14100c0f0]
movd xmm7, edi
mov rax, qword [0x14100c0e8]
mov r8, rcx
sub ecx, eax
mov rdx, rax
shr r8, 0x20
cvtdq2pd xmm7, xmm7
shr rdx, 0x20
sub r8d, edx
movd xmm0, ecx
lea rcx, str._13.3f_ops_sec___6.0f_usecs_op_n
movd xmm1, r8d
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm1, xmm1
mulsd xmm1, qword [0x140009a88]
addsd xmm1, xmm0
movaps xmm6, xmm1
divsd xmm6, xmm7
divsd xmm7, xmm1
mulsd xmm6, qword [0x140009a90]
call sub.libintl_8.dll_libintl_gettext
movaps xmm2, xmm6
movaps xmm1, xmm7
mov rcx, rax
movq r8, xmm2
movq rdx, xmm1
mov rbx, qword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
jmp fcn.140004b00
lea rcx, str.write_failed
call fcn.140002320
int3
lea rcx, str.could_not_open_output_file
call fcn.140002320
int3
Function at 0x140002480
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xc40
mov rax, qword [0x14000c0b0]
xor rax, rsp
mov qword [rsp + 0xc30], rax
mov rbx, rdx
mov rdi, rcx
lea rdx, str.postgres_10
mov rcx, rbx
call sub.MSVCR120.dll_strcmp
test eax, eax
je 0x1400024c6
lea rdx, [0x140009a5a]
xor ecx, ecx
call fcn.1400072a0
lea rdx, [rsp + 0x830]
mov rcx, rdi
call fcn.1400025f0
test eax, eax
js 0x1400025c4
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.140004350
lea rdx, [rsp + 0x430]
mov rcx, rbx
call sub.libintl_8.dll_libintl_bindtextdomain
mov rcx, rbx
call sub.libintl_8.dll_libintl_textdomain
lea rcx, str.PGLOCALEDIR
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
jne 0x14000255d
lea r9, [rsp + 0x430]
lea r8, str.PGLOCALEDIR_s
lea rcx, [rsp + 0x20]
mov edx, 0x40e
call fcn.1400048b0
lea rcx, [rsp + 0x2c]
call fcn.140003a30
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll__strdup]
test rax, rax
je 0x14000255d
mov rcx, rax
call fcn.140006e60
lea rcx, str.PGSYSCONFDIR
call qword [sym.imp.MSVCR120.dll_getenv]
test rax, rax
jne 0x1400025c4
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x830]
call fcn.140004230
lea r9, [rsp + 0x430]
lea r8, str.PGSYSCONFDIR_s
lea rcx, [rsp + 0x20]
mov edx, 0x40e
call fcn.1400048b0
lea rcx, [rsp + 0x2d]
call fcn.140003a30
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR120.dll__strdup]
test rax, rax
je 0x1400025c4
mov rcx, rax
call fcn.140006e60
mov rcx, qword [rsp + 0xc30]
xor rcx, rsp
call fcn.140007d70
mov rbx, qword [rsp + 0xc60]
add rsp, 0xc40
pop rdi
ret
Function at 0x1400035a0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x1400035d8
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call sub.libintl_8.dll_libintl_gettext
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140004ad0
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
call qword [sym.imp.MSVCR120.dll__strdup]
test rax, rax
jne 0x140003610
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140004ad0
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
add rsp, 0x20
pop rbx
ret
jmp 0x1400035a0

Function at 0x1400036e0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x1400035d8
lea rcx, str.cannot_duplicate_null_pointer__internal_error__n
call sub.libintl_8.dll_libintl_gettext
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140004ad0
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
call qword [sym.imp.MSVCR120.dll__strdup]
test rax, rax
jne 0x140003610
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140004ad0
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
add rsp, 0x20
pop rbx
ret
jmp 0x1400035a0

Function at 0x1400049b0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x478
mov rax, qword [0x14000c0b0]
xor rax, rsp
mov qword [rsp + 0x450], rax
test rcx, rcx
jne 0x1400049f5
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 0x16
or eax, 0xffffffff
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140007d70
add rsp, 0x478
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x470], rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x460], rdi
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x44], 0
mov qword [rsp + 0x30], rax
call fcn.140004bc0
mov rdi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx ebx, byte [rsp + 0x44]
sub rdi, rcx
test bl, bl
jne 0x140004a93
test rdi, rdi
je 0x140004a93
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x468], rsi
mov esi, 1
mov edx, esi
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_fwrite]
mov ecx, dword [rsp + 0x40]
movzx ebx, bl
add ecx, eax
cmp rax, rdi
cmovne ebx, esi
mov rsi, qword [rsp + 0x468]
jmp 0x140004a97
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x460]
or eax, 0xffffffff
test bl, bl
mov rbx, qword [rsp + 0x470]
cmovne ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140007d70
add rsp, 0x478
ret
Function at 0x140004b50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov rdi, qword [rbx]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140004ba2
test rdi, rdi
je 0x140004ba2
mov r9, qword [rbx + 0x18]
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
mov rax, qword [rbx + 8]
mov qword [rbx], rax
je 0x140004ba5
mov byte [rbx + 0x24], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400054b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp dword [rsp + 0x50], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], r14
mov r14, rcx
mov edi, r8d
je 0x1400054f5
movsxd rax, r9d
mov rbp, rcx
test r9d, r9d
je 0x1400054f1
nop dword [rax]
dec rax
cmp byte [rbp], 0
je 0x1400054f1
inc rbp
test rax, rax
jne 0x1400054e0
sub ebp, ecx
jmp 0x140005509
or rbp, 0xffffffffffffffff
nop dword [rax]
inc rbp
cmp byte [rcx + rbp], 0
jne 0x140005500
sub edi, ebp
mov eax, 0
cmovs edi, eax
test edx, edx
je 0x140005519
neg edi
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rsi
test edi, edi
jle 0x140005588
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005579
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x140005579
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140005546
inc dword [rbx + 0x20]
jmp 0x140005582
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140005572
test rsi, rsi
je 0x140005572
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x140005572
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec edi
test edi, edi
jg 0x140005527
mov r8, rbx
mov edx, ebp
mov rcx, r14
call fcn.140005d60
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
test edi, edi
jns 0x140005610
neg edi
movsxd rsi, edi
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005602
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x140005602
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x1400055cf
inc dword [rbx + 0x20]
jmp 0x14000560b
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x1400055fb
test rdi, rdi
je 0x1400055fb
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x1400055fb
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec rsi
jne 0x1400055b0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400056a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x80
mov rax, qword [0x14000c0b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, qword [rsp + 0xd0]
xor ebp, ebp
movsx eax, dl
add eax, 0xffffffa8
mov r10, rcx
lea r11, str.0123456789abcdef
mov dword [rsp + 0x24], ebp
mov esi, ebp
cmp eax, 0x20
ja case.0x140005705.89
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x58f8]
mov ecx, dword [rdx + rax*4 + 0x58e0]
add rcx, rdx
jmp rcx
mov ecx, 0xa
test r10, r10
jns 0x14000571e
mov dword [rsp + 0x24], 0x2d
neg r10
jmp 0x140005747
test r8d, r8d
je 0x140005747
mov dword [rsp + 0x24], 0x2b
jmp 0x140005747
mov ecx, 8
jmp 0x140005747
mov ecx, 0xa
jmp 0x140005747
lea r11, str.0123456789ABCDEF
mov ecx, 0x10
mov qword [rsp + 0x90], rdi
mov edi, dword [rsp + 0xc0]
test r10, r10
jne 0x140005768
cmp dword [rsp + 0xc8], esi
je 0x140005768
test edi, edi
je 0x14000578f
lea r8, [rsp + 0x30]
nop dword [rax]
xor edx, edx
mov rax, r10
inc esi
div rcx
lea r8, [r8 + 1]
mov r10, rax
movzx eax, byte [rdx + r11]
mov byte [r8 - 1], al
test r10, r10
jne 0x140005770
mov eax, dword [rsp + 0xb0]
sub edi, esi
cmovs edi, ebp
sub eax, edi
sub eax, esi
cmovs eax, ebp
mov dword [rsp + 0x20], eax
test r9d, r9d
je 0x1400057b1
neg eax
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0xb8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x24]
mov r9, rbx
call fcn.140005ee0
test edi, edi
jle 0x140005800
nop
mov rax, qword [rbx + 0x10]
dec edi
test rax, rax
je 0x1400057f3
cmp qword [rbx], rax
jb 0x1400057f3
cmp qword [rbx + 0x18], rbp
jne 0x1400057eb
inc dword [rbx + 0x20]
jmp 0x1400057fc
mov rcx, rbx
call fcn.140004b50
mov rax, qword [rbx]
mov byte [rax], 0x30
inc qword [rbx]
test edi, edi
jg 0x1400057d0
movsxd rdi, esi
test esi, esi
jle 0x140005847
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
movsx esi, byte [rsp + rdi + 0x2f]
dec rdi
test rax, rax
je 0x140005839
cmp qword [rbx], rax
jb 0x140005839
cmp qword [rbx + 0x18], rbp
jne 0x140005831
inc dword [rbx + 0x20]
jmp 0x140005842
mov rcx, rbx
call fcn.140004b50
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
test rdi, rdi
jg 0x140005810
mov eax, dword [rsp + 0x20]
test eax, eax
jns 0x1400058b4
neg eax
movsxd rsi, eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400058a6
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x1400058a6
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140005873
inc dword [rbx + 0x20]
jmp 0x1400058af
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], bpl
jne 0x14000589f
test rdi, rdi
je 0x14000589f
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000589f
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec rsi
jne 0x140005854
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140007d70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x140005920
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
xor eax, eax
lea edi, [r8 - 1]
mov qword [rsp + 0x30], rbp
test edi, edi
mov rbx, r9
mov ebp, ecx
cmovs edi, eax
test edx, edx
je 0x140005945
neg edi
mov qword [rsp + 0x38], rsi
test edi, edi
jle 0x1400059b1
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400059a2
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x1400059a2
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x14000596f
inc dword [rbx + 0x20]
jmp 0x1400059ab
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000599b
test rsi, rsi
je 0x14000599b
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x14000599b
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec edi
test edi, edi
jg 0x140005950
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400059d3
cmp qword [rbx], rax
jb 0x1400059d3
cmp qword [rbx + 0x18], 0
jne 0x1400059cb
inc dword [rbx + 0x20]
jmp 0x1400059dc
mov rcx, rbx
call fcn.140004b50
mov rax, qword [rbx]
mov byte [rax], bpl
inc qword [rbx]
mov rbp, qword [rsp + 0x30]
test edi, edi
jns 0x140005a50
neg edi
movsxd rsi, edi
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005a42
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x140005a42
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140005a0f
inc dword [rbx + 0x20]
jmp 0x140005a4b
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140005a3b
test rdi, rdi
je 0x140005a3b
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x140005a3b
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec rsi
jne 0x1400059f0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005d60
Capabilities:
Write file on windows

Disassembly:
test edx, edx
jle 0x140005e29
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov qword [rsp + 0x30], rsi
mov rbx, r8
mov ebp, edx
mov qword [rsp + 0x38], rdi
mov r14, rcx
nop word [rax + rax]
cmp qword [rbx + 0x10], 0
je 0x140005d9e
mov eax, dword [rbx + 0x10]
sub eax, dword [rbx]
jmp 0x140005da0
mov eax, ebp
test eax, eax
jg 0x140005de5
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x140005e0c
mov rcx, qword [rbx + 8]
mov rdi, qword [rbx]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140005ddc
test rdi, rdi
je 0x140005ddc
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x140005ddc
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x140005e06
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
cmovl esi, eax
mov rdx, r14
movsxd rdi, esi
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_memmove]
add qword [rbx], rdi
add r14, rdi
sub ebp, esi
test ebp, ebp
jg 0x140005d90
jmp 0x140005e0f
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140005ee0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp dword [r8], 0
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov esi, ecx
jle 0x140005f58
test ecx, ecx
je 0x140005f58
mov ecx, dword [rdx]
test ecx, ecx
je 0x140005f21
mov rdx, rbx
call fcn.140005e30
dec dword [rdi]
mov dword [r14], 0
cmp dword [rdi], 0
jle 0x140005f58
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005f48
cmp qword [rbx], rax
jb 0x140005f48
cmp qword [rbx + 0x18], 0
jne 0x140005f40
inc dword [rbx + 0x20]
jmp 0x140005f51
mov rcx, rbx
call fcn.140004b50
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
dec dword [rdi]
cmp dword [rdi], 0
jg 0x140005f26
xor eax, eax
cmp dword [r14], eax
setne al
cmp dword [rdi], eax
jle 0x140005fcd
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005fb6
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x140005fb6
mov r9, qword [rbx + 0x18]
test r9, r9
jne 0x140005f83
inc dword [rbx + 0x20]
jmp 0x140005fbf
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140005faf
test rsi, rsi
je 0x140005faf
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x140005faf
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec dword [rdi]
xor eax, eax
cmp dword [r14], eax
setne al
cmp dword [rdi], eax
jg 0x140005f64
mov esi, dword [r14]
test esi, esi
je 0x14000600f
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140005ff6
cmp qword [rbx], rax
jb 0x140005ff6
cmp qword [rbx + 0x18], 0
jne 0x140005fee
inc dword [rbx + 0x20]
jmp 0x140005fff
mov rcx, rbx
call fcn.140004b50
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
mov eax, dword [rdi]
test eax, eax
jle 0x140006009
dec eax
jmp 0x14000600d
jns 0x14000600f
inc eax
mov dword [rdi], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1401a71d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
cpuid
mov r10d, 0x78e4b830
mov rbx, qword [rsp + 0x27]
jmp 0x1401a71f4