joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008c5b0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, 0xffffffffffffffff
mov r14, r8
mov rsi, rbx
mov rbp, rdx
nop word [rax + rax]
inc rsi
cmp byte [rsi + rdx], 0
jne 0x14008c5e0
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rbp
call fcn.140042830
mov rcx, qword [0x140168cf8]
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, edi
mov edx, esi
mov r8, rax
mov qword [0x140168cf8], rax
mov rcx, rbp
call fcn.140042830
mov ecx, eax
xor esi, esi
mov rax, qword [0x140168cf8]
mov word [rax + rcx*2], si
inc rbx
cmp byte [r14 + rbx], sil
jne 0x14008c634
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, r14
call fcn.140042830
mov rcx, qword [0x140168d00]
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, edi
mov edx, ebx
mov r8, rax
mov qword [0x140168d00], rax
mov rcx, r14
call fcn.140042830
mov ecx, eax
mov rax, qword [0x140168d00]
mov word [rax + rcx*2], si
mov rdx, qword [0x140168d00]
mov rcx, qword [0x140168cf8]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]

Function at 0x14008c6c0
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14008c6e0
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call fcn.140042830
mov rcx, qword [0x140168cf8]
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, edi
mov edx, ebx
mov r8, rax
mov qword [0x140168cf8], rax
mov rcx, rsi
call fcn.140042830
mov ecx, eax
xor edx, edx
mov rax, qword [0x140168cf8]
mov word [rax + rcx*2], dx
mov rcx, qword [0x140168cf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrmdir]

Function at 0x14008c850
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14008c870
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call fcn.140042830
mov rcx, qword [0x140168cf8]
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, edi
mov edx, ebx
mov r8, rax
mov qword [0x140168cf8], rax
mov rcx, rsi
call fcn.140042830
mov ecx, eax
xor edx, edx
mov rax, qword [0x140168cf8]
mov word [rax + rcx*2], dx
mov rcx, qword [0x140168cf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
Function at 0x14009cd90
Capabilities:
Open clipboard

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
mov rbx, rdx
xor edi, edi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x14009cdb6
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8, qword [str.text_plain]
mov rax, rbx
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14009cdd6
inc rax
test ecx, ecx
jne 0x14009cdc3
test edx, edx
je 0x14009ce3a
cmp byte [rbx], dil
je 0x14009ce3a
mov rdx, qword [str.image]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x14009ce02
inc rbx
test eax, eax
jne 0x14009cdf0
test ecx, ecx
jne 0x14009ce47
mov ecx, 8
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14009ce22
lea ecx, [rax + 0xe]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x14009ce47
mov edi, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov edi, eax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x30]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x14009cee0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
test rdx, rdx
je 0x14009d12d
push rbx
push rdi
sub rsp, 0x38
mov edi, r8d
mov rbx, rdx
test r8d, r8d
js 0x14009d127
mov qword [rsp + 0x50], rbp
cmp r9d, 2
mov qword [rsp + 0x58], rsi
mov ebp, 1
mov qword [rsp + 0x60], r12
mov eax, r8d
mov qword [rsp + 0x30], r13
mov r12d, ebp
cmovl r12d, r9d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov esi, r15d
test r8d, r8d
jle 0x14009cfd3
nop
movzx ecx, byte [rdx]
cmp cl, 0xd
jne 0x14009cf5f
cmp byte [rdx + 1], 0xa
jne 0x14009cf69
cmp eax, 2
jb 0x14009cf69
add esi, 2
mov ecx, 2
dec eax
jmp 0x14009cf6e
cmp cl, 0xa
jne 0x14009cf69
add esi, 2
jmp 0x14009cf6b
inc esi
mov rcx, rbp
dec eax
add rdx, rcx
test eax, eax
jg 0x14009cf40
lea ebp, [rsi + 1]
movsxd rcx, ebp
call fcn.1400fbf44
mov r14, rax
movzx ecx, byte [rbx]
cmp cl, 0xd
jne 0x14009cfaf
cmp byte [rbx + 1], 0xa
lea rdx, [rbx + 1]
jne 0x14009cfaf
cmp edi, 2
jb 0x14009cfaf
mov byte [rax], cl
mov rbx, rdx
movzx ecx, byte [rdx]
mov byte [rax + 1], cl
add rax, 2
dec edi
jmp 0x14009cfc8
cmp cl, 0xa
jne 0x14009cfc3
mov byte [rax], 0xd
movzx ecx, byte [rbx]
mov byte [rax + 1], cl
add rax, 2
jmp 0x14009cfc8
mov byte [rax], cl
inc rax
dec edi
inc rbx
test edi, edi
jg 0x14009cf85
jmp 0x14009cfde
mov rcx, rbp
call fcn.1400fbf44
mov r14, rax
movsxd rdi, r12d
lea r13, [0x140000000]
mov byte [rax], r15b
cmp ebp, dword [r13 + rdi*4 + 0x16aa30]
mov rbp, qword [rsp + 0x50]
jle 0x14009d022
mov rcx, qword [r13 + rdi*8 + 0x16aa18]
call fcn.1400fbf3c
lea ebx, [rsi + 0x64]
movsxd rcx, ebx
call fcn.1400fbf44
mov qword [r13 + rdi*8 + 0x16aa18], rax
mov dword [r13 + rdi*4 + 0x16aa30], ebx
mov rcx, qword [r13 + rdi*8 + 0x16aa18]
mov rdx, r14
movsxd rbx, esi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [r13 + rdi*8 + 0x16aa18]
test r12d, r12d
mov r12, qword [rsp + 0x60]
mov byte [rbx + rax], r15b
mov dword [r13 + rdi*4 + 0x16aa28], esi
mov rsi, qword [rsp + 0x58]
mov byte [rdi + r13 + 0x16a9b4], 1
mov r13, qword [rsp + 0x30]
je 0x14009d115
call fcn.140043310
test rax, rax
je 0x14009d115
mov rax, qword [rax + 0xc8]
test rax, rax
je 0x14009d08a
mov r15, qword [rax]
mov rcx, r15
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14009d115
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, dword [0x14016aa2c]
xor r9d, r9d
mov rcx, qword [0x14016aa20]
xor r8d, r8d
call fcn.140042830
mov ebx, eax
lea ecx, [rax*2 + 2]
movsxd rdx, ecx
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [0x14016aa2c]
lea r9d, [rbx + 1]
mov rcx, qword [0x14016aa20]
mov r8, rax
call fcn.140042830
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov byte [0x14016a9b5], 1
mov rcx, r14
call fcn.1400fbf3c
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x14009deb0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140153558]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, ax
mov r9d, 6
lea r8, [rsp + 0x20]
mov edx, 0x1004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atol]
mov dword [0x140168ce8], eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400fbfe0
add rsp, 0x38
ret

Function at 0x14009dfb0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub rsp, 0x28
call fcn.140043310
test rax, rax
je 0x14009e071
mov rcx, qword [rax + 0xc8]
test rcx, rcx
je 0x14009dfd1
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14009e071
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, dword [0x14016aa2c]
xor r9d, r9d
mov rcx, qword [0x14016aa20]
xor r8d, r8d
call fcn.140042830
mov ebx, eax
lea ecx, [rax*2 + 2]
movsxd rdx, ecx
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [0x14016aa2c]
lea r9d, [rbx + 1]
mov rcx, qword [0x14016aa20]
mov r8, rax
call fcn.140042830
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov byte [0x14016a9b5], 1
add rsp, 0x28
ret
Function at 0x14009ef80
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x14016b0c1], 0
jne 0x14009f0b8
lea rcx, str.User32.DLL
mov byte [0x14016b0c1], 1
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SetProcessDpiAwarenessContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14009efd0
mov rcx, 0xfffffffffffffffc
call rax
test eax, eax
setne al
mov byte [0x14016aa45], al
jmp 0x14009efd7
movzx eax, byte [0x14016aa45]
test al, al
jne 0x14009f01b
lea rcx, str.Shcore.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SetProcessDpiAwareness
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14009f01b
mov ecx, 2
call rax
movzx ecx, byte [0x14016aa45]
test eax, eax
mov edx, 1
cmove ecx, edx
mov byte [0x14016aa45], cl
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
lea rcx, str.IMM32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14016aa58], rax
test rax, rax
jne 0x14009f050
lea rcx, str.FLTK_Lib_Error:_IMM32.DLL_file_not_found__n_nPlease_check_your_input_method_manager_library_accessibility.
call qword [str._B_n_]
mov rax, qword [0x14016aa58]
lea rdx, str.ImmAssociateContextEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14016aa58]
lea rdx, str.ImmGetContext
mov qword [0x14016a9f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14016aa58]
lea rdx, str.ImmSetCompositionWindow
mov qword [0x14016aa00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14016aa58]
lea rdx, str.ImmReleaseContext
mov qword [0x14016aa08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14016aa10], rax
add rsp, 0x28
ret
Function at 0x14009f890
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x678
mov rax, qword [0x140153558]
xor rax, rsp
mov qword [rsp + 0x660], rax
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [0x14016a9b8]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14009f8e7
mov eax, 1
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400fbfe0
add rsp, 0x678
ret
cmp dword [0x14016b088], 0
jne 0x14009f90a
xor eax, eax
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400fbfe0
add rsp, 0x678
ret
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], 0
lea rdx, [0x14016aa70]
mov r8d, 0x618
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x30]
xor ecx, ecx
lea r9, [rsp + 0x450]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x248]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1400fbfe0
add rsp, 0x678
ret
Function at 0x1400a4260
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 2
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call fcn.1400a49e0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdx, rax
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1400a7490
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, edx
call fcn.1400a74b0
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0xfffffffe
add rsp, 0x28
ret

Function at 0x1400a7540
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x130
mov rax, qword [0x140153558]
xor rax, rsp
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x20]
mov ebx, edx
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, ebx
call fcn.1400a74b0
movsxd rcx, eax
movzx eax, byte [rsp + rcx + 0x20]
and eax, 0xfffffffe
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400fbfe0
add rsp, 0x130
pop rbx
ret
Function at 0x1400a8960
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov r13d, dword [rdx + 0x1c]
mov r14, rdx
mov ebp, dword [rdx + 0x20]
mov rbx, qword [rdx + 0x30]
mov dword [rdx + 0x48], r13d
mov dword [rdx + 0x4c], ebp
lea eax, [r13 + 7]
cdq
and edx, 7
lea edi, [rdx + rax]
lea eax, [r13 + 0xf]
sar edi, 3
cdq
and edx, 0xf
lea esi, [rdx + rax]
sar esi, 4
add esi, esi
mov ecx, esi
imul ecx, ebp
movsxd rcx, ecx
call fcn.1400fbf44
mov r15, rax
mov r8, rax
test ebp, ebp
jle 0x1400a8a22
sub esi, edi
mov qword [rsp + 0x60], r12
movsxd rsi, esi
lea r12, [0x140151ff0]
mov r11d, ebp
test edi, edi
jle 0x1400a8a14
mov r10, rdi
nop dword [rax + rax]
movzx r9d, byte [rbx]
inc rbx
mov eax, r9d
mov ecx, r9d
shr rcx, 4
and eax, 0xf
and r9d, 0xf
movzx edx, byte [rcx + r12]
xor dl, byte [rax + r12]
and dl, 0xf
xor dl, byte [r9 + r12]
mov byte [r8], dl
inc r8
sub r10, 1
jne 0x1400a89e0
add r8, rsi
sub r11, 1
jne 0x1400a89d4
mov r12, qword [rsp + 0x60]
mov r9d, 1
mov qword [rsp + 0x20], r15
mov r8d, r9d
mov edx, ebp
mov ecx, r13d
call qword [sym.imp.GDI32.dll_CreateBitmap]
mov rcx, r15
mov rbx, rax
call fcn.1400fbf3c
mov rbp, qword [rsp + 0x70]
mov qword [r14 + 0x40], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x1400be690
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword gs:[0x58]
mov rdi, rcx
mov r9d, dword [0x14016db58]
mov ebp, r8d
mov ecx, 4
mov esi, edx
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm7
mov r9, qword [rax + r9*8]
mov eax, dword [rcx + r9]
cmp dword [0x14016dab0], eax
jg 0x1400be825
cmp byte [rdi + 0x78], 0
mov rax, qword [rdi + 0x58]
mov rcx, qword [rax]
movss xmm0, dword [rcx]
movss xmm4, dword [rcx + 4]
cvtps2pd xmm0, xmm0
cvtps2pd xmm4, xmm4
je 0x1400be743
addsd xmm0, qword [0x140113c08]
addsd xmm4, qword [0x140113c08]
xorps xmm3, xmm3
xorps xmm2, xmm2
cvtsi2ss xmm3, esi
cvttsd2si eax, xmm0
xorps xmm0, xmm0
cvtsi2ss xmm2, ebp
cvtsi2ss xmm0, eax
cvttsd2si eax, xmm4
divss xmm3, xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, eax
divss xmm2, xmm0
minss xmm3, xmm2
cvtps2pd xmm6, xmm3
movaps xmm7, xmm6
jmp 0x1400be75b
movd xmm6, esi
movd xmm7, ebp
cvtdq2pd xmm6, xmm6
cvtdq2pd xmm7, xmm7
divsd xmm6, xmm0
divsd xmm7, xmm4
mov eax, esi
imul eax, ebp
shl eax, 2
movsxd rcx, eax
call fcn.1400fbf44
mov rdx, qword [rdi + 0x58]
lea ecx, [rsi*4]
mov dword [rsp + 0x48], ecx
lea rbx, [rdi + 0x30]
mov rcx, qword [0x14016daa8]
xorps xmm3, xmm3
mov dword [rsp + 0x40], ebp
xorps xmm2, xmm2
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rax
cvtpd2ps xmm0, xmm7
mov qword [rbx], rax
mov rdx, qword [rdx]
cvtpd2ps xmm1, xmm6
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x20], xmm1
call fcn.1400bef00
cmp byte [rdi + 0x6c], 0
mov dword [rdi + 0x38], 1
mov qword [rdi + 0x28], rbx
mov dword [rdi + 0x18], 1
mov dword [rdi + 0x10], 4
je 0x1400be7de
mov rcx, rdi
call fcn.14005cf70
movss xmm2, dword [rdi + 0x74]
movss xmm0, dword [0x140113c04]
comiss xmm0, xmm2
jbe 0x1400be7fb
mov edx, dword [rdi + 0x70]
mov rcx, rdi
call fcn.14005c420
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
movaps xmm7, xmmword [rsp + 0x50]
mov dword [rdi + 0x64], esi
mov rsi, qword [r11 + 0x20]
mov dword [rdi + 0x68], ebp
mov rbp, qword [r11 + 0x18]
mov byte [rdi + 0x60], 1
mov rsp, r11
pop rdi
ret
lea rcx, [0x14016dab0]
call fcn.1400fc3d8
cmp dword [0x14016dab0], 0xffffffff
jne 0x1400be6df
mov ecx, 0x80
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
jne 0x1400be850
jmp 0x1400be880
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov dword [rax + 8], 0x3e800000
mov dword [rax + 0xc], 0x3c23d70a
lea rcx, [0x14016dab0]
mov qword [0x14016daa8], rax
call fcn.1400fc378
jmp 0x1400be6df
Function at 0x1400be9b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
lea rdx, [0x1401126c4]
mov rdi, rcx
call fcn.140042140
mov rbx, rax
test rax, rax
je 0x1400be9f8
mov edx, 2
lea rcx, [rsp + 0x58]
mov r9, rax
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
jae 0x1400bea05
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp byte [rsp + 0x58], 0x1f
jne 0x1400bea17
cmp byte [rsp + 0x59], 0x8b
jne 0x1400bea17
xor ebp, ebp
jmp 0x1400bea1c
mov ebp, 1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, rbx
movsxd rsi, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.140042360
test eax, eax
js 0x1400be9f8
lea rdx, [0x1401126c4]
mov ecx, eax
call fcn.1400f3b80
mov r12, rax
test rax, rax
je 0x1400be9f8
mov qword [rsp + 0x50], r14
mov r14d, esi
mov qword [rsp + 0x60], r15
test ebp, ebp
jne 0x1400bea7e
lea r14d, [rsi + rsi*2]
inc r14d
movsxd rcx, r14d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
lea r15d, [r14 + 1]
mov rbx, rax
test ebp, ebp
jne 0x1400beac5
movsxd rdx, r14d
lea rcx, [rbx + rsi]
add rdx, rdi
cmp rcx, rdx
jbe 0x1400beac5
add r15d, esi
mov rcx, rdi
movsxd rdx, r15d
add r14d, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rcx, rax
sub rcx, rdi
mov rdi, rax
add rbx, rcx
mov r8d, esi
mov rdx, rbx
mov rcx, r12
call fcn.1400f4540
test eax, eax
jle 0x1400beae0
movsxd rcx, eax
add rbx, rcx
mov byte [rbx], 0
test ebp, ebp
jne 0x1400beae8
test eax, eax
jg 0x1400bea94
mov rcx, r12
call fcn.1400f45b0
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x50]
test ebp, ebp
jne 0x1400beb11
sub rbx, rdi
mov rcx, rdi
lea rdx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rdi, rax
mov rax, rdi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c0110
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x24]
mov rbx, rcx
cmp eax, 0xca
jne 0x1400c0146
call fcn.1400c0350
cmp byte [rbx + 0x58], 0
je 0x1400c013d
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
jmp 0x1400c0151
cmp eax, 0xcb
jne 0x1400c01d5
mov rax, qword [rbx + 0x240]
cmp byte [rax + 0x20], 0
je 0x1400c01bc
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400c016e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x240]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1400c01b4
cmp eax, 2
je 0x1400c01bc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400c0160
dec eax
test eax, 0xfffffffd
jne 0x1400c0160
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x1400c0160
mov ecx, dword [rbx + 0x190]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x1400c0160
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x1400c0210
cmp eax, 0xcc
je 0x1400c01f7
mov rax, qword [rcx]
mov dword [rax + 0x28], 0x15
mov rcx, qword [rcx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400c0210
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
cmp dword [rcx + 0x24], 0xcc
je 0x1400c023e
mov rax, qword [rcx + 0x220]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x220]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x1400c02e5
mov ecx, dword [rbx + 0x98]
nop
cmp ecx, dword [rbx + 0x78]
jae 0x1400c02b4
mov rax, qword [rbx + 0x10]
mov edi, ecx
test rax, rax
je 0x1400c028c
mov dword [rax + 8], ecx
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov edi, dword [rbx + 0x98]
mov rax, qword [rbx + 0x228]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + 8]
mov ecx, dword [rbx + 0x98]
cmp ecx, edi
je 0x1400c030d
cmp ecx, dword [rbx + 0x78]
jb 0x1400c0265
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov ecx, ebp
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x10], cl
jne 0x1400c0260
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x1400c02f8