joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002434
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rbx, rcx
test r8, r8
je 0x18000249a
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x18000248b
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180002481
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180002455
mov r8, qword [rbx]
mov rcx, qword [0x18001f400]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800024ac
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x38]
imul rbx, rax, 0x38
mov r8d, 0x40
add rbx, qword [0x18001f430]
mov rdx, qword [rbx]
mov al, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rbp, [rdx - 5]
cmove rbp, rdx
lea rdi, [rdx - 5]
test al, al
lea rsi, [rcx*2 + 5]
cmove rdi, rdx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180002517
mov eax, 0xa
jmp 0x180002564
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180002533
mov rax, qword [rbx]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rbx + 0x20], 6
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180002814
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x18000282b
cmp r8b, 0x90
je 0x18000282b
cmp r8b, 0xcc
jne 0x18000284d
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x180002849
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x18000284d
add edx, r10d
cmp edx, r9d
jb 0x180002839
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x180002bb4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x180002bfe
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x18001f428]
lea r15, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r15
cmovbe r15, qword [rbp - 0x50]
sub r15, 0xfff
test rbx, rbx
je 0x180002c3b
cmp rbx, rsi
jb 0x180002c36
cmp rbx, r15
jae 0x180002c36
cmp qword [rbx + 8], 0
jne 0x180002d97
mov rbx, qword [rbx]
jmp 0x180002c1c
mov r14, rdi
cmp rdi, rsi
jb 0x180002cbf
mov r12d, dword [rbp - 0x38]
xor edx, edx
mov rax, r14
div r12
sub r14, rdx
sub r14, r12
cmp r14, rsi
jb 0x180002cb6
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180002cb6
cmp dword [rbp - 0x10], 0x10000
je 0x180002c86
mov r14, qword [rbp - 0x28]
cmp r14, r12
jb 0x180002cb6
jmp 0x180002c52
test r14, r14
je 0x180002cb6
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180002d57
cmp r14, rsi
jae 0x180002c43
test rbx, rbx
jne 0x180002d57
cmp rdi, r15
ja 0x180002d97
mov r14d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov esi, r14d
div r14
mov eax, r14d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x180002d97
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180002d97
cmp dword [rbp - 0x10], 0x10000
je 0x180002d2d
xor edx, edx
lea edi, [r14 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div rsi
sub rdi, rdx
cmp rdi, r15
jmp 0x180002ce6
test rdi, rdi
je 0x180002d97
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jmp 0x180002cb9
and qword [rbx + 8], 0
lea rcx, [rbx + 0x40]
and dword [rbx + 0x10], 0
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x180002d6a
mov rax, qword [0x18001f428]
mov qword [rbx], rax
mov qword [0x18001f428], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002915c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c754
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c754
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400292ac
cmp rax, 0xffffffffffffffff
je 0x1400292ac
xor edi, edi
test rbp, rbp
jle 0x140029257
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f068
mov rbx, rax
test rax, rax
jne 0x1400291e4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002924d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a088
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d430
cmp eax, 0xffffffff
je 0x14002922d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400291f4
mov edx, r15d
mov ecx, r14d
call fcn.14001a088
jmp 0x14002924d
cmp byte [rsi + 0x38], dil
je 0x140029244
cmp dword [rsi + 0x34], 5
jne 0x140029244
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002924d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001ae1c
jmp 0x1400292c0
jns 0x1400292c0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c754
cmp rax, 0xffffffffffffffff
jne 0x140029278
cmp byte [rsi + 0x30], dil
je 0x1400292c0
mov edi, dword [rsi + 0x2c]
jmp 0x1400292c0
mov ecx, r14d
call fcn.140018540
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400292c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400292c0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400292b9
mov eax, dword [rsi + 0x2c]
jmp 0x1400292be
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c754
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1407788d4
Capabilities:
Encode data using xor

Disassembly:
test rsi, rsi
push 0xffffffffc221c106
lea rsp, [rsp + 0x18]
je 0x14077892d
mov ebx, 0xe0bdac05
lea rbx, [0x1407959a0]
mov edi, 0xcb115cb0
movzx edi, byte [r11]
push 0xffffffffe0a3138d
sal byte [rsp + 5], 0x27
xor edi, edx
and edi, 0xff
mov edi, dword [rbx + rdi*4]
shr edx, 8
xor edx, edi
inc r11
xor edx, 0xb8254820
dec rsi
lea rsp, [rsp + 8]
jne 0x1407788f3
call fcn.14077858c
jmp 0x140781c2f

Function at 0x14079aa20
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 8]
je 0x14079aa7a
mov r11d, 0x82c4ba9
lea r11, [0x140793540]
push 0x709ab5be
movzx edx, byte [rcx]
xor edx, esi
and edx, 0xff
mov edx, dword [r11 + rdx*4]
xor byte [rsp + 1], 0xb8
shr esi, 8
add qword [rsp], 0x70252233
xor esi, edx
inc rcx
xor esi, 0xcd122918
dec rax
push 0xffffffffb2039308
lea rsp, [rsp + 0x10]
jne 0x14079aa38
push 0xffffffff8515d40b
not esi
mov dword [rbp + riz], esi
lea rsp, [rsp + 8]
jmp 0x1407a47c4
Function at 0x140023c40
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14004e028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, r9
movzx r15d, r8b
mov r14d, edx
mov rbp, rcx
mov qword [rsp + 0x68], r9
mov edx, 0x208
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
lea r8, str..pipe_
mov ebx, 0x104
mov edx, ebx
mov rcx, rax
call fcn.140001c20
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140023ca9
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rsi
call fcn.140001b60
mov rcx, rbx
mov rax, rsi
nop word [rax + rax]
cmp word [rax], 0
je 0x140023cd0
add rax, 2
sub rcx, 1
jne 0x140023cc0
mov rax, rbx
sub rax, rcx
xor r12d, r12d
test rcx, rcx
cmove rax, r12
je 0x140023d2e
sub rbx, rax
lea rcx, [rsi + rax*2]
je 0x140023d1f
mov eax, 0x7ffffffe
lea r8, str.pipe_srvsvc
sub r8, rcx
nop word [rax + rax]
test rax, rax
je 0x140023d1f
movzx edx, word [r8 + rcx]
test dx, dx
je 0x140023d1f
mov word [rcx], dx
add rcx, 2
dec rax
sub rbx, 1
jne 0x140023d00
lea rax, [rcx - 2]
test rbx, rbx
cmovne rax, rcx
mov word [rax], r12w
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
lea r9, [rsp + 0x50]
lea r8, [0x140023150]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x50], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ncalrpc
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcStringBindingComposeW]
test eax, eax
jne 0x140023db0
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
lea rcx, [rsp + 0x50]
test eax, eax
je 0x140023e20
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140023def
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140023dea
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140023e9d
mov rcx, r8
call fcn.1400318f8
xor eax, eax
mov word [rdi], r12w
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r12
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400311c0
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
nop
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140026cb0
mov r9, rax
movzx r8d, r15b
mov edx, r14d
mov rcx, qword [rsp + 0x60]
call fcn.140023270
mov ebx, r12d
test eax, eax
sete bl
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140023e96
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140023e91
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140023e9d
mov rcx, r8
call fcn.1400318f8
mov eax, ebx
jmp 0x140023df1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140023eb0
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14004e028]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, r9
movzx r15d, r8b
mov ebp, edx
mov r14, rcx
mov qword [rsp + 0x60], r9
mov edx, 0x208
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
lea r8, str..pipe_
mov ebx, 0x104
mov edx, ebx
mov rcx, rax
call fcn.140001c20
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140023f15
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rsi
call fcn.140001b60
mov rcx, rbx
mov rax, rsi
cmp word [rax], 0
je 0x140023f36
add rax, 2
sub rcx, 1
jne 0x140023f26
mov rax, rbx
sub rax, rcx
xor r12d, r12d
test rcx, rcx
cmove rax, r12
je 0x140023f8e
sub rbx, rax
lea rcx, [rsi + rax*2]
je 0x140023f7f
mov eax, 0x7ffffffe
lea r8, str.pipe_spoolss
sub r8, rcx
test rax, rax
je 0x140023f7f
movzx edx, word [r8 + rcx]
test dx, dx
je 0x140023f7f
mov word [rcx], dx
add rcx, 2
dec rax
sub rbx, 1
jne 0x140023f60
lea rax, [rcx - 2]
test rbx, rbx
cmovne rax, rcx
mov word [rax], r12w
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
lea r9, [rsp + 0x50]
lea r8, [0x140023150]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140026cb0
mov r8, rax
movzx edx, r15b
mov ecx, ebp
call fcn.140023910
mov ebx, r12d
test eax, eax
sete bl
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140024021
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14002401c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002404f
mov rcx, r8
call fcn.1400318f8
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 7
mov word [rdi], r12w
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400311c0
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140024bb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140024c11
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140024bd0
mov ecx, dword [r9]
jmp 0x140024cf8
cmp ecx, 0x4e0
jb 0x140024cf8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140024c30
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140024c80
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400259e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140025a08
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140025a2e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140025a30
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140025a89
test ecx, ecx
jle 0x140025a69
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140025a89
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140025a89
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140025ab0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140025ad2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140025ae8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140025b04
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140025b06
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140025b42
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140025bde
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140025b7d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140025bbe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140025bde
cmp rbx, rax
ja 0x140025b90
test rbx, rbx
je 0x140025bde
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140026000
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14004e028]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14002602d
xor eax, eax
jmp 0x140026199
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140026067
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140026067
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140026199
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14002618c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400260aa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400260d5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140026191
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140026144
sub eax, 1
je 0x140026144
cmp eax, 2
jne 0x14002618c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140026191
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140026172
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14002618c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140026191
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400311c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140027590
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14004e028]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140027663
cmp byte [rcx + 0x71], 0
je 0x140027663
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14002765f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140027624
sub eax, 1
je 0x140027628
cmp eax, 2
jne 0x14002765f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400311c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140027656
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14002765f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14002760c
xor al, al
jmp 0x14002760c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400311c0
add rsp, 0x60
pop rbx
ret
Function at 0x14002ed70
Capabilities:
Get hostname

Disassembly:
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx]
jmp 0x140030db0
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x14004e028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rcx
mov dword [rsp + 0x78], 0x10
lea rdx, [r11 - 0x40]
lea rcx, [r11 - 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edx, 0x208
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
lea r9, [rsp + 0x90]
lea r8, str._hs
mov edx, 0x104
mov rcx, rax
call fcn.140001c20
xor r14d, r14d
mov qword [rsp + 0x70], r14
lea rdi, [rsp + 0x80]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rsp + 0x38], r14d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
xor r8d, r8d
lea edx, [r14 + 1]
lea rcx, [0x14003cf40]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov rdi, rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140030ee5
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x100
mov r9, qword [rsp + 0x70]
xor r8d, r8d
lea edx, [rax + 0x3e]
lea rcx, [0x14003cf40]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x60], rax
mov edi, eax
mov dword [rsp + 0x50], eax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea edx, [r14 + 0x1d]
lea rcx, [0x14003cf40]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x68], rax
jmp 0x140030eed
mov eax, edi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400311c0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret