joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045840
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x14007c040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [0x14007eb28], 0
mov rbp, rdx
mov rbx, rcx
je 0x1400458a3
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r8, qword [0x14007eb20]
mov rax, qword [rsp + 0x20]
cqo
idiv r8
mov rsi, rax
mov rax, qword [rsp + 0x20]
cqo
idiv r8
imul rax, rdx, 0xf4240
cqo
idiv r8
mov r14, rax
jmp 0x1400458c9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
mov esi, edx
imul edx, edx, 0x3e8
sub r8d, edx
imul r14d, r8d, 0x3e8
mov rcx, rbx
mov qword [rsp + 0x70], r15
call fcn.140011110
mov rcx, rbp
mov rdi, rax
call fcn.140011110
mov r8d, 1
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400459d4
movabs rbp, 0x20c49ba5e353f6
movabs r15, 0x4189374bc6a7ec
cmp byte [0x14007eb28], 0
je 0x14004594c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
idiv qword [0x14007eb20]
mov r9, rax
imul rax, rdx, 0xf4240
cqo
idiv qword [0x14007eb20]
mov rcx, rax
jmp 0x140045973
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
imul ecx, edx, 0x3e8
mov r9d, edx
sub r8d, ecx
imul ecx, r8d, 0x3e8
sub r9, rsi
lea rax, [r9 + rbp]
cmp rax, r15
ja 0x140045a0f
sub ecx, r14d
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul rax, r9, 0x3e8
movsxd rcx, edx
add rcx, rax
js 0x140045a0f
cmp rcx, 0x3e8
jg 0x140045a0f
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140045912
test rdi, rdi
je 0x1400459e2
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x1400459f0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov r15, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140065250
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
test rdi, rdi
je 0x140045a1d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x140045a2b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, 1
jmp 0x1400459f2
Function at 0x14004cf20
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14007c040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, Ordinal_26
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14004cf6c
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x14004d036
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14004cfb0
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x14004d036
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
lea edx, [r8 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x14004d012
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14004d022
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14004d034
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140065250
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140054620
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14007c040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov byte [rsp + 0x20], 0xff
mov rcx, qword [rcx + 0x20]
mov esi, r8d
mov edi, edx
mov byte [rsp + 0x22], sil
xor r9d, r9d
mov byte [rsp + 0x21], dil
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x188]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140054687
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbx
mov r8d, eax
call fcn.140013150
mov r9d, esi
lea rdx, str.SENT
mov r8d, edi
mov rcx, rbx
call fcn.1400544f0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140065250
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400546c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14007c040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, qword [rcx + 0x198]
mov rbx, rcx
movsxd rdi, edx
mov ecx, dword [rsi + rdi*4 + 8]
test ecx, ecx
je 0x1400547df
sub ecx, 2
je 0x140054737
cmp ecx, 1
jne 0x1400547bb
mov ecx, dword [rsi + rdi*4 + 0x408]
test ecx, ecx
je 0x14005472a
cmp ecx, 1
jne 0x1400547bb
mov dword [rsi + rdi*4 + 8], ecx
mov dword [rsi + rdi*4 + 0x408], 0
jmp 0x1400547bb
mov dword [rsi + rdi*4 + 8], 0
jmp 0x1400547bb
mov ecx, dword [rsi + rdi*4 + 0x408]
test ecx, ecx
je 0x1400547d5
cmp ecx, 1
jne 0x1400547bb
mov dword [rsi + rdi*4 + 8], 3
mov dword [rsi + rdi*4 + 0x1008], 0
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov word [rsp + 0x20], 0xfcff
mov byte [rsp + 0x22], dil
mov rcx, qword [rcx + 0x188]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400547a3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbx
mov r8d, eax
call fcn.140013150
mov r9d, edi
lea rdx, str.SENT
mov r8d, 0xfc
mov rcx, rbx
call fcn.1400544f0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140065250
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov dword [rsi + rdi*4 + 8], 1
jmp 0x140054852
cmp dword [rsi + rdi*4 + 0x808], 1
jne 0x14005486f
mov dword [rsi + rdi*4 + 8], 1
lea rdx, [rsp + 0x20]
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
mov word [rsp + 0x20], 0xfbff
mov byte [rsp + 0x22], dil
mov rcx, qword [rcx + 0x188]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14005483a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbx
mov r8d, eax
call fcn.140013150
mov r9d, edi
lea rdx, str.SENT
mov r8d, 0xfb
mov rcx, rbx
call fcn.1400544f0
cmp dword [rsi + rdi*4 + 0x1808], 1
jne 0x1400547bb
mov edx, edi
mov rcx, rbx
call fcn.1400555e0
jmp 0x1400547bb
cmp dword [rsi + rdi*4 + 0x1808], 1
jne 0x14005475e
mov dword [rsi + rdi*4 + 8], 1
lea rdx, [rsp + 0x20]
mov rcx, qword [rbx + 0x20]
xor r9d, r9d
mov word [rsp + 0x20], 0xfbff
mov byte [rsp + 0x22], dil
mov rcx, qword [rcx + 0x188]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400548ca
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbx
mov r8d, eax
call fcn.140013150
mov r9d, edi
lea rdx, str.SENT
mov r8d, 0xfb
mov rcx, rbx
call fcn.1400544f0
mov edx, edi
mov rcx, rbx
call fcn.1400555e0
jmp 0x1400547bb
Function at 0x1400555e0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x140055796
push rbp
push rsi
push r13
sub rsp, 0x30
mov rbp, qword [rcx + 0x198]
mov rsi, rcx
mov r13, qword [rcx + 0x20]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdi
lea rdi, [rbp + 0x1cd8]
mov qword [rsp + 0x28], r14
lea rbx, [rbp + 0x1ed8]
mov qword [rsp + 0x20], r15
mov qword [rbx], rdi
mov rax, rdi
cmp rdi, rbx
jae 0x140055636
lea rax, [rdi + 1]
mov byte [rdi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x14005564f
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x14005564f
mov byte [rax], 0x1f
inc qword [rbx]
movzx ecx, word [rbp + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rbp + 0x1caa]
movzx r14d, ax
shr r14w, 8
movzx r15d, ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
shr cx, 8
cmp r9, rbx
jae 0x14005568e
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x20]
cmp r9, rbx
jae 0x1400556a1
mov byte [r9], r14b
inc qword [rbx]
mov r9, qword [rbx]
mov r14, qword [rsp + 0x28]
cmp r9, rbx
jae 0x1400556e0
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400556e0
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400556e0
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400556e0
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rbp + 0x1ee0], r9
lea r8, [rbp + 0x1cda]
sub r9, rdi
mov qword [rbx], rdi
sub r9, 2
mov edx, 0x3e
mov rcx, rsi
call fcn.140054900
mov rcx, qword [r13 + 0x188]
xor r9d, r9d
mov rdx, rdi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
test eax, eax
jns 0x140055742
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.140013150
lea rdx, [rbp + 0x1cdb]
mov r8d, 4
mov rcx, rsi
call fcn.140055ff0
mov rcx, qword [r13 + 0x188]
lea rdx, [rbp + 0x1cdf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x14005578e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rsi
mov r8d, eax
call fcn.140013150
add rsp, 0x30
pop r13
pop rsi
pop rbp
ret
Function at 0x140057dd0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov r8d, dword [rcx]
mov r9, qword [rcx + 0x10]
test r8d, r8d
je 0x140057e37
sub r8d, 1
je 0x140057e2e
sub r8d, 1
je 0x140057e25
lea rdx, [0x14006a64c]
mov rcx, r9
cmp r8d, 1
je 0x140057e12
lea r8, str.Internal_state_machine_error
call fcn.140013150
mov eax, 0x47
add rsp, 0x28
ret
lea r8, str.TFTP_finished
call fcn.140013280
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.140057900
add rsp, 0x28
jmp fcn.1400575d0
add rsp, 0x28
jmp fcn.140056ed0
Function at 0x14005e660
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
push rbx
push rdi
push r15
sub rsp, 0xc0
mov rax, qword [0x14007c040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [rdx + 0x2c8]
mov r15, rcx
mov qword [r11 + 0x18], rsi
lea rdx, [rsp + 0x20]
mov qword [r11 - 0x20], r12
lea r12, [0x140000000]
mov qword [r11 - 0x28], r14
mov rcx, qword [rax]
movzx eax, byte [rcx]
test al, al
je 0x14005e6cc
nop dword [rax]
movzx eax, al
lea rcx, [rcx + 1]
movzx eax, byte [rax + r12 + 0x69060]
mov byte [rdx], al
inc rdx
movzx eax, byte [rcx]
test al, al
jne 0x14005e6b0
mov eax, dword [str._proxy]
mov edi, 1
mov dword [rdx], eax
xor ecx, ecx
movzx eax, word [0x140073fe4]
xor r14d, r14d
mov word [rdx + 4], ax
mov esi, edi
movzx eax, byte [0x140073fe6]
mov byte [rdx + 6], al
mov edx, edi
mov qword [rsp + 0xe8], rbp
call qword [0x14007c4d0]
mov rbx, rax
test rax, rax
je 0x14005e75f
nop dword [rax]
mov r8d, esi
lea rcx, [rsp + 0x20]
mov rdx, rbx
mov r14, rbx
mov ebp, esi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test eax, eax
je 0x14005e900
cmp esi, ebp
je 0x14005e900
cmp esi, 0x8000
ja 0x14005e900
cmp esi, ebp
jb 0x14005e8f2
mov edx, esi
mov rcx, rbx
call qword [0x14007c4d0]
mov rbx, rax
test rax, rax
jne 0x14005e710
mov rcx, r14
call qword [0x14007c4b8]
xor ebx, ebx
lea r8, [rsp + 0x20]
lea rdx, str.http_proxy
movzx r9d, byte [r8]
test r9b, r9b
je 0x14005e7a4
movzx ecx, byte [rdx]
movzx eax, byte [r9 + r12 + 0x69160]
cmp byte [rcx + r12 + 0x69160], al
jne 0x14005e7bb
inc rdx
inc r8
cmp byte [rdx], 0
jne 0x14005e776
movzx r9d, byte [r8]
xor ecx, ecx
cmp byte [rdx], cl
sete cl
xor eax, eax
test r9b, r9b
setne al
cmp ecx, eax
jne 0x14005e866
mov r8d, Ordinal_133
lea rdx, [rsp + 0x20]
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
movzx ecx, byte [rax + r12 + 0x69160]
mov byte [rdx - 1], cl
test cl, cl
je 0x14005e7ec
sub r8, rdi
jne 0x14005e7d0
mov rdx, rdi
xor ecx, ecx
xor ebp, ebp
call qword [0x14007c4d0]
mov rbx, rax
test rax, rax
je 0x14005e85b
nop dword [rax]
nop word [rax + rax]
mov r8d, edi
lea rcx, [rsp + 0x20]
mov rdx, rbx
mov rbp, rbx
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test eax, eax
je 0x14005e908
cmp edi, esi
je 0x14005e908
cmp edi, 0x8000
ja 0x14005e908
cmp edi, esi
jb 0x14005e866
mov edx, edi
mov rcx, rbx
call qword [0x14007c4d0]
mov rbx, rax
test rax, rax
jne 0x14005e810
mov rcx, rbp
call qword [0x14007c4b8]
xor ebx, ebx
mov r14, qword [rsp + 0xb0]
lea rdi, [rsp + 0x20]
mov r12, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
test rbx, rbx
jne 0x14005e8be
lea rdi, str.all_proxy
mov rcx, rdi
call fcn.1400213a0
mov rbx, rax
test rax, rax
jne 0x14005e8be
lea rdi, str.ALL_PROXY
mov rcx, rdi
call fcn.1400213a0
mov rbx, rax
test rax, rax
je 0x14005e8d6
mov r9, rbx
lea rdx, str.Uses_proxy_env_variable__s___s
mov r8, rdi
mov rcx, r15
call fcn.140013280
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140065250
add rsp, 0xc0
pop r15
pop rdi
pop rbx
ret
test rbx, rbx
jne 0x14005e866
jmp 0x14005e76a
mov rcx, rbx
jmp 0x14005e762
mov rcx, rbx
jmp 0x14005e85e
Function at 0x140061640
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14007c040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rcx + 0x20]
xor ebp, ebp
cmp byte [0x14007eb28], bpl
mov rsi, rdx
mov rdi, rcx
je 0x1400616aa
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x30]
mov r8, qword [0x14007eb20]
mov rax, rcx
cqo
idiv r8
mov qword [rsp + 0x30], rax
mov rax, rcx
cqo
idiv r8
imul rax, rdx, 0xf4240
cqo
idiv r8
jmp 0x1400616d1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, edx
mov qword [rsp + 0x30], rax
imul eax, edx, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [rsp + 0x38], eax
lea r8, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x30]
mov edx, 4
mov rcx, rdi
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140044830
mov r8, qword [rbx + 0x2c8]
test byte [r8 + 0x8c], 0x10
je 0x14006170d
mov byte [rsi], 1
xor eax, eax
jmp 0x1400617bc
cmp byte [0x14007eb28], bpl
mov byte [rbx + 0x2ac], bpl
je 0x140061757
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x30]
mov r8, qword [0x14007eb20]
mov rax, rcx
cqo
idiv r8
mov qword [rsp + 0x30], rax
mov rax, rcx
cqo
idiv r8
imul rax, rdx, 0xf4240
cqo
idiv r8
jmp 0x140061782
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0x10624dd3
mul r8d
shr edx, 6
mov eax, edx
mov qword [rsp + 0x30], rax
imul eax, edx, 0x3e8
sub r8d, eax
imul eax, r8d, 0x3e8
mov dword [rsp + 0x38], eax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x158], xmm0
cmp byte [rbx + 0x2af], bpl
jne 0x1400617b7
mov r9, qword [rbx + 0x30]
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rdi
call fcn.14000cc30
mov ebp, eax
mov byte [rsi], 0
mov eax, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140065250
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140065dbc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140065e06
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140065e06
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140065e06
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140065e06
cmp dword [rcx + 0x84], 0xe
jbe 0x140065e06
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140065e08
xor al, al
add rsp, 0x28
ret
Function at 0x1400039b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140158e80]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003a83
cmp byte [rcx + 0x71], 0
je 0x140003a83
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140003a7f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003a44
sub eax, 1
je 0x140003a48
cmp eax, 2
jne 0x140003a7f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400074e0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003a76
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140003a7f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140003a2c
xor al, al
jmp 0x140003a2c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400074e0
add rsp, 0x60
pop rbx
ret
Function at 0x1400051c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140158e80]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x1400051ed
xor eax, eax
jmp 0x140005356
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14000522d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14000522d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14000534e
cmp qword [rdi + 0x80], 0
je 0x140005349
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x140005267
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140005292
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14000534e
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005301
sub eax, 1
je 0x140005301
cmp eax, 2
jne 0x140005349
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14000534e
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14000532f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140005349
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14000534e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400074e0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140005b70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140005ba1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140005bb8
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140005c09
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x140005c81
mov rcx, rbp
call fcn.140003df0
cmp rbx, 0xfff
jbe 0x140005c61
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140005ca2
cmp rbx, rax
ja 0x140005c30
test rdi, rdi
je 0x140005c81
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x140005c84
Function at 0x140005cb0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140005cd1
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140005d4c
test rax, rax
jle 0x140005d2c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140005d4c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005d4c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
invalid