joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069920
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [str.LB_a_]
mov rdi, rax
test rax, rax
je 0x1400698ed
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x140069918
cmp ebx, esi
je 0x140069918
cmp ebx, 0x8000
ja 0x140069918
cmp ebx, esi
jb 0x140069913
mov edx, ebx
mov rcx, rdi
call qword [str.LB_a_]
mov rdi, rax
test rax, rax
jne 0x1400698b0
mov rcx, rbp
call qword [str._B_a_]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x1400698f8
mov rcx, rdi
jmp 0x1400698f0
jmp 0x140069870

Function at 0x14006b540
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.140035490
mov rcx, rbx
movups xmm6, xmmword [rax]
call fcn.14006b130
mov rcx, rdi
mov rsi, rax
call fcn.14006b130
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x14006b5f0
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.140035490
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.140035520
cmp rax, 0x3e8
ja 0x14006b623
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14006b5a0
test rsi, rsi
je 0x14006b5fe
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x14006b60c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x14006b631
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x14006b63f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
jmp 0x14006b60e
Function at 0x14006c1b0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400cd070]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, r8
mov dword [rsp + 0x40], 8
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14006c27c
mov qword [rsp + 0xa0], rbp
lea rdx, [rsp + 0x64]
xor ebp, ebp
mov dword [rsp + 0x58], 0x208
mov rcx, rsi
mov qword [rsp + 0x64], rbp
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
call fcn.14006c2f0
lea rcx, [rsp + 0x64]
lea edx, [rbp + 8]
call fcn.14006e9e0
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r8d, [rbp + 0x14]
xor r9d, r9d
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rbp, qword [rsp + 0xa0]
test eax, eax
jne 0x14006c280
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x14006c2ca
mov rax, qword [rdi]
xor r9d, r9d
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov qword [rbx], rax
xor edx, edx
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140072f40
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006e820
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x14006e862
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14006e8a9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14006e902
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x14006e8c0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14006e943
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14008129e]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14008129f]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14006e910
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140001b6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bb6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bb8
xor al, al
add rsp, 0x28
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005480]
mov dword [rax], 1
mov rax, qword [0x140005490]
mov dword [rax], 1
mov rax, qword [0x1400054a0]
mov dword [rax], 1
mov rax, qword [0x140005430]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001680
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r9, r8
test ecx, ecx
jne 0x1400016e0
mov rax, rdx
and rax, 0xfffffffffffffffb
cmp rax, 0x100
je 0x140001700
cmp rax, 0x101
jne 0x1400016c8
mov eax, dword [r8]
cmp eax, 0xa3
je 0x1400017f0
cmp eax, 0xa5
jne 0x1400016c8
mov byte [0x140008030], 0
nop dword [rax]
cmp byte [section..data], 0
je 0x1400016e0
mov eax, 1
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov r8, rbx
mov edx, ecx
mov rcx, qword [0x140008038]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.USER32.dll_CallNextHookEx]
mov eax, dword [r8]
cmp eax, 0xa3
je 0x1400017d0
movzx edx, byte [0x140008031]
cmp eax, 0xa5
jne 0x1400017b0
mov byte [0x140008030], 1
test dl, dl
je 0x1400016c8
mov rsi, qword [sym.imp.libstdc_6.dll_std::cout]
mov r8d, 0x10
lea rdx, str.Input_unblocked_
mov qword [rsp + 0x28], r9
mov byte [section..data], 0
mov rcx, rsi
call sym.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov rax, qword [rsi]
mov r9, qword [rsp + 0x28]
mov rax, qword [rax - 0x18]
mov rdi, qword [rax + rsi + 0xf0]
test rdi, rdi
je 0x140001840
cmp byte [rdi + 0x38], 0
je 0x140001800
movsx edx, byte [rdi + 0x43]
mov rcx, rsi
mov qword [rsp + 0x28], r9
call sym.std::ostream::put_char_
mov rcx, rax
call sym.std::ostream::flush__
mov rcx, qword [0x140008038]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov r9, qword [rsp + 0x28]
mov r8, rbx
xor edx, edx
jmp 0x1400016e5
test dl, dl
je 0x1400016c8
cmp byte [0x140008030], 0
je 0x1400016c8
jmp 0x14000172b
cmp byte [0x140008030], 0
mov byte [0x140008031], 1
je 0x1400016c8
jmp 0x14000172b
mov byte [0x140008031], 0
jmp 0x1400016c8
mov rcx, rdi
mov qword [rsp + 0x28], r9
call sym.std::ctype_char_::_M_widen_init___const
mov rax, qword [rdi]
mov r9, qword [rsp + 0x28]
lea rcx, [method.std::ctype_char_.do_widen_char__const]
mov edx, 0xa
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x14000177e
mov rcx, rdi
call rax
mov r9, qword [rsp + 0x28]
movsx edx, al
jmp 0x14000177e
call sym.std::__throw_bad_cast__
nop
nop word cs:[rax + rax]
Function at 0x140001f10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140002be2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140008128]
test eax, eax
je 0x140002c7a
lea rax, [0x140008100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140008130]
mov qword [rbp - 8], rax
jmp 0x140002c5e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002c52
cmp qword [rbp - 0x10], 0
je 0x140002c52
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002c18
lea rax, [0x140008100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140002c7b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140002d80
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140002da8
mov eax, 0
jmp 0x140002df6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140002dd1
mov eax, 0
jmp 0x140002df6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002df1
mov eax, 0
jmp 0x140002df6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x140002dfc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140002e7a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140002e71
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140002e71
mov rax, qword [rbp - 8]
jmp 0x140002e8f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140002e44
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001a70
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140001a98
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001abe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001ac0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001b19
test ecx, ecx
jle 0x140001af9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001b19
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001b19
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140001b40
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140001b62
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140001b78
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001b94
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001b96
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140001bd2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140001c6e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140001c0d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140001c4e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140001c6e
cmp rbx, rax
ja 0x140001c20
test rbx, rbx
je 0x140001c6e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400020d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400020fd
xor eax, eax
jmp 0x140002269
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002137
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002137
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002269
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000225c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000217a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400021a5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002261
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002214
sub eax, 1
je 0x140002214
cmp eax, 2
jne 0x14000225c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002261
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002242
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000225c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002261
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002fe0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400026d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400027a3
cmp byte [rcx + 0x71], 0
je 0x1400027a3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000279f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002764
sub eax, 1
je 0x140002768
cmp eax, 2
jne 0x14000279f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002fe0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002796
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000279f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000274c
xor al, al
jmp 0x14000274c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002fe0
add rsp, 0x60
pop rbx
ret

Function at 0x140003960
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400039aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400039aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400039aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400039aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400039aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400039ac
xor al, al
add rsp, 0x28
ret

Function at 0x140001120
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x140003680]
syscall
ret

Function at 0x140001a00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a4c
xor al, al
add rsp, 0x28
ret
Function at 0x140001600
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
cmp qword [rcx + 0x18], 0xf
jbe 0x14000160e
mov rcx, qword [rcx]
mov r8, rcx
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x38
ret

Function at 0x140001640
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 2
lea rdx, str.license_check.txt
lea rcx, [rsp + 0x30]
call fcn.140003590
nop
cmp qword [rsp + 0xb8], 0
je 0x1400016dc
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400016a0
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400044c0
lea rcx, [rsp + 0x38]
call fcn.140003a60
test rax, rax
jne 0x1400016dc
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.notepad_license_check.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rsp + 0x30]
call fcn.140001290
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400048c0
add rsp, 0x150
pop rbx
ret