joyce8/EMBER2024-capa huggingface dataset:
Function at 0x382382460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x38238260a
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0x617604bccf00736f
mov qword [rsp + 0x69], rdx
movabs rdx, 0x653eb82005a24e61
mov qword [rsp + 0x70], rdx
movabs rdx, 0x532a72f78f15e365
mov qword [rsp + 0x78], rdx
movabs rdx, 0xc71b322ff717461f
mov qword [rsp + 0x80], rdx
movabs rdx, 0x6e65a0b6d8126c36
mov qword [rsp + 0x88], rdx
movabs rdx, 0x20b32a9d8717c965
mov qword [rsp + 0x90], rdx
movabs rdx, 0xd63a456fa04120f9
mov qword [rsp + 0x98], rdx
movabs rdx, 0x171a122b21290c1e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1522040d161d3003
mov qword [rsp + 0x25], rdx
movabs rdx, 0x233629301522040d
mov qword [rsp + 0x29], rdx
movabs rdx, 0x2432081f03331815
mov qword [rsp + 0x31], rdx
movabs rdx, 0x9291f2f2a28282d
mov qword [rsp + 0x39], rdx
movabs rdx, 0x352221211004330d
mov qword [rsp + 0x41], rdx
movabs rdx, 0x112b17032a0a220f
mov qword [rsp + 0x49], rdx
movabs rdx, 0xd3316020818221a
mov qword [rsp + 0x51], rdx
movabs rdx, 0x1928331d0d323633
mov qword [rsp + 0x59], rdx
movabs rdx, 0x1c24151305352c1b
mov qword [rsp + 0x61], rdx
xor eax, eax
jmp 0x3823825a6
movzx r9d, byte [rsp + rsi + 0x69]
sub r9d, edx
lea edx, [r9 - 0x40]
mov byte [rsp + rdi + 0x69], dl
lea edx, [r8 - 0x40]
mov byte [rsp + rsi + 0x69], dl
add rax, 2
cmp rax, 0x4c
jge 0x3823825d7
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x37
jae 0x3823825fd
movzx r8d, byte [rsp + rdi + 0x69]
sub r8d, edx
cmp rsi, 0x37
jb 0x382382589
jmp 0x3823825f1
xor eax, eax
lea rbx, [rsp + 0x69]
mov ecx, 0x37
call fcn.382294b80
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.3822a6820
mov eax, edi
mov ecx, 0x37
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.382382460
Function at 0x3823848a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x382384a27
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x48213247de65e735
mov qword [rsp + 0x61], rdx
movabs rdx, 0x72c07251654c6467
mov qword [rsp + 0x69], rdx
movabs rdx, 0x4a4b706176778d72
mov qword [rsp + 0x70], rdx
movabs rdx, 0x871d37cb18db676e
mov qword [rsp + 0x78], rdx
movabs rdx, 0x551c6c415e3f72d5
mov qword [rsp + 0x80], rdx
movabs rdx, 0xee3467fad5360fb7
mov qword [rsp + 0x88], rdx
movabs rdx, 0x1629161925081c08
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1b2e1e1516291619
mov qword [rsp + 0x21], rdx
movabs rdx, 0x11e12271c23252e
mov qword [rsp + 0x29], rdx
movabs rdx, 0x27232a031a2b0e28
mov qword [rsp + 0x31], rdx
movabs rdx, 0x42b012e1f100306
mov qword [rsp + 0x39], rdx
movabs rdx, 0x1f1915001d051b12
mov qword [rsp + 0x41], rdx
movabs rdx, 0x230a1a211b22261a
mov qword [rsp + 0x49], rdx
movabs rdx, 0x1f0a002d280c2707
mov qword [rsp + 0x51], rdx
movabs rdx, 0xe1a052a261f0c
mov qword [rsp + 0x59], rdx
xor eax, eax
jmp 0x3823849c2
movzx r9d, byte [rsp + rsi + 0x61]
sub r9d, edx
lea edx, [r9 + 0x78]
mov byte [rsp + rdi + 0x61], dl
lea edx, [r8 + 0x78]
mov byte [rsp + rsi + 0x61], dl
add rax, 2
cmp rax, 0x44
jge 0x3823849ef
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2f
jae 0x382384a1a
movzx r8d, byte [rsp + rdi + 0x61]
sub r8d, edx
cmp rsi, 0x2f
jb 0x3823849a5
jmp 0x382384a0e
xor eax, eax
lea rbx, [rsp + 0x61]
mov ecx, 0x2f
nop dword [rax + rax]
call fcn.382294b80
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x2f
call fcn.3822a6820
mov eax, edi
mov ecx, 0x2f
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.3823848a0

Function at 0x38238de20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38238df0c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x5ead902d1020713
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x7a05ead902d10207
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf24645444342ce39
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70301060605000a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x208070301060605
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x70405101002
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x38238deaa
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x24]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x12
jge 0x38238dedc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x38238deff
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x24]
cmp rsi, 0x11
jb 0x38238de90
jmp 0x38238def3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.382294b80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.3822a6820
mov eax, edi
mov ecx, 0x11
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.38238de20
Function at 0x38238ebe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38238ecca
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x85ba3534e2325e30
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xb885ba3534e2325e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x26fbd5cecf62fe39
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd0c070f01100f07
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x100a0d0c070f0110
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x8060107030e0f0e
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x38238ec6d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x64]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x64]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x12
jge 0x38238ec9a
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x38238ecbd
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x38238ec50
jmp 0x38238ecb1
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.382294b80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.3822a6820
mov eax, edi
mov ecx, 0x11
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.38238ebe0

Function at 0x38238ece0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38238edcc
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x376635132d54ed0f
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x38376635132d54ed
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0f5da641c628122
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc030310060c0a10
mov qword [rsp + 0x19], rdx
movabs rdx, 0x40a0f090a020c03
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe00040101030603
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x38238ed6a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x34]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x16
jge 0x38238ed9c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x38238edbf
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x34]
cmp rsi, 0x11
jb 0x38238ed50
jmp 0x38238edb3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.382294b80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.3822a6820
mov eax, edi
mov ecx, 0x11
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.38238ece0
Function at 0x38238ede0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38238eeca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe38a737233da18a4
mov qword [rsp + 0x37], rdx
movabs rdx, 0x13e38a737233da18
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa06638007c856110
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60c06000d0b0504
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x90e0e1002060c10
mov qword [rsp + 0x27], rdx
movabs rdx, 0x700080d010c0405
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x38238ee6d
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 + 0x6a]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 + 0x6a]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x18
jge 0x38238ee9a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x38238eebd
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x11
jb 0x38238ee50
jmp 0x38238eeb1
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.382294b80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.3822a6820
mov eax, edi
mov ecx, 0x11
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.38238ede0

Function at 0x382395340
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.382396760
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.382396760
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x3823953b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x38250a844]
mov r12, rcx
test ebx, ebx
jle 0x3823954e0
mov rax, qword [0x38250a848]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x3823953fc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x382395483
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x3823953e0
mov rcx, r12
call fcn.382395b30
mov rsi, rax
test rax, rax
je 0x382395502
mov rax, qword [0x38250a848]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.382395c60
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x38250a848]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x3823954e7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x38239547c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x382395490
add dword [0x38250a844], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x38250a848]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x38239547c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.382395340
nop dword [rax]
xor ebx, ebx
jmp 0x382395407
mov rax, qword [0x38250a848]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.382395340
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.382395340
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x3823957a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x38250a880]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x38250a860]
test rbx, rbx
je 0x3823957f4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x3823957eb
test r12, r12
je 0x3823957eb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x3823957d0
lea rcx, [0x38250a880]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x382395b30
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x382476e80]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x382395b50
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x382395b58
ret
cmp word [r8 + 0x18], 0x20b
jne 0x382395b50
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x382395ba5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x382395b9c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x382395b50
add rax, 0x28
cmp rax, r9
jne 0x382395b88
xor eax, eax
ret

Function at 0x382395bb0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x382476e80]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x382395bd0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x382395bd8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x382395bd0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x382395c60
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x382476e80]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x382395c80
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x382395c88
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x1422bb058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1422bb1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1422bb089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1422bb06f
add dl, dl
jne 0x1422bb096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1422bb0f6
xor eax, eax
add dl, dl
jne 0x1422bb0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1422bb1ad
add dl, dl
jne 0x1422bb0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1422bb0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1422bb0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1422bb0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1422bb0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1422bb07e
mov eax, 1
add dl, dl
jne 0x1422bb106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1422bb113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1422bb0fb
sub eax, ebx
mov ebx, 1
jne 0x1422bb14c
mov ecx, 1
add dl, dl
jne 0x1422bb12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1422bb13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1422bb123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1422bb07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1422bb168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1422bb175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1422bb15d
cmp eax, 0x7d00
jae 0x1422bb19b
cmp eax, 0x500
jb 0x1422bb196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1422bb07e
cmp eax, 0x7f
ja 0x1422bb19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1422bb07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1422bb1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1422bb07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002dd0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140002df8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140002e1e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002e20
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002e79
test ecx, ecx
jle 0x140002e59
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002e79
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002e79
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140002ea0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002ed1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x140002eef
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002f0b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002f0d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002f49
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140002fde
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140002f84
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140002fbe
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140002fde
cmp rbx, rax
ja 0x140002f90
test rbx, rbx
je 0x140002fde
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140003420
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140003444
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140003487
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140003487
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x1400035b8
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400034ca
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400034f5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1400035bd
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000356a
sub eax, 1
je 0x14000356a
cmp eax, 2
jne 0x1400035b8
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1400035bd
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14000359b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400035b8
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400035bd
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1400039e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003aa9
cmp byte [rcx + 0x71], 0
je 0x140003aa9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140003a9c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003a58
sub eax, 1
je 0x140003a5c
cmp eax, 2
jne 0x140003a9c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140003a8a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140003a9c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x140005700
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000574a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000574a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000574a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000574a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000574a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000574c
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001030
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140001b38
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b82
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b82
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b82
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b82
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b82
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b84
xor al, al
add rsp, 0x28
ret