joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cf447
Capabilities:
Write file on windows

Disassembly:
jmp 0x14025b460
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1402e2a20]
call fcn.1400d1d2d
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14025b4b7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14025b5c3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14025b55c
cmp qword [rbp + 0x28], 0
jle 0x14025b55c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14025b4fc
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400d1a4e
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14025b5b2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14025b5b2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400cfbf9
Capabilities:
Get common file path

Disassembly:
jmp 0x1402677e0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x1402c6840]
xor rax, rbp
mov qword [rbp + 0x410], rax
mov dword [rbp + 0x3f4], 0
lea rcx, [0x1402e2f62]
call fcn.1400d1d2d
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rbp + 0x10]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
je 0x14026786d
cmp dword [rbp + 0x234], 0x105
jbe 0x1402678c6
lea rdx, str.____Failed_to_get_temp_path
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400d076b
mov qword [rbp + 0x408], rax
lea rdx, [0x1400d0626]
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x14027adfc]
mov rcx, qword [rbp + 0x440]
call fcn.1400cfec4
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
jmp 0x140267938
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcslen]
movzx eax, word [rbp + rax*2 + 0xe]
cmp eax, 0x5c
jne 0x140267912
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcslen]
lea rax, [rax + rax - 2]
mov qword [rbp + 0x3d8], rax
cmp qword [rbp + 0x3d8], 0x20a
jae 0x1402678ff
jmp 0x140267904
call fcn.1400d1139
xor eax, eax
mov rcx, qword [rbp + 0x3d8]
mov word [rbp + rcx + 0x10], ax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x440]
call fcn.1400cfec4
mov eax, dword [rbp + 0x3f4]
or eax, 1
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp + 0x440]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402b0720]
call fcn.1400d15d0
mov rax, rdi
mov rcx, qword [rbp + 0x410]
xor rcx, rbp
call fcn.1400d0603
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x1400cfd98
Capabilities:
Enumerate gui resources

Disassembly:
jmp 0x1401a9f80
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x178]
mov rax, qword [0x1402c6840]
xor rax, rbp
mov qword [rbp + 0x128], rax
lea rcx, [0x1402e268c]
call fcn.1400d1d2d
mov qword [rbp + 0x118], 0
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.1400cf564
lea rdx, [rbp + 8]
lea rcx, [0x1401a9d90]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rbp + 0x34], eax
cmp dword [rbp + 0x34], 0
jne 0x1401aa01b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x1401aa01b
cmp qword [rbp + 8], 0
je 0x1401aa01b
mov rax, qword [rbp + 8]
jmp 0x1401aa01d
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140280ab0]
call fcn.1400d15d0
mov rax, rdi
mov rcx, qword [rbp + 0x128]
xor rcx, rbp
call fcn.1400d0603
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400cfdb1
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1401c6f30
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x20]
lea rcx, [0x1402e2738]
call fcn.1400d1d2d
mov eax, 4
imul rax, rax, 1
lea rcx, [0x1402c9d00]
cmp dword [rcx + rax], 0
jne 0x1401c6fd8
mov dword [rbp + 4], 0xedb88320
mov dword [rbp + 0x24], 0
jmp 0x1401c6f86
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0x100
jae 0x1401c6fd8
mov eax, dword [rbp + 0x24]
mov dword [rbp + 0x44], eax
mov dword [rbp + 0x64], 0
jmp 0x1401c6fa6
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 8
jae 0x1401c6fc6
mov eax, dword [rbp + 0x44]
shr eax, 1
mov ecx, dword [rbp + 0x44]
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [rbp + 0x44], eax
jmp 0x1401c6f9e
mov eax, dword [rbp + 0x24]
lea rcx, [0x1402c9d00]
mov edx, dword [rbp + 0x44]
mov dword [rcx + rax*4], edx
jmp 0x1401c6f7e
mov eax, dword [rbp + 0x1d0]
not eax
mov dword [rbp + 0x1d0], eax
mov eax, dword [rbp + 0x1d0]
mov dword [rbp + 0x84], eax
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0xa8], rax
cmp dword [rbp + 0x1c8], 0
jle 0x1401c7083
mov eax, dword [rbp + 0x1c8]
mov dword [rbp + 0x194], eax
mov eax, dword [rbp + 0x1c8]
dec eax
mov dword [rbp + 0x1c8], eax
cmp dword [rbp + 0x194], 0
je 0x1401c707e
mov eax, dword [rbp + 0x84]
shr eax, 8
mov ecx, dword [rbp + 0x84]
and ecx, 0xff
mov rdx, qword [rbp + 0xa8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
lea rdx, [0x1402c9d00]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x194], eax
mov rax, qword [rbp + 0xa8]
inc rax
mov qword [rbp + 0xa8], rax
mov eax, dword [rbp + 0x194]
mov dword [rbp + 0x84], eax
jmp 0x1401c7009
jmp 0x1401c713b
mov rax, qword [rbp + 0xa8]
movzx eax, byte [rax]
mov byte [rbp + 0x194], al
mov rax, qword [rbp + 0xa8]
inc rax
mov qword [rbp + 0xa8], rax
movzx eax, byte [rbp + 0x194]
mov byte [rbp + 0xc4], al
movzx eax, byte [rbp + 0xc4]
test eax, eax
je 0x1401c713b
movzx eax, byte [rbp + 0xc4]
cmp eax, 0x23
jne 0x1401c7106
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0xa8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401c7106
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0xa8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1401c7106
mov eax, dword [rbp + 0x1d0]
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0x84]
shr eax, 8
mov ecx, dword [rbp + 0x84]
and ecx, 0xff
movzx edx, byte [rbp + 0xc4]
xor ecx, edx
mov ecx, ecx
lea rdx, [0x1402c9d00]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x84], eax
jmp 0x1401c7083
mov eax, dword [rbp + 0x84]
not eax
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret
Function at 0x1400d01d0
Capabilities:
Write file on windows

Disassembly:
jmp 0x1401da590
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x1402c6840]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x1402e2738]
call fcn.1400d1d2d
mov rax, qword [0x1402c9c80]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
xorps xmm0, xmm0
movss dword [rax + 0x2cd4], xmm0
cmp qword [rbp + 0x160], 0
jne 0x1401da5ff
jmp 0x1401da655
mov qword [rbp + 0x28], 0
lea rcx, [rbp + 0x28]
call fcn.1400d209d
mov qword [rbp + 0x48], rax
lea rdx, [0x140288f70]
mov rcx, qword [rbp + 0x160]
call fcn.1400d02fc
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x1401da634
jmp 0x1401da655
mov r9, qword [rbp + 0x68]
mov r8, qword [rbp + 0x28]
mov edx, 1
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ucrtbased.dll_fclose]
lea rcx, [rbp - 0x20]
lea rdx, [0x140281f30]
call fcn.1400d15d0
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1400d0603
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x1400d0950
Capabilities:
Terminate process

Disassembly:
jmp 0x14026b350
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400d09be
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x140267660
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rcx, [0x1402e2f62]
call fcn.1400d1d2d
mov rcx, qword [rbp + 0x180]
call fcn.1400d046e
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x188]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rbp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x64], 0
jmp 0x1402676db
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x28]
movzx eax, word [rax + 6]
cmp dword [rbp + 0x64], eax
jae 0x140267783
mov eax, dword [rbp + 0x64]
imul rax, rax, 0x28
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x180]
mov rcx, rax
call fcn.1400d00ae
test eax, eax
jne 0x14026777e
mov rax, qword [rbp + 0x88]
mov rcx, rax
call fcn.1400d046e
cmp qword [rbp + 8], rax
jne 0x14026777e
mov rax, qword [rbp + 0x88]
cmp dword [rax + 0xc], 0
jne 0x140267748
xor eax, eax
jmp 0x140267785
cmp qword [rbp + 0x190], 0
je 0x140267765
mov rax, qword [rbp + 0x190]
mov rcx, qword [rbp + 0x88]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x188]
add rcx, rax
mov rax, rcx
jmp 0x140267785
jmp 0x1402676d3
xor eax, eax
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x1400d0a4f
Capabilities:
Terminate process

Disassembly:
jmp 0x1401aa080
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x40]
lea rcx, [0x1402e268c]
call fcn.1400d1d2d
lea rdx, [0x1402c9af0]
mov ecx, 0x20
call fcn.1400d02c0
test eax, eax
jge 0x1401aa0bf
mov ecx, 3
call qword [sym.imp.ucrtbased.dll_exit]
mov r8d, 0x40
xor edx, edx
lea rcx, [0x1402c9b10]
call fcn.1400d1279
mov dword [0x1402c9b38], 1
mov dword [0x1402c9b28], 1
mov rax, qword [rbp + 0x100]
mov qword [0x1402c9b30], rax
mov dword [0x1402c9b24], 0
mov dword [0x1402c9b18], 0x15
mov eax, dword [0x1402c9c6c]
mov dword [0x1402c9b10], eax
mov eax, dword [0x1402c9c70]
mov dword [0x1402c9b14], eax
mov dword [0x1402c9b3c], 1
mov dword [0x1402c9b40], 0x50
mov dword [0x1402c9b4c], 0x80000000
mov rax, qword [0x1402c9af0]
mov rax, qword [rax]
mov rax, qword [rax + 0xa0]
mov qword [rbp + 0xd8], rax
lea rax, [0x1402c9b00]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
lea rax, [0x1402c9b10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40
mov r9, qword [rbp + 0x100]
mov r8d, 1
xor edx, edx
mov rcx, qword [0x1402c9af0]
call qword [rbp + 0xd8]
test eax, eax
jge 0x1401aa1bf
mov rax, qword [0x1402c9af0]
mov rax, qword [rax]
mov rcx, qword [0x1402c9af0]
call qword [rax + 0x10]
mov ecx, 4
call qword [sym.imp.ucrtbased.dll_exit]
xor ecx, ecx
call fcn.1400d1bfc
call fcn.1400d12dd
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rax + 0x18], 0
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x98]
mov qword [rbp + 0xd8], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
movss xmm2, dword [0x140280cac]
lea rdx, str.C:WindowsFonts_arialbd.ttf
mov rcx, qword [rbp + 0xd8]
call fcn.1400d1ee5
xor ecx, ecx
call fcn.1400cfab4
call fcn.1400d1b93
mov rcx, qword [rbp + 0x100]
call fcn.1400cfc4e
mov rcx, qword [0x1402c9b00]
call fcn.1400cf51e
xor eax, eax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1400d0dba
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140216340
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402c6840]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1402e28af]
call fcn.1400d1d2d
call fcn.1400d12dd
mov qword [rbp + 8], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [0x1402cf6e8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x2c]
mov ecx, dword [rbp + 0x34]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov eax, dword [rbp + 0x28]
mov ecx, dword [rbp + 0x30]
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm1, eax
movaps xmm2, xmm0
lea rcx, [rbp + 0x154]
call fcn.1400d0d15
mov rax, qword [rax]
mov rcx, qword [rbp + 8]
mov qword [rcx + 8], rax
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [0x1402cf6f0]
mov rcx, qword [rbp + 0x58]
sub rcx, rax
mov rax, rcx
cvtsi2ss xmm0, rax
cvtsi2ss xmm1, qword [0x1402cf6f8]
divss xmm0, xmm1
mov rax, qword [rbp + 8]
movss dword [rax + 0x10], xmm0
mov rax, qword [rbp + 0x58]
mov qword [0x1402cf6f0], rax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14021642f
mov dword [rbp + 0x164], 1
jmp 0x140216439
mov dword [rbp + 0x164], 0
mov rax, qword [rbp + 8]
movzx ecx, byte [rbp + 0x164]
mov byte [rax + 0x118], cl
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14021646b
mov dword [rbp + 0x164], 1
jmp 0x140216475
mov dword [rbp + 0x164], 0
mov rax, qword [rbp + 8]
movzx ecx, byte [rbp + 0x164]
mov byte [rax + 0x119], cl
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1402164a7
mov dword [rbp + 0x164], 1
jmp 0x1402164b1
mov dword [rbp + 0x164], 0
mov rax, qword [rbp + 8]
movzx ecx, byte [rbp + 0x164]
mov byte [rax + 0x11a], cl
mov rax, qword [rbp + 8]
mov byte [rax + 0x11b], 0
call fcn.140216790
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0xc8]
test eax, eax
je 0x1402164ed
mov dword [rbp + 0x164], 0xffffffff
jmp 0x1402164f8
call fcn.1400d099b
mov dword [rbp + 0x164], eax
mov eax, dword [rbp + 0x164]
mov dword [rbp + 0x74], eax
mov eax, dword [rbp + 0x74]
cmp dword [0x1402c677c], eax
je 0x14021651a
mov eax, dword [rbp + 0x74]
mov dword [0x1402c677c], eax
call fcn.140216610
lea rcx, [rbp - 0x20]
lea rdx, [0x140295f90]
call fcn.1400d15d0
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1400d0603
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400d0f63
Capabilities:
Read file on windows

Disassembly:
jmp 0x1401c6710
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1402e2738]
call fcn.1400d1d2d
cmp qword [rbp + 0x160], 0
je 0x1401c6752
cmp qword [rbp + 0x168], 0
jne 0x1401c6773
mov eax, dword [0x1402c651c]
inc eax
mov r8d, eax
lea rdx, str.D:NiggerSavedValoratio_main_src_thirdpartyimguiimgui.cpp
lea rcx, str.filename__file_open_mode
call qword [sym.imp.ucrtbased.dll__wassert]
xor eax, eax
cmp qword [rbp + 0x170], 0
je 0x1401c678b
mov rax, qword [rbp + 0x170]
mov qword [rax], 0
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x160]
call fcn.1400d02fc
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1401c67b0
xor eax, eax
jmp 0x1401c68bc
mov r8d, 2
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fseek]
test eax, eax
jne 0x1401c67ec
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_ftell]
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0xffffffff
je 0x1401c67ec
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fseek]
test eax, eax
je 0x1401c67fd
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x1401c68bc
movsxd rax, dword [rbp + 0x24]
mov qword [rbp + 0x48], rax
movsxd rax, dword [rbp + 0x178]
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1400cfd5c
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x1401c683a
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
jmp 0x1401c68bc
mov r9, qword [rbp + 8]
mov r8, qword [rbp + 0x48]
mov edx, 1
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ucrtbased.dll_fread]
cmp rax, qword [rbp + 0x48]
je 0x1401c686e
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
mov rcx, qword [rbp + 0x68]
call fcn.1400d172e
xor eax, eax
jmp 0x1401c68bc
cmp dword [rbp + 0x178], 0
jle 0x1401c6896
movsxd rax, dword [rbp + 0x178]
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x68]
add rdx, rcx
mov rcx, rdx
mov r8, rax
xor edx, edx
call fcn.1400d1279
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
cmp qword [rbp + 0x170], 0
je 0x1401c68b8
mov rax, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x48]
mov qword [rax], rcx
mov rax, qword [rbp + 0x68]
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1400d0fd1
Capabilities:
Parse pe header

Disassembly:
jmp 0x14026d490
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14026d4b0
xor al, al
jmp 0x14026d531
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14026d4c3
xor al, al
jmp 0x14026d531
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14026d4ed
xor al, al
jmp 0x14026d531
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14026d501
xor al, al
jmp 0x14026d531
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14026d513
xor al, al
jmp 0x14026d531
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14026d52f
xor al, al
jmp 0x14026d531
mov al, 1
add rsp, 0x38
ret
Function at 0x1400d1576
Capabilities:
Create thread
Hide graphical window

Disassembly:
jmp 0x1401aa420
push rbp
push rdi
sub rsp, 0x1f8
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402c6840]
xor rax, rbp
mov qword [rbp + 0x188], rax
lea rcx, [0x1402e268c]
call fcn.1400d1d2d
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400cf361]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [rbp + 0x10], 0x50
mov dword [rbp + 0x14], 0
mov rax, qword [sym.imp.USER32.dll_DefWindowProcA]
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x20], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x28], 0
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x30], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
lea rax, [0x140280ca0]
mov qword [rbp + 0x50], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rbp + 0x58], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rbp + 0x78]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rbp + 0x84]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x80]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x7c]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x78]
mov dword [rsp + 0x20], eax
mov r9d, 0x80000000
lea r8, [0x140280ca0]
lea rdx, [0x140280ca0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1402c9b60], rax
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x1402c9b60]
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x1402c9b60]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov dword [rbp + 0xa8], 0xffffffff
lea rax, [rbp + 0xac]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
lea rdx, [rbp + 0xa8]
mov rcx, qword [0x1402c9b60]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 5
mov rcx, qword [0x1402c9b60]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1402c9b60]
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rcx, [rbp - 0x60]
lea rdx, [0x140280bc0]
call fcn.1400d15d0
mov rcx, qword [rbp + 0x188]
xor rcx, rbp
call fcn.1400d0603
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret
Function at 0x1400d1828
Capabilities:
Parse pe header

Disassembly:
jmp 0x140263370
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1402e2cbe]
call fcn.1400d1d2d
mov rax, qword [rbp + 0x120]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1402633ac
xor eax, eax
jmp 0x1402633d9
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x4550
je 0x1402633d5
xor eax, eax
jmp 0x1402633d9
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret