joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140084810
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x140084858
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14008482a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140097310
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x140097338
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x140097380
cdqe
add rsi, rax
sub rbx, rax
jne 0x140097350
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14009738c
call rbp
cmp dword [rax], 4
je 0x140097350
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400a7750
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov rcx, rdx
test rdx, rdx
js 0x1400a7768
add rsp, 0x28
jmp sym.operator_new_unsigned_long_long_
call method.std.__throw_bad_alloc__
nop
nop
nop

Function at 0x1400aa0c0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
movabs rcx, 0x3fffffffffffffff
mov rax, qword [rdx]
cmp rcx, rax
jb 0x1400aa11b
lea r9, [rax + 1]
cmp r8, rax
jae 0x1400aa0f9
add r8, r8
cmp rax, r8
jae 0x1400aa0f9
cmp rcx, r8
jae 0x1400aa108
movabs r9, 0x4000000000000000
mov qword [rdx], rcx
mov rcx, r9
add rsp, 0x28
jmp sym.operator_new_unsigned_long_long_
lea r9, [r8 + 1]
mov qword [rdx], r8
mov rcx, r9
add rsp, 0x28
jmp sym.operator_new_unsigned_long_long_
lea rcx, [0x1400c5570]
call method.std.__throw_length_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400ab860
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov rax, rdx
shr rax, 0x3e
jne 0x1400ab880
lea rcx, [rdx + rdx]
add rsp, 0x28
jmp sym.operator_new_unsigned_long_long_
test rdx, rdx
js 0x1400ab890
call method.std.__throw_bad_alloc__
nop word [rax + rax]
call method.std.__throw_bad_array_new_length__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400ade00
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
movabs rax, 0x1fffffffffffffff
mov rcx, qword [rdx]
cmp rax, rcx
jb 0x1400ade61
cmp r8, rcx
jb 0x1400ade30
add rcx, 1
add rcx, rcx
add rsp, 0x28
jmp sym.operator_new_unsigned_long_long_
add r8, r8
cmp rcx, r8
jae 0x1400ade1b
cmp rax, r8
jae 0x1400ade58
movabs rcx, 0x4000000000000000
mov qword [rdx], rax
add rsp, 0x28
jmp sym.operator_new_unsigned_long_long_
mov qword [rdx], r8
lea rcx, [r8 + 1]
jmp 0x1400ade1f
lea rcx, str.basic_string::_M_create
call method.std.__throw_length_error_char_const_
nop
nop
nop

Function at 0x1400bcec0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, 1
test rcx, rcx
cmovne rax, rcx
mov rbx, rax
mov rcx, rbx
call sym.malloc
test rax, rax
je 0x1400bcee7
add rsp, 0x20
pop rbx
ret
call method.std.get_new_handler__
test rax, rax
je sym.operator_new_unsigned_long_long___clone_cold_
call rax
jmp 0x1400bced4

Function at 0x1400bd9c0
Capabilities:
Write file on windows

Disassembly:
call sym.abort
mov rcx, rax
call sym.__cxa_begin_catch
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400bd9e0
Capabilities:
Write file on windows

Disassembly:
mov ecx, 8
call sym.__cxa_allocate_exception
lea r8, [method.std::bad_alloc.bad_alloc__]
lea rdx, [0x1400cd190]
mov rcx, rax
mov rax, qword [str.P4_r_]
add rax, 0x10
mov qword [rcx], rax
call sym.__cxa_throw
nop
nop

Function at 0x1400bda10
Capabilities:
Write file on windows

Disassembly:
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400bda8c
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
call sym.abort
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x1400bda7a
Function at 0x1400bf160
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edx, edx
lea rcx, [0x1400c0840]
movabs rdi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
call sym.pthread_mutex_init
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x1400c0858], 0
movups xmmword [0x1400c0848], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x1400bf215
jmp 0x1400bf2bf
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x1400bf270
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x1400bf200
cmp qword [rbx + 7], r12
jne 0x1400bf200
cmp byte [rbx + 0xf], 0x2e
jne 0x1400bf200
add rbx, 0x10
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x1400bf25b
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x1400bf265
cmp byte [rbx + rsi], 0x3d
je 0x1400bf2f5
add rbp, 0x18
cmp rbp, r13
jne 0x1400bf23f
jmp 0x1400bf200
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x1400c0858], rbx
jne 0x1400bf2cf
lea rcx, [sym.__tcf_0_3]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.atexit
mov qword [0x1400c0858], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x1400c0850], rax
test rax, rax
je 0x1400bf32c
xor edx, edx
mov qword [0x1400c0848], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x1400bf2a7
lea rdx, [rsp + 0x28]
lea rcx, [rbx + rsi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x1400bf31c
test dl, dl
jne 0x1400bf200
test eax, eax
js 0x1400bf200
mov dword [rbp + 0x10], eax
jmp 0x1400bf200
xor ecx, ecx
mov qword [0x1400c0858], rcx
jmp 0x1400bf2a7
Function at 0x1400192a0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x340
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x70]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140019306
lea rdx, [0x140135300]
mov rcx, qword [rsp + 0x350]
call fcn.140017c40
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x350]
jmp 0x1400194a3
mov edx, 0x100
lea rcx, [rsp + 0x230]
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x140019350
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, [0x140135308]
mov rcx, qword [rsp + 0x350]
call fcn.140017c40
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x350]
jmp 0x1400194a3
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x44], 2
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], 2
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
xor edx, edx
lea rcx, [rsp + 0x230]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1400193d2
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, [0x140135310]
mov rcx, qword [rsp + 0x350]
call fcn.140017c40
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x350]
jmp 0x1400194a3
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
jmp 0x1400193ec
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14001946b
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
add rax, 4
mov r9d, 0x16
lea r8, [rsp + 0x210]
mov rdx, rax
mov ecx, 2
call sub.WS2_32.dll_inet_ntop
test rax, rax
je 0x140019466
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, [rsp + 0x210]
mov rcx, qword [rsp + 0x350]
call fcn.140017c40
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x350]
jmp 0x1400194a3
jmp 0x1400193de
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, [0x140135318]
mov rcx, qword [rsp + 0x350]
call fcn.140017c40
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x350]
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x340
pop rdi
ret
Function at 0x1400194c0
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2b8
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x60], 0x101
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400195a9
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x68]
call fcn.140017f70
nop
lea rcx, [rsp + 0x24]
call fcn.140016530
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.14001b0f0
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.14001ae90
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x2c0]
call fcn.140014b10
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x68]
call fcn.140018780
nop
mov rax, qword [rsp + 0x2c0]
jmp 0x1400195d0
lea rdx, [0x1401352f8]
mov rcx, qword [rsp + 0x2c0]
call fcn.140017c40
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x2b8
ret

Function at 0x14001faf0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1400257f0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140021560
nop
lea rax, [0x14001f4d0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400167a0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14001fb94
lea rcx, [rsp + 0x40]
call fcn.140026c30
nop
jmp 0x14001fbab
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140023410
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x58
ret
Function at 0x14001fbd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1400257f0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140021560
nop
lea rax, [0x14001f560]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400167a0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14001fc74
lea rcx, [rsp + 0x40]
call fcn.140026c30
nop
jmp 0x14001fc8b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140023410
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x58
ret

Function at 0x14001fcb0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1400257f0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140021560
nop
lea rax, [0x14001f5f0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400167a0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14001fd54
lea rcx, [rsp + 0x40]
call fcn.140026c30
nop
jmp 0x14001fd6b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140023410
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x58
ret
Function at 0x14001fd90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1400257f0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140021560
nop
lea rax, [0x14001f680]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400167a0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14001fe34
lea rcx, [rsp + 0x40]
call fcn.140026c30
nop
jmp 0x14001fe4b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140023410
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x58
ret

Function at 0x14001fe70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1400257f0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140021560
nop
lea rax, [0x14001f710]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.1400167a0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14001ff14
lea rcx, [rsp + 0x40]
call fcn.140026c30
nop
jmp 0x14001ff2b
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.140023410
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x58
ret

Function at 0x1400213c0
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x18
xor eax, eax
test eax, eax
je 0x1400213df
movsx eax, byte [rsp + 0x28]
or eax, 0x20
mov dword [rsp], eax
jmp 0x1400213e7
movsx eax, byte [rsp + 0x28]
mov dword [rsp], eax
mov eax, dword [rsp]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
imul eax, eax, 0x1000193
add rsp, 0x18
ret
Function at 0x140041210
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, qword [rsp + 0x58]
call fcn.14001b700
inc rax
mov rdx, rax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14004125d
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
jmp 0x1400412cf
mov rcx, qword [rsp + 0x58]
call fcn.14001b700
inc rax
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x58]
call fcn.14001aef0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, qword [rsp + 0x20]
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop
add rsp, 0x48
ret

Function at 0x1400412e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
call fcn.140017c40
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x140049f50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x140049f8d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140049f94
mov al, 1
jmp 0x14004a0ec
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.14001b160
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.14001b160
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.14001b1b0
movzx eax, al
test eax, eax
je 0x140049fe9
xor al, al
jmp 0x14004a0ec
mov qword [rsp + 0x60], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14004a059
cmp dword [rsp + 0x30], 1
je 0x14004a065
cmp dword [rsp + 0x30], 3
je 0x14004a0da
jmp 0x14004a0ea
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14004a0b1
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14004a0b1
xor al, al
jmp 0x14004a0ec
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14004a0cb
mov dword [rsp + 0x34], 1
jmp 0x14004a0d3
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14004a0ec
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14004a0ec
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0xa8
ret
Function at 0x14005a240
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140413c00]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x14005a274
xor eax, eax
jmp 0x14005a471
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x14005a2a6
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14005a471
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x14005a358
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.1400175c0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.14001af40
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
nop
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x14005a461
mov rcx, qword [rsp + 0x80]
call fcn.14004b4a0
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x14005a40e
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x14005a409
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x14005a471
jmp 0x14005a384
cmp qword [rsp + 0x50], 0
jbe 0x14005a461
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14011cd30
add rsp, 0x78
ret