joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400af1a0
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r12, qword [0x140158810]
mov rax, qword [r12]
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 8]
mov r13, rcx
test rax, rax
je 0x1400af1f0
mov rdx, qword [rsp + 0x28]
sub rdx, qword [r12]
jne 0x1400af284
mov rcx, qword [rcx]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp rax
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov ebx, 4
lea rsi, [rsp + 0x24]
mov rbp, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
nop dword [rax + rax]
mov ecx, dword [r13 + 0x10]
mov r8d, ebx
mov rdx, rsi
call rdi
test eax, eax
jle 0x1400af250
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400af210
mov eax, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
sub rdx, qword [r12]
jne 0x1400af284
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp eax, 0xffffffff
jne 0x1400af27b
call rbp
mov r14, rbp
cmp dword [rax], 4
je 0x1400af210
call r14
mov rdx, qword [rsp + 0x28]
sub rdx, qword [r12]
jne 0x1400af284
mov ecx, dword [rax]
lea rdx, str.random_device_could_not_be_read
call method.std._anonymous_namespace_::__throw_syserr_int__char_const_
mov r14, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jmp 0x1400af25f
call dbg.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400d0670
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x1400d06c8
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x1400d06a0
and edx, 7
je 0x1400d06fd
sub edx, 1
movsxd rax, edx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r11 + rax]
shl rdx, 8
sub rax, 1
add rdx, rcx
test eax, eax
jns 0x1400d06d8
xor rdx, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rdx
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret

Function at 0x1400d1290
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, r8
test rdx, rdx
je 0x1400d12bc
movabs r9, 0x100000001b3
add rdx, rcx
nop dword [rax]
movsx r8, byte [rcx]
add rcx, 1
xor rax, r8
imul rax, r9
cmp rcx, rdx
jne 0x1400d12a8
ret
Function at 0x1400d8520
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rsi, qword [0x140158810]
lea rcx, [0x14014f940]
movabs rbp, 0x2e78786362696c67
movabs r13, 0x6c6f6f705f68652e
mov rdx, qword [rsi]
mov qword [rsp + 0x68], rdx
xor edx, edx
call sym.pthread_mutex_init
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x14014f958], 0
movups xmmword [0x14014f948], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x1400d85e5
jmp 0x1400d86a7
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x1400d8648
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rbp
jne 0x1400d85d0
cmp qword [rbx + 7], r13
jne 0x1400d85d0
cmp byte [rbx + 0xf], 0x2e
jne 0x1400d85d0
add rbx, 0x10
lea r12, [rsp + 0x30]
lea r14, [rsp + 0x60]
mov rdi, qword [r12]
test rdi, rdi
je 0x1400d862c
mov rcx, qword [r12 + 8]
mov r8, rdi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x1400d8636
cmp byte [rbx + rdi], 0x3d
je 0x1400d86dd
add r12, 0x18
cmp r14, r12
jne 0x1400d860f
jmp 0x1400d85d0
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x14014f958], rbx
jne 0x1400d86b7
mov rax, qword [rsp + 0x68]
sub rax, qword [rsi]
jne 0x1400d8724
lea rcx, [sym.__tcf_0]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp dbg.atexit
mov qword [0x14014f958], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x14014f950], rax
test rax, rax
je 0x1400d8716
xor edx, edx
mov qword [0x14014f948], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x1400d867f
lea rdx, [rsp + 0x28]
lea rcx, [rbx + rdi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x1400d8704
test dl, dl
jne 0x1400d85d0
test eax, eax
js 0x1400d85d0
mov dword [r12 + 0x10], eax
jmp 0x1400d85d0
xor ecx, ecx
mov qword [0x14014f958], rcx
jmp 0x1400d867f
call dbg.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
Function at 0x140001288
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x5b0
lea rdi, [rsp + 0x60]
mov ecx, 0x154
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x5c0]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x5a0], rax
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x64], 0x3fff
mov dword [rsp + 0x2b4], 0
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x140019960]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001312
mov eax, dword [rsp + 0x60]
jmp 0x14000153d
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x2d4]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2b4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [rsp + 0x308], eax
cmp dword [rsp + 0x308], 0
jne 0x14000152b
cmp dword [rsp + 0x2b4], 0
jbe 0x14000152b
mov dword [rsp + 0x304], 0
jmp 0x1400013b8
mov eax, dword [rsp + 0x304]
inc eax
mov dword [rsp + 0x304], eax
mov eax, dword [rsp + 0x2b4]
cmp dword [rsp + 0x304], eax
jae 0x14000152b
mov dword [rsp + 0x294], 0xff
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x294]
lea r8, [rsp + 0x80]
mov edx, dword [rsp + 0x304]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x308], eax
cmp dword [rsp + 0x308], 0
jne 0x140001526
lea rax, [rsp + 0x318]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001518
mov dword [rsp + 0x334], 0
lea rax, [rsp + 0x360]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x584], 0x104
lea rax, [rsp + 0x584]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x360]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x334]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001518
lea rdx, str.IApplicationAssociationRegistrationInternal
lea rcx, [rsp + 0x360]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140001518
lea r8, [rsp + 0x80]
mov edx, 0x104
mov rcx, qword [rsp + 0x5c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x60], 1
jmp 0x14000152b
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400013a8
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x60]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140019cf0]
call fcn.140015a64
mov rax, rdi
mov rcx, qword [rsp + 0x5a0]
xor rcx, rsp
call fcn.140015b70
add rsp, 0x5b0
pop rdi
ret
Function at 0x140009da8
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x100
lea rdi, [rsp + 0x30]
mov ecx, 0x34
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x110]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x84], MsiDatabaseExportA
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140009eff
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140009eff
cmp qword [rsp + 0x68], 0
je 0x140009eff
xor r9d, r9d
mov r8d, dword [rsp + 0x118]
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140009eff
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x84]
lea r8, [rsp + 0xa8]
mov edx, 2
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140009eff
lea r9, [rsp + 0xd8]
lea r8, [rsp + 0xa8]
mov edx, dword [rsp + 0x118]
mov rcx, qword [rsp + 0x110]
call fcn.140009634
movzx eax, al
test eax, eax
je 0x140009eff
mov rdx, qword [rsp + 0x120]
lea rcx, [rsp + 0xd8]
call fcn.14000a434
movzx eax, al
test eax, eax
je 0x140009eff
mov byte [rsp + 0x30], 1
cmp qword [rsp + 0x68], 0
je 0x140009f12
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp qword [rsp + 0x48], 0
je 0x140009f27
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, byte [rsp + 0x30]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400393f0]
call fcn.140015a64
mov rax, rdi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140015b70
add rsp, 0x100
pop rdi
ret
Function at 0x14000a434
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xf8
lea rdi, [rsp + 0x20]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x110]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0x30]
lea rcx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x82
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0xc4], 0
mov dword [rsp + 0xc8], 0
cmp dword [rsp + 0xc8], 8
jae 0x14000a66a
mov eax, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x110]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xcc], eax
mov eax, dword [rsp + 0xc8]
inc eax
mov dword [rsp + 0xc8], eax
cmp dword [rsp + 0xc8], 8
jae 0x14000a50f
mov eax, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x110]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xe0], eax
mov eax, dword [rsp + 0xc8]
inc eax
mov dword [rsp + 0xc8], eax
jmp 0x14000a51a
mov dword [rsp + 0xe0], 0
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0xd0], eax
cmp dword [rsp + 0xc8], 8
jae 0x14000a55e
mov eax, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x110]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xe4], eax
mov eax, dword [rsp + 0xc8]
inc eax
mov dword [rsp + 0xc8], eax
jmp 0x14000a569
mov dword [rsp + 0xe4], 0
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0xd4], eax
mov eax, dword [rsp + 0xcc]
shr eax, 2
mov eax, eax
mov ecx, dword [rsp + 0xc4]
mov rdx, qword [rsp + 0x118]
movzx eax, word [rsp + rax*2 + 0x30]
mov word [rdx + rcx*2], ax
mov eax, dword [rsp + 0xc4]
inc eax
mov dword [rsp + 0xc4], eax
mov eax, dword [rsp + 0xd0]
shr eax, 4
mov ecx, dword [rsp + 0xcc]
and ecx, 3
shl ecx, 4
or eax, ecx
mov eax, eax
mov ecx, dword [rsp + 0xc4]
mov rdx, qword [rsp + 0x118]
movzx eax, word [rsp + rax*2 + 0x30]
mov word [rdx + rcx*2], ax
mov eax, dword [rsp + 0xc4]
inc eax
mov dword [rsp + 0xc4], eax
mov eax, dword [rsp + 0xd4]
shr eax, 6
mov ecx, dword [rsp + 0xd0]
and ecx, 0xf
shl ecx, 2
or eax, ecx
mov eax, eax
mov ecx, dword [rsp + 0xc4]
mov rdx, qword [rsp + 0x118]
movzx eax, word [rsp + rax*2 + 0x30]
mov word [rdx + rcx*2], ax
mov eax, dword [rsp + 0xc4]
inc eax
mov dword [rsp + 0xc4], eax
mov eax, dword [rsp + 0xd4]
and eax, 0x3f
mov eax, eax
mov ecx, dword [rsp + 0xc4]
mov rdx, qword [rsp + 0x118]
movzx eax, word [rsp + rax*2 + 0x30]
mov word [rdx + rcx*2], ax
mov eax, dword [rsp + 0xc4]
inc eax
mov dword [rsp + 0xc4], eax
jmp 0x14000a4a1
mov eax, dword [rsp + 0xc4]
dec eax
mov dword [rsp + 0xc4], eax
mov eax, dword [rsp + 0xc4]
mov ecx, 0x3d
mov rdx, qword [rsp + 0x118]
mov word [rdx + rax*2], cx
mov eax, dword [rsp + 0xc4]
inc eax
mov dword [rsp + 0xc4], eax
mov eax, dword [rsp + 0xc4]
xor ecx, ecx
mov rdx, qword [rsp + 0x118]
mov word [rdx + rax*2], cx
mov al, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140039260]
call fcn.140015a64
mov rax, rdi
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.140015b70
add rsp, 0xf8
pop rdi
pop rsi
ret
Function at 0x14000b9f4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xac0
lea rdi, [rsp + 0x30]
mov ecx, 0x2a4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xad0]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xab8], rax
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov byte [rsp + 0xa74], 0
mov edx, 0x400
lea rcx, [rsp + 0x270]
call fcn.14000b608
mov dword [rsp + 0xa78], eax
cmp dword [rsp + 0xa78], 0
je 0x14000ba99
lea r8, [0x140037178]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rsp + 0x270]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
jmp 0x14000bab0
lea r8, [0x140037190]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x1400371c0]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rcx, [rsp + 0xa88]
call fcn.140014be4
nop
mov dword [rsp + 0x28], 0x105
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xad0]
lea r8, [0x140037248]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xa88]
call fcn.140015274
mov rcx, qword [rsp + 0xad0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
test rax, rax
jne 0x14000bb40
xor r9d, r9d
mov r8d, 0x1c
mov rdx, qword [rsp + 0xad0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14000bb3e
mov byte [rsp + 0xa74], 1
jmp 0x14000bb48
mov byte [rsp + 0xa74], 1
mov al, byte [rsp + 0xa74]
mov byte [rsp + 0xab0], al
lea rcx, [rsp + 0xa88]
call fcn.140014c18
mov al, byte [rsp + 0xab0]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400390f0]
call fcn.140015a64
mov rax, rdi
mov rcx, qword [rsp + 0xab8]
xor rcx, rsp
call fcn.140015b70
add rsp, 0xac0
pop rdi
ret
Function at 0x14000be30
Capabilities:
Create process on windows
Get common file path

Disassembly:
push rdi
sub rsp, 0x370
lea rdi, [rsp + 0x50]
mov ecx, 0xc8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x360], rax
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov qword [rsp + 0x288], 0
lea r9, [rsp + 0x288]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140054e60]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x14000bf69
mov r8, qword [rsp + 0x288]
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
test eax, eax
jne 0x14000bf5b
lea r8, str.control.exe__name_Microsoft.DefaultPrograms__page_pageDefaultProgram
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
test eax, eax
jne 0x14000bf5b
lea rax, [rsp + 0x2b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rsp + 0x338]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov dword [rsp + 0x2b0], 0x68
lea rax, [rsp + 0x338]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, rsp
lea rdx, [0x140038e90]
call fcn.140015a64
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140015b70
add rsp, 0x370
pop rdi
ret
Function at 0x14000dda0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xd0
lea rdi, [rsp + 0x30]
mov ecx, 0x28
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xe0]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xe0]
cmp qword [rax + 0x68], 0
je 0x14000ddf7
mov rax, qword [rsp + 0xe0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000ddfe
mov al, 1
jmp 0x14000df78
call fcn.14000e964
mov rcx, qword [rsp + 0xe0]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0xa8], rcx
mov edx, eax
mov rcx, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xa8]
call qword [0x1400197c0]
mov dword [rsp + 0xb0], eax
call fcn.14000e964
mov ecx, dword [rsp + 0xb0]
mov edx, ecx
mov ecx, eax
call fcn.14000e970
movzx eax, al
test eax, eax
je 0x14000de5c
xor al, al
jmp 0x14000df78
mov qword [rsp + 0x30], 0x20
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0xe0]
add rcx, 0x74
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x48]
mov rdx, rcx
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0xb4], eax
cmp dword [rsp + 0xb4], 0
je 0x14000dece
cmp dword [rsp + 0xb4], 1
je 0x14000deda
cmp dword [rsp + 0xb4], 3
je 0x14000df66
jmp 0x14000df76
mov rax, qword [rsp + 0xe0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x88]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
jbe 0x14000df35
mov rax, qword [rsp + 0xe0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x98]
mov edx, 1
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x98], rax
je 0x14000df35
xor al, al
jmp 0x14000df78
mov rax, qword [rsp + 0xe0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000df52
mov dword [rsp + 0xb8], 1
jmp 0x14000df5d
mov dword [rsp + 0xb8], 0
mov al, byte [rsp + 0xb8]
jmp 0x14000df78
mov rax, qword [rsp + 0xe0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14000df78
xor al, al
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14003a300]
call fcn.140015a64
mov rax, rdi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140015b70
add rsp, 0xd0
pop rdi
ret
Function at 0x14000fae0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x80]
cmp qword [rsp + 0x90], 0
jg 0x14000fb1f
xor eax, eax
jmp 0x14000fd07
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x14000fb51
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14000fd07
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14000fc02
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140002408
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x58]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140003a14
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x14000fcf7
mov rcx, qword [rsp + 0x80]
call fcn.14000e44c
mov qword [rsp + 0x60], 0xfff
cmp qword [rsp + 0x28], 0xfff
jbe 0x14000fcb8
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x68], 0xfff
je 0x14000fcb3
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
jmp 0x14000fd07
jmp 0x14000fc2e
cmp qword [rsp + 0x28], 0
jbe 0x14000fcf7
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x28]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov rdi, rax
mov rcx, rsp
lea rdx, [0x14003a0c0]
call fcn.140015a64
mov rax, rdi
add rsp, 0x70
pop rdi
ret
Function at 0x14000fd30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x14000fd6a
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14000fe58
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x50], 0
jle 0x14000fe00
cmp qword [rsp + 0x28], 0
jle 0x14000fe00
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x50], rax
jge 0x14000fdaa
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140003a14
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x14000fe48
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x14000fe48
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
add rsp, 0x30
pop rdi
ret