joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000ab78
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, rdx
mov r14, rcx
xor ebx, ebx
lea rcx, [rbp - 0x20]
xor edx, edx
lea r8d, [rbx + 0x20]
call fcn.180016580
mov rax, qword [r14 + 8]
xor esi, esi
mov rcx, qword [r14 + 0x28]
mov r13, qword [rax + 0x60]
call fcn.18000ec44
lea edi, [rbx + 1]
test rdi, rdi
je 0x18000ac08
mov rcx, qword [r13 + 8]
lea rdx, [rbp - 0x20]
and qword [rsp + 0x20], rsi
lea r9, [rbp + 0x30]
mov r8d, 0x20
mov eax, ebx
sub r8d, ebx
add rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000abf8
add ebx, dword [rbp + 0x30]
cmp ebx, 0x20
jne 0x18000abbe
xor edi, edi
jmp 0x18000abbe
mov ecx, 0x490
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000ad23
cmp ebx, 0x20
jne 0x18000ad23
cmp byte [rbp - 0x1d], sil
jne 0x18000ac5b
mov edi, dword [rbp - 0x20]
add edi, 0xffffffe4
movsxd rcx, edi
call fcn.180017740
lea r9, [rbp + 0x30]
mov r8d, edi
mov rdx, rax
mov rcx, r13
mov rbx, rax
call fcn.18000a3a8
mov rcx, rbx
call fcn.180017738
cmp edi, dword [rbp + 0x30]
jne 0x18000ad23
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
and qword [r15], rsi
jmp 0x18000ad23
mov r8d, 0x1c
lea rdx, [rbp - 0x1c]
lea rcx, [rbp - 0x20]
call fcn.1800065f0
mov rcx, qword [r14 + 0x20]
add rcx, 0x20
call fcn.18000661c
test eax, eax
je 0x18000ac96
mov rcx, qword [r14 + 0x20]
lea rdx, [rbp - 0x1c]
add rcx, 0x20
mov r8d, reloc.WS2_32.dll_recv
call fcn.180015ec0
mov ecx, dword [rbp - 8]
call qword [sym.imp.WS2_32.dll_ntohl]
lea ebx, [rax - 8]
lea edi, [rbx + 0x20]
mov ecx, edi
call fcn.180017740
mov rsi, rax
test rax, rax
jne 0x18000acbc
lea ecx, [rax + 8]
jmp 0x18000abfd
mov r8d, 0x1c
lea rdx, [rbp - 0x1c]
lea rcx, [rbp - 0x20]
call fcn.1800065f0
mov r8d, 0x20
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.180015ec0
lea rdx, [rsi + 0x20]
mov r8d, ebx
lea r9, [rbp + 0x30]
mov rcx, r13
call fcn.18000a3a8
cmp dword [rbp + 0x30], ebx
je 0x18000ad00
mov ecx, eax
jmp 0x18000abfd
mov r9d, edi
mov r8, rsi
mov rdx, r15
mov rcx, r14
call fcn.180006ea4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
call fcn.180017738
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rsi, rsi
je 0x18000ad38
mov rcx, rsi
call fcn.180017738
mov rcx, qword [r14 + 0x28]
call fcn.18000ec64
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x18000b460
Capabilities:
Create tcp socket
Initialize winsock library
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r13
push r14
lea rbp, [rax - 0x108]
sub rsp, 0x1f0
and qword [rdx], 0
mov r14, rdx
movzx esi, cx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x198
call fcn.180016580
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18000b4bd
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x18000b595
xor edi, edi
lea edx, [rdi + 1]
lea ecx, [rdi + 0x17]
lea r8d, [rdi + 6]
call qword [sym.imp.WS2_32.dll_socket]
lea r13d, [rdi + 2]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000b50f
and dword [rbp + 0x118], edi
lea r9, [rbp + 0x118]
lea edx, [rdi + 0x29]
mov dword [rsp + 0x20], 4
lea r8d, [rdi + 0x1b]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x18000b529
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov edx, 1
mov ecx, r13d
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
mov edi, 1
and qword [rsp + 0x44], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x34], xmm0
test edi, edi
je 0x18000b553
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
mov dword [rsp + 0x34], eax
mov word [rsp + 0x30], r13w
jmp 0x18000b56a
movups xmm0, xmmword [0x180029238]
mov eax, reloc.WS2_32.dll_socket
mov word [rsp + 0x30], ax
movdqu xmmword [rsp + 0x38], xmm0
movzx ecx, si
call qword [sym.imp.WS2_32.dll_htons]
neg edi
lea rdx, [rsp + 0x30]
mov r9, r14
mov word [rsp + 0x32], ax
sbb r8d, r8d
mov rcx, rbx
and r8d, 0xfffffff4
add r8d, 0x1c
call fcn.18000b5b4
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
Function at 0x18000b8b8
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x1e0
mov rbx, qword [rsp + 0x220]
mov ebp, r8d
movzx r14d, dx
mov r15, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x198
mov esi, r9d
and qword [rbx], 0
call fcn.180016580
mov ecx, 0x202
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18000b91f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x18000b99e
mov edx, 1
lea r12d, [rdx + 1]
mov ecx, r12d
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, r15
mov rdi, rax
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx]
mov ecx, dword [rdx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
movzx ecx, r14w
mov word [rsp + 0x30], r12w
mov dword [rsp + 0x34], eax
call qword [sym.imp.WS2_32.dll_htons]
mov r9d, ebp
mov dword [rsp + 0x20], esi
lea r8d, [r12 + 0xe]
mov word [rsp + 0x32], ax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.18000bb24
test eax, eax
jne 0x18000b99e
mov qword [rbx], rdi
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18000b9c0
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov r15, qword [rsp + 0x248]
mov r13d, r8d
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x198
mov qword [r15], rbx
mov r12d, r9d
call fcn.180016580
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18000ba29
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x18000bafe
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x30]
call fcn.180016580
mov ebp, reloc.WS2_32.dll_socket
mov dword [rsp + 0x2c], 6
lea r9, [rsp + 0x248]
mov dword [rsp + 0x24], ebp
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rsi
lea r14d, [rbp - 0x16]
mov dword [rsp + 0x28], r14d
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x18000ba1e
lea r8d, [rbp - 0x11]
mov edx, r14d
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000ba1e
mov ebp, ebx
call fcn.1800065a4
mov r14d, eax
call fcn.1800065a4
mov rdi, qword [rsp + 0x248]
jmp 0x18000bac5
mov rax, qword [rdi + 0x20]
mov rcx, rsi
mov dword [rax + 0x18], r13d
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x18000bb1f
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x18000baa1
mov ecx, dword [rsp + 0x240]
call fcn.180006548
call fcn.1800065a4
sub eax, r14d
cmp eax, r12d
jb 0x18000ba92
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, ebp
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, ebx
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov qword [r15], rsi
jmp 0x18000baee

Function at 0x18000bb24
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov esi, r9d
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
call fcn.1800065a4
mov ebp, eax
call fcn.1800065a4
mov r8d, r14d
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18000bb87
mov ecx, dword [rsp + 0x60]
call fcn.180006548
call fcn.1800065a4
sub eax, ebp
cmp eax, esi
jb 0x18000bb4f
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x18000bba4
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [rcx + 8]
mov rsi, rcx
mov rcx, qword [rcx + 0x28]
mov edi, edx
mov rbx, qword [rax + 0x60]
call fcn.18000ec44
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rax, qword [rbx]
xor r9d, r9d
and dword [rsp + 0x250], 0
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x250]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x254], edi
mov ecx, dword [rbx]
inc ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rsi + 0x28]
mov ebx, eax
call fcn.18000ec64
lea r11, [rsp + 0x240]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18000cbec
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx + 0x30]
mov r14d, 0xfe
movzx r12d, word [rcx]
sub r14, rax
mov esi, dword [rcx + 4]
xor ebx, ebx
add r14, r14
mov rdi, rcx
cmp word [rcx + 8], 0x30
lea r13, [rcx + rax*2]
mov eax, 0x248
lea r15d, [rax + 2]
cmovne r15d, eax
mov rax, qword [rdi + 0x10]
lea r8, str._d._s._s
mov qword [rsp + 0x28], rax
lea rcx, [r13 + 0x38]
mov rax, qword [rdi + 0x18]
mov rdx, r14
movzx r9d, r12w
mov qword [rsp + 0x20], rax
call fcn.18000d6a4
mov r9, qword [rdi + 0x28]
lea rax, [rdi + 0x20]
movzx edx, word [rdi + 8]
lea rcx, [rdi + 0x38]
mov qword [rsp + 0x28], rbx
mov r8d, r15d
mov qword [rsp + 0x20], rax
call sub.DNSAPI.dll_DnsQuery_W
inc r12w
mov ebp, eax
test eax, eax
je 0x18000cc9a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, rsi
dec rsi
test rax, rax
je 0x18000cca9
test ebp, ebp
jne 0x18000cc3a
test rsi, rsi
jne 0x18000ccb3
lea ebx, [rsi + 2]
jmp 0x18000ccbd
test ebp, ebp
mov eax, 3
cmovne ebx, eax
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18000ee78
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, r9
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x18000eed8
mov ecx, 0x38
call fcn.180017740
mov rbx, rax
test rax, rax
je 0x18000eed8
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x38]
call fcn.180016580
call fcn.18000ec84
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x18000eef5
mov rcx, rbx
call fcn.180017738
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov qword [rsp + 0x28], rbx
lea r8, [0x18000f060]
mov r9, rbx
mov dword [rsp + 0x20], 4
xor edx, edx
mov qword [rbx + 0x20], r14
xor ecx, ecx
mov qword [rbx + 0x28], rbp
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x18], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x18000ef3a
mov rcx, qword [rbx + 0x10]
call fcn.18000ece0
jmp 0x18000eed0
mov rax, rbx
jmp 0x18000eeda

Function at 0x18000ef80
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x28
test rcx, rcx
jne 0x18000ef8d
xor eax, eax
jmp 0x18000ef9c
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
add rsp, 0x28
ret

Function at 0x18000efc0
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x18000efe1
mov rcx, qword [rcx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x18000efe1
mov eax, 1
jmp 0x18000efe3
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800101b4
Capabilities:
Compute adler32 checksum

Disassembly:
movzx r9d, cx
mov r10, rdx
shr ecx, 0x10
test rdx, rdx
jne 0x1800102ed
lea eax, [rdx + 1]
ret
mov edx, 0x15b0
cmp r8d, edx
cmovb edx, r8d
sub r8d, edx
cmp edx, 0x10
jl 0x1800102b1
mov r11d, edx
shr r11, 4
mov eax, r11d
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [r10]
add r9d, eax
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 8]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 9]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xa]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xb]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xc]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xd]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xe]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xf]
add ecx, r9d
add r10, 0x10
add r9d, eax
add ecx, r9d
sub r11, 1
jne 0x1800101f4
test edx, edx
je 0x1800102c7
movzx eax, byte [r10]
inc r10
add r9d, eax
add ecx, r9d
sub edx, 1
jne 0x1800102b5
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
test r8d, r8d
jne 0x1800101cb
shl ecx, 0x10
or ecx, r9d
mov eax, ecx
ret
Function at 0x180013a4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov esi, dword [rcx + 0x38]
mov rbx, rcx
mov r9d, dword [rcx + 0x94]
mov edi, dword [rbx + 0x50]
mov edx, dword [rbx + 0x8c]
sub edi, edx
sub edi, r9d
jne 0x180013a8e
test edx, edx
jne 0x180013a9d
test r9d, r9d
jne 0x180013a9d
mov edi, esi
jmp 0x180013b24
cmp edi, 0xffffffff
jne 0x180013a9d
mov edi, 0xfffffffe
jmp 0x180013b24
mov ecx, dword [rbx + 0x38]
add ecx, 0xfffffefa
add ecx, esi
cmp edx, ecx
jb 0x180013b24
mov rcx, qword [rbx + 0x48]
mov r8, rsi
lea rdx, [rsi + rcx]
call fcn.180015ec0
mov r9d, dword [rbx + 0x6c]
mov rax, qword [rbx + 0x60]
sub dword [rbx + 0x90], esi
sub dword [rbx + 0x8c], esi
sub dword [rbx + 0x7c], esi
lea r8, [rax + r9*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, si
cmp edx, esi
cmovae ax, cx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x180013ad7
mov rax, qword [rbx + 0x58]
mov r9d, esi
lea r8, [rax + rsi*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, si
cmp edx, esi
cmovae ax, cx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x180013b02
add edi, esi
mov rcx, qword [rbx]
cmp dword [rcx + 8], 0
je 0x180013b9b
mov edx, dword [rbx + 0x94]
mov r8d, edi
mov eax, dword [rbx + 0x8c]
add rdx, rax
add rdx, qword [rbx + 0x48]
call fcn.180014648
add dword [rbx + 0x94], eax
mov r9d, dword [rbx + 0x94]
cmp r9d, 3
jb 0x180013b85
mov eax, dword [rbx + 0x8c]
mov rdx, qword [rbx + 0x48]
mov ecx, dword [rbx + 0x78]
movzx r8d, byte [rax + rdx]
mov dword [rbx + 0x68], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rbx + 0x74]
mov dword [rbx + 0x68], r8d
cmp r9d, 0x106
jae 0x180013b9b
mov rax, qword [rbx]
cmp dword [rax + 8], 0
jne 0x180013a6e
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140001f30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001f7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001f7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001f7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001f7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001f7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001f7c
xor al, al
add rsp, 0x28
ret
Function at 0x140002330
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x55555556
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
sub r8d, ecx
je 0x140002396
sub r8d, 1
je 0x14000238a
cmp r8d, 1
jne 0x14000239b
call fcn.140002000
xor eax, eax
add rsp, 0x28
ret
call fcn.140001d00
xor eax, eax
add rsp, 0x28
ret
call fcn.140001540
xor eax, eax
add rsp, 0x28
ret

Function at 0x140002740
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140002761
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000278e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002790
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400027e9
test ecx, ecx
jle 0x1400027c9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400027e9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400027e9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140002810
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002832
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140002841
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002864
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002866
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400028a2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000293e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400028dd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000291e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000293e
cmp rbx, rax
ja 0x1400028f0
test rbx, rbx
je 0x14000293e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x140002d60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002d8d
xor eax, eax
jmp 0x140002ef9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002dc7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002dc7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002ef9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002eec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002e0a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002e35
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002ef1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002ea4
sub eax, 1
je 0x140002ea4
cmp eax, 2
jne 0x140002eec
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002ef1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002ed2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002eec
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002ef1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003e40
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret