joyce8/EMBER2024-capa huggingface dataset:
Function at 0x33d501a00
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x33d5070a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x33d507080]
test rbx, rbx
je 0x33d501a54
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x33d501a4b
test r12, r12
je 0x33d501a4b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x33d501a30
lea rcx, [0x33d5070a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x33d501d90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x33d504360]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x33d501db0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x33d501db8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x33d501db0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x33d501e05
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x33d501dfc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x33d501db0
add rax, 0x28
cmp rax, r9
jne 0x33d501de8
xor eax, eax
ret

Function at 0x33d501e10
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x33d504360]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x33d501e30
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x33d501e38
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x33d501e30
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x33d501ec0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x33d504360]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x33d501ee0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x33d501ee8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x140001019
Capabilities:
Terminate process

Disassembly:
jmp 0x1400ef5fc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ecx, 1
call fcn.14000119a
test al, al
je 0x1400ef4c3
xor sil, sil
mov byte [rsp + 0x20], sil
call fcn.140001118
mov bl, al
mov ecx, dword [0x1400f6160]
cmp ecx, 1
je 0x1400ef4ce
test ecx, ecx
jne 0x1400ef3f9
mov dword [0x1400f6160], 1
lea rdx, [0x1400f4660]
lea rcx, [0x1400f4330]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
test eax, eax
je 0x1400ef3da
mov eax, 0xff
jmp 0x1400ef4b3
lea rdx, [0x1400f4220]
lea rcx, [section..rdata]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [0x1400f6160], 2
jmp 0x1400ef401
mov sil, 1
mov byte [rsp + 0x20], sil
mov cl, bl
call fcn.1400011d6
call fcn.1400010eb
mov rbx, rax
cmp qword [rax], 0
je 0x1400ef434
mov rcx, rax
call fcn.140001145
test al, al
je 0x1400ef434
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [rbx]
call qword [0x1400f9010]
call fcn.140001113
mov rbx, rax
cmp qword [rax], 0
je 0x1400ef456
mov rcx, rax
call fcn.140001145
test al, al
je 0x1400ef456
mov rcx, qword [rbx]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov rdi, qword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov rbx, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
mov r8, rax
mov rdx, rdi
mov ecx, dword [rbx]
call fcn.1400010b9
mov ebx, eax
call fcn.140001181
test al, al
je 0x1400ef4d8
test sil, sil
jne 0x1400ef48d
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
xor edx, edx
mov cl, 1
call fcn.140001186
mov eax, ebx
jmp 0x1400ef4b3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 7
call fcn.140001140
nop
mov ecx, 7
call fcn.140001140
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
mov ecx, ebx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
nop
int3
sub rsp, 0x28
call fcn.1400011b3
add rsp, 0x28
jmp 0x1400ef36c

Function at 0x140001041
Capabilities:
Terminate process

Disassembly:
jmp 0x1400f0314
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140001145
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x1400efb98
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400efc26
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x1400efc26
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400efc26
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1400efc0d
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400efc07
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1400efc0f
add rdx, 0x28
jmp 0x1400efbec
xor edx, edx
test rdx, rdx
jne 0x1400efc18
xor al, al
jmp 0x1400efc2c
cmp dword [rdx + 0x24], 0
jge 0x1400efc22
xor al, al
jmp 0x1400efc2c
mov al, 1
jmp 0x1400efc2c
xor al, al
jmp 0x1400efc2c
add rsp, 0x18
ret

Function at 0x140001172
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
jmp 0x1400ef130
xor r8d, r8d
mov r9d, edx
mov r10, rcx
test edx, edx
jle 0x1400ef184
lea r11, str.CN3PGqhRp_c
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x2aaaaaab
lea r10, [r10 + 1]
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
inc r8d
lea ecx, [rdx + rdx*2]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
movzx eax, byte [rcx + r11]
xor byte [r10 - 1], al
cmp r8d, r9d
jl 0x1400ef150
mov eax, r9d
ret

Function at 0x140001181
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400f0188
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f01d3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f01d3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f01d3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f01d3
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f01d3
cmp dword [rcx + 0xf8], 0
je 0x1400f01d3
mov al, 1
jmp 0x1400f01d5
xor al, al
add rsp, 0x28
ret
Function at 0x1000138a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
sub rsp, 0x38
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r12d, ecx
mov qword [rax - 0x18], r14
movzx r13d, dx
lea rcx, [0x1000a92a0]
xor r14d, r14d
xor edx, edx
mov rbx, r14
call fcn.100047064
lea ebp, [r14 + 1]
test rax, rax
mov rsi, rax
je 0x1000139b5
nop
test rbx, rbx
jne 0x1000139b5
mov eax, r12d
lea edx, [rbx + 6]
movzx r9d, r13w
shr eax, 4
mov rcx, rsi
inc ax
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
mov rdi, rax
jne 0x100013923
mov rbx, r14
jmp 0x100013999
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x100013939
mov rbx, r14
jmp 0x100013994
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
jne 0x10001394f
mov rbx, r14
jmp 0x100013994
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rbx
and ecx, 0xf
jbe 0x100013982
nop
nop
cmp rbx, r11
jae 0x100013987
add ecx, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x100013970
cmp rbx, r11
jb 0x10001398c
mov rbx, r14
jmp 0x100013994
cmp word [rbx], r14w
cmove rbx, r14
test rbx, rbx
jne 0x1000139df
lea rcx, [0x1000a92a0]
mov edx, ebp
call fcn.100047064
inc ebp
test rax, rax
mov rsi, rax
jne 0x1000138f0
xor eax, eax
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
mov rax, rsi
jmp 0x1000139b7
Function at 0x1000139f0
Capabilities:
Compare security identifiers

Disassembly:
mov r11, rsp
sub rsp, 0x98
mov rax, qword [0x1000a81b8]
mov qword [rsp + 0x80], rax
mov qword [r11 + 0x18], rbx
xor ebx, ebx
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x30], rbx
mov rdi, rbx
mov dword [rsp + 0x60], ebx
mov qword [r11 - 0x28], rbx
mov byte [rsp + 0x78], bl
mov byte [rsp + 0x79], bl
mov byte [rsp + 0x7a], bl
mov byte [rsp + 0x7b], bl
mov byte [rsp + 0x7c], bl
mov byte [rsp + 0x7d], 5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov rcx, rax
mov edx, 0x20008
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100013b10
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea edx, [rbx + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100013b10
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
mov rdi, rax
je 0x100013b10
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea edx, [rbx + 1]
mov r8, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x100013b10
lea rax, [rsp + 0x70]
lea r8d, [rbx + 0x12]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dl, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x100013b10
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne bl
inc ebx
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x100013b20
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test rdi, rdi
je 0x100013b2e
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0xb8]
test rcx, rcx
je 0x100013b46
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x80]
call fcn.100087ed0
add rsp, 0x98
ret
Function at 0x1000149f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov eax, r8d
mov qword [rsp + 0x40], rsi
mov rbp, rdx
shr eax, 4
inc ax
mov qword [rsp + 0x48], rdi
mov edi, r8d
mov rsi, rcx
mov rcx, rbp
movzx edx, ax
mov r8d, 6
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x100014a91
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x100014a91
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rbx, rax
je 0x100014a91
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x100014a84
cmp rbx, r11
jae 0x100014a91
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x100014a72
cmp rbx, r11
jae 0x100014a91
movzx eax, word [rbx]
test ax, ax
jne 0x100014ab1
xor eax, eax
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
movzx edi, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or ecx, eax
jge 0x100014ad2
mov edx, edi
mov rcx, rsi
call fcn.1000140c0
mov rcx, qword [rsi]
lea rbp, [rdi + rdi]
lea rdx, [rbx + 2]
mov r8, rbp
call sub.msvcrt.dll_memcpy
test edi, edi
js 0x100014b04
mov rcx, qword [rsi]
cmp edi, dword [rcx - 0xc]
jg 0x100014b04
mov dword [rcx - 0x10], edi
mov rcx, qword [rsi]
mov eax, 1
mov word [rcx + rbp], 0
jmp 0x100014a93
mov ecx, 0x80070057
call fcn.100013860
int3
Function at 0x100015e20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov ebx, edx
mov qword [rsp + 0x48], rdi
mov rdi, rcx
xor edx, edx
mov ecx, ebx
call fcn.1000138a0
test rax, rax
jne 0x100015e50
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
jmp fcn.1000149f0
Function at 0x100045470
Capabilities:
Get file size
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x30], ebx
mov edx, 0xffffffff
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x38], eax
test eax, eax
je 0x1000454b2
cmp eax, 0x80
jne 0x100045508
mov dword [rsp + 0x30], 1
mov eax, dword [section.Shared]
test eax, eax
jle 0x1000454cb
mov ebx, 1
jmp 0x100045508
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x58]
mov r8d, 2
lea rdx, [0x100007c34]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x34], eax
xor edx, edx
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x3c], eax
xchg dword [section.Shared], eax
mov ebx, dword [rsp + 0x34]
cmp dword [rsp + 0x30], 0
je 0x100045519
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x48
ret
Function at 0x100045b90
Capabilities:
Get file size

Disassembly:
mov rax, rsp
sub rsp, 0x78
cmp qword [rcx], 0xffffffffffffffff
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbp, rdx
mov rbx, rcx
je 0x100045bb9
mov eax, 1
jmp 0x100045d81
mov esi, 1
lea r9, [0x100007bc0]
xor ecx, ecx
mov r8d, esi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
mov qword [rbx + 0x10], rax
je 0x100045d81
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x98], rdi
call fcn.1000458f0
test eax, eax
je 0x100045c0c
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
xor eax, eax
mov qword [rbx + 0x10], rdi
jmp 0x100045d79
lea r8, [0x100007bf0]
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
mov qword [rbx + 0x18], rax
jne 0x100045c94
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
xor edi, edi
test rcx, rcx
mov qword [rbx + 0x10], rdi
je 0x100045c4e
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rsp + 0x58], rdi
cmp qword [rsp + 0x60], rdi
je 0x100045c70
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x60], rdi
cmp qword [rsp + 0x68], rdi
je 0x100045c8d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x100045d79
mov rcx, qword [rsp + 0x58]
xor edi, edi
test rcx, rcx
je 0x100045cab
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rsp + 0x58], rdi
cmp qword [rsp + 0x60], rdi
je 0x100045ccd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x60], rdi
cmp qword [rsp + 0x68], rdi
je 0x100045cef
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x68], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0xc0000000
lea r8d, [r9 + 3]
mov rcx, rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov qword [rbx], rax
jne 0x100045d4f
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
mov qword [rbx + 0x10], rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x18], rdi
xor eax, eax
jmp 0x100045d79
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r11d, eax
xor eax, eax
lock cmpxchg dword [section.Shared], r11d
test r11d, r11d
jne 0x100045d77
mov rcx, rbx
call fcn.100045470
mov esi, eax
mov eax, esi
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x100045db0
Capabilities:
Get file size
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov rax, rsp
sub rsp, 0x78
mov qword [rax + 0x20], rbx
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov r14, rdx
mov rbx, rcx
xor r15d, r15d
mov dword [rax - 0x44], r15d
mov r12d, r15d
mov dword [rax - 0x48], r15d
cmp qword [rcx], 0xffffffffffffffff
jne 0x100045df9
xor eax, eax
jmp 0x100045f45
lea esi, [r8 + r8]
test esi, esi
js 0x100045f43
mov eax, 0x55555556
imul dword [rcx + 8]
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp esi, edx
jg 0x100045f43
mov r13d, 0xffffffff
nop
nop
nop
nop
mov eax, 1
lock xadd dword [0x1000b6004], eax
inc eax
cmp eax, 1
jne 0x100045e4e
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov edi, esi
lock xadd dword [section.Shared], edi
lea eax, [rdi + rsi]
cmp eax, dword [rbx + 0xc]
jl 0x100045ef1
mov eax, r13d
lock xadd dword [0x1000b6004], eax
dec eax
jne 0x100045e7e
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
mov dword [rsp + 0x30], r15d
mov edx, 0xffffffff
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x38], eax
test eax, eax
je 0x100045ea1
cmp eax, 0x80
jne 0x100045ede
mov dword [rsp + 0x30], 1
mov eax, dword [section.Shared]
cmp eax, dword [rbx + 0xc]
jl 0x100045ede
mov edx, 0xffffffff
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, edi
mov rcx, rbx
call fcn.100045680
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xchg dword [section.Shared], eax
cmp dword [rsp + 0x30], 0
je 0x100045ef7
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x100045ef7
mov r12d, 1
test r12d, r12d
je 0x100045e30
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x34]
mov r8d, esi
mov rdx, r14
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
lock dec dword [0x1000b6004]
jne 0x100045f3f
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, edi
jmp 0x100045f45
xor eax, eax
mov rbx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
add rsp, 0x78
ret
Function at 0x100045fa0
Capabilities:
Manipulate console buffer

Disassembly:
sub rsp, 0x58
call fcn.100049bb0
cmp eax, 2
jne 0x100045fb5
xor eax, eax
add rsp, 0x58
ret
lea rcx, [0x100007c48]
mov qword [rsp + 0x78], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
mov rdi, rax
je 0x100046016
lea rdx, [0x100007c38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x10004600d
mov ecx, 0xffffffff
call rax
test eax, eax
je 0x10004600d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, 0xffffffffffffffff
mov qword [0x1000a8d10], rax
jne 0x100046022
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rdi, qword [rsp + 0x78]
add rsp, 0x58
ret
lea rdx, [0x1000a8d0c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x100046007
mov edx, dword [0x1000a8d0c]
mov rcx, qword [0x1000a8d10]
or edx, 3
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
test eax, eax
je 0x100046007
mov rcx, qword [0x1000a8d10]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x100046007
mov qword [rsp + 0x70], rbx
movsx rbx, word [rsp + 0x3c]
mov word [0x1000a8d0a], 1
mov rcx, rbx
mov word [0x1000a8d08], bx
shl rcx, 2
call qword [sym.imp.msvcrt.dll_malloc]
test rax, rax
mov qword [0x1000a8d18], rax
je 0x1000460ec
movzx ecx, word [rsp + 0x3e]
mov r8d, dword [0x1000a8d08]
mov word [rsp + 0x60], 0
mov word [rsp + 0x32], cx
inc cx
mov word [rsp + 0x62], 0
mov r9d, dword [rsp + 0x60]
mov word [rsp + 0x36], cx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x1000a8d10]
mov rdx, rax
mov word [rsp + 0x30], 0
mov word [rsp + 0x34], bx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
movzx eax, word [rsp + 0x3e]
movsx r8d, word [rsp + 0x3c]
mov rcx, qword [0x1000a8d10]
mov word [rsp + 0x62], ax
lea rax, [rsp + 0x68]
mov word [rsp + 0x60], 0
mov ebx, dword [rsp + 0x60]
mov dx, 0x20
mov qword [rsp + 0x20], rax
mov r9d, ebx
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
test eax, eax
jne 0x100046149
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
xor eax, eax
add rsp, 0x58
ret
mov rcx, qword [0x1000a8d10]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov eax, 1
add rsp, 0x58
ret
Function at 0x100046660
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], r12
xor ebp, ebp
xor r12d, r12d
xor esi, esi
test rax, rax
mov rbx, rcx
je 0x10004676d
test byte [rax + 0x18], 0x10
mov qword [rsp + 0x58], rdi
mov rdi, qword [rcx + 8]
jne 0x100046757
nop
nop
nop
nop
mov r9, qword [rbx]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8, rdx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
jne 0x1000467a1
movzx eax, byte [rsp + 0x20]
cmp al, 0x2c
je 0x100046757
cmp al, 0xa
je 0x100046757
mov rdx, qword [rbx + 0x10]
inc rbp
cmp rbp, rdx
jbe 0x10004672e
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x100046707
mov ecx, 0x106
mov qword [rbx + 0x10], 0x104
call qword [sym.imp.msvcrt.dll_malloc]
jmp 0x10004671c
add rdx, 0x104
mov qword [rbx + 0x10], rdx
add rdx, 2
call qword [sym.imp.msvcrt.dll_realloc]
test rax, rax
je 0x100046786
mov qword [rbx + 8], rax
lea rdi, [rax + rbp - 1]
mov al, byte [rsp + 0x20]
mov byte [rdi], al
cmp byte [rsp + 0x20], 0x20
je 0x100046747
test r12, r12
je 0x100046741
mov rsi, rdi
jmp 0x100046747
mov r12, rdi
mov rsi, rdi
mov rax, qword [rbx]
inc rdi
test byte [rax + 0x18], 0x10
je 0x1000466b0
cmp qword [rbx], 0
je 0x10004679d
mov byte [rsi + 1], 0
mov rax, r12
mov byte [rsi + 2], 0
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x10004679d
call qword [sym.imp.msvcrt.dll_free]
mov qword [rbx + 8], 0
xor eax, eax
jmp 0x100046768
mov rcx, qword [rbx]
call qword [sym.imp.msvcrt.dll_fclose]
mov qword [rbx], 0
xor eax, eax
jmp 0x100046768