joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403418f0
Capabilities:
Get file system object information

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x318
mov rax, qword [0x14055f260]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov rbp, r8
mov qword [rsp + 0x30], rcx
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x2b8
mov esi, r9d
call sub.VCRUNTIME140.dll_memset
or esi, 0x1010
cmp qword [rdi + 0x18], 8
jb 0x140341941
mov rdi, qword [rdi]
mov r9d, 0x2b8
mov dword [rsp + 0x20], esi
lea r8, [rsp + 0x40]
mov edx, reloc.WS2_32.dll_recv
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
jne 0x14034198c
lea rax, vtable.wxObject.0
mov qword [rbx], rax
mov rcx, qword [0x14055ba40]
mov qword [rbx + 8], rcx
test rcx, rcx
je 0x140341980
inc dword [rcx + 8]
lea rax, vtable.wxBitmap.0
mov qword [rbx], rax
jmp 0x1403419a1
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov r9, rbp
mov rcx, rbx
call fcn.1403419c0
mov rax, rbx
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.14036c0d0
add rsp, 0x318
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140373c60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbp, rdx
mov r14, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov eax, 1
test esi, esi
cmove esi, eax
mov r8d, esi
mov eax, 2
mul r8
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.14036c728
mov rbx, rax
mov qword [rsp + 0x60], rax
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor esi, esi
test eax, eax
jne 0x140373ce7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140373ce7
lea r8, str.boost::filesystem::current_path
mov rdx, rbp
mov ecx, eax
call fcn.140376ac0
jmp 0x140373d03
test rbp, rbp
je 0x140373d03
xorps xmm0, xmm0
mov qword [rsp + 0x30], rsi
movups xmmword [rbp], xmm0
movsd xmm0, qword [rsp + 0x30]
movsd qword [rbp + 0x10], xmm0
mov qword [r14], rsi
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 7
mov word [r14], si
inc rdi
cmp word [rbx + rdi*2], si
jne 0x140373d16
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.14001d300
nop
mov rcx, rbx
call fcn.14036c454
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140374120
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
xor edx, edx
test rsi, rsi
je 0x140374157
xorps xmm0, xmm0
mov qword [rsp + 0x50], rdx
movups xmmword [rsi], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rsi + 0x10], xmm0
mov ebp, dword [0x1405a2a00]
nop
mov rax, qword [rcx + 0x18]
test ebp, ebp
je 0x140374231
cmp rax, 8
jb 0x140374173
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x10198
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x1403741b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x1403741c2
mov edx, ebp
mov rcx, rbx
call fcn.140375240
mov ecx, eax
test eax, eax
je 0x140374224
cmp ecx, 0x35
ja 0x1403741d7
movabs rdx, 0x2000000020800c
bt rdx, rcx
jb 0x14037420a
lea eax, [rcx - 0x43]
cmp eax, 0x38
ja 0x1403741ef
movabs rdx, 0x100000000100001
bt rdx, rax
jb 0x14037420a
cmp ecx, 0xa1
je 0x14037420a
lea r9, str.boost::filesystem::remove
mov r8, rsi
mov rdx, rdi
call fcn.1403769c0
nop
cmp rbx, 0xffffffffffffffff
je 0x14037429b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1403742ac
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1403742ac
cmp rax, 8
jb 0x14037423a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14037429f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd r10, eax
cmp r10d, 0x35
ja 0x140374264
movabs rdx, 0x2000000020800c
bt rdx, r10
jb 0x14037429b
lea eax, [r10 - 0x43]
cmp eax, 0x38
ja 0x14037427d
movabs rdx, 0x100000000100001
bt rdx, rax
jb 0x14037429b
cmp r10d, 0xa1
je 0x14037429b
lea r9, str.boost::filesystem::remove
mov r8, rsi
mov rdx, rdi
mov ecx, r10d
call fcn.1403769c0
xor al, al
jmp 0x1403742ac
mov r8, rsi
mov edx, eax
mov rcx, rdi
call fcn.1403750e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1403750e0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, edx
movzx ebp, dl
shr edi, 4
mov r14, r8
and dil, 1
mov esi, edx
mov rbx, rcx
and bpl, 1
je 0x140375180
and edx, 0xfffffffe
cmp qword [rcx + 0x18], 8
jb 0x140375121
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140375180
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd r10, eax
cmp r10d, 0x35
ja 0x14037514e
movabs rax, 0x2000000020800c
bt rax, r10
jb 0x14037521c
lea eax, [r10 - 0x43]
cmp eax, 0x38
ja 0x14037516b
movabs rcx, 0x100000000100001
bt rcx, rax
jb 0x14037521c
cmp r10d, 0xa1
je 0x14037521c
mov ecx, r10d
jmp 0x14037520a
mov rax, qword [rbx + 0x18]
mov rcx, rbx
test dil, dil
jne 0x14037519d
cmp rax, 8
jb 0x140375195
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1403751ac
cmp rax, 8
jb 0x1403751a6
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140375220
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd rdi, eax
cmp edi, 0x35
ja 0x1403751ce
movabs rax, 0x2000000020800c
bt rax, rdi
jb 0x14037521c
lea eax, [rdi - 0x43]
cmp eax, 0x38
ja 0x1403751e6
movabs rcx, 0x100000000100001
bt rcx, rax
jb 0x14037521c
cmp edi, 0xa1
je 0x14037521c
test bpl, bpl
je 0x140375208
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x140375200
mov rcx, qword [rbx]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, edi
lea r9, str.boost::filesystem::remove
mov r8, r14
mov rdx, rbx
call fcn.1403769c0
xor al, al
jmp 0x140375222
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140375960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x14055f260]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
cmp qword [rdx + 0x18], 8
jb 0x14037598d
mov rdx, qword [rdx]
xor ebp, ebp
mov qword [rsp + 0x48], rbp
movdqa xmm0, xmmword [0x1403c8da0]
movdqu xmmword [rsp + 0x58], xmm0
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], bp
jne 0x1403759b0
lea rcx, [rsp + 0x48]
call fcn.14001d300
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x88
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140375a49
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140375a44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140375a44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14036c454
movdqa xmm0, xmmword [0x1403c8da0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], bp
cmp rbx, 0xffffffffffffffff
jne 0x140375ac4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 5
jne 0x140375ab1
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140375a7c
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140375aa9
bt eax, 0xa
jb 0x140375ab1
mov edx, eax
mov rcx, rdi
call fcn.14036fe90
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
mov dword [rsi], ebx
mov dword [rsi + 4], eax
jmp 0x140375adf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov r9, r14
mov r8, rdi
mov edx, ebp
mov rcx, rsi
call fcn.140373fb0
nop
jmp 0x140375adf
mov r9, r14
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.140375480
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14036c0d0
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140002030
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000207a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000207a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000207a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000207a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000207a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000207c
xor al, al
add rsp, 0x28
ret
Function at 0x14000abe0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xorps xmm0, xmm0
mov rbx, 0xffffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov rbp, rax
mov qword [rdi + 0x18], r15
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x14000ac20
movabs r14, 0x7ffffffffffffffe
cmp rbx, r14
ja 0x14000ad20
mov qword [rsp + 0x50], rsi
cmp rbx, 7
ja 0x14000ac6f
mov qword [rdi + 0x10], rbx
mov rdx, rbp
add rbx, rbx
mov qword [rdi + 0x18], 7
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r15w
jmp 0x14000acfe
mov rax, rbx
or rax, 7
cmp rax, r14
jbe 0x14000ac93
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
call fcn.140006fc0
mov rsi, rax
jmp 0x14000acdd
mov ecx, 0xa
mov r14, rax
cmp rax, rcx
movabs rax, 0x7fffffffffffffff
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, rax
ja 0x14000ad1a
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000accb
call fcn.140006fc0
mov rsi, rax
jmp 0x14000acdd
test rcx, rcx
je 0x14000acda
call fcn.14011ec0c
mov rsi, rax
jmp 0x14000acdd
mov rsi, r15
mov qword [rdi + 0x10], rbx
mov rdx, rbp
add rbx, rbx
mov qword [rdi], rsi
mov r8, rbx
mov qword [rdi + 0x18], r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r15w
mov rsi, qword [rsp + 0x50]
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
call fcn.140009c40
int3
call fcn.140009c60
int3

Function at 0x140012370
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
xor r8d, r8d
movabs rax, 0xcbf29ce484222325
test r9, r9
je 0x1400123a4
movabs r10, 0x100000001b3
movzx edx, byte [rcx + r8]
inc r8
xor rax, rdx
imul rax, r10
cmp r8, r9
jb 0x140012390
ret
Function at 0x140027b60
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r15d, r15d
mov qword [rbp - 0x48], r15
lea rax, vtable.Microsoft::NativeHost::TryingToBringNewWindowToForeground.0
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x50]
call qword [sym.imp.nh.dll_void___cdecl_Microsoft::NativeHost::Log_struct_Microsoft::NativeHost::Logging::ILogEvent_const____ptr64_]
lea rcx, [rbp - 0x40]
call qword [sym.imp.nh.dll_class_std::vector_unsigned_long_int__class_std::allocator_unsigned_long_int_____cdecl_Microsoft::NativeHost::GetOtherAppInstanceProcessIds_void_]
nop
mov rsi, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x38]
cmp rsi, rbx
jne 0x140027bcf
mov qword [rbp - 0x48], r15
lea rax, vtable.Microsoft::NativeHost::FailedToGetExistingProcessId.0
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x50]
call qword [sym.imp.nh.dll_void___cdecl_Microsoft::NativeHost::Log_struct_Microsoft::NativeHost::Logging::ILogEvent_const____ptr64_]
xor bl, bl
jmp 0x140027cd7
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r15
mov rax, rbx
sub rax, rsi
sar rax, 2
test rax, rax
je 0x140027c69
movabs rcx, 0x3fffffffffffffff
cmp rax, rcx
ja 0x140027d35
lea rdi, [rax*4]
cmp rdi, 0x1000
jb 0x140027c23
mov rcx, rdi
call fcn.140006fc0
mov r14, rax
mov rbx, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x40]
jmp 0x140027c40
test rdi, rdi
je 0x140027c3d
mov rcx, rdi
call fcn.14011ec0c
mov r14, rax
mov rbx, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x40]
jmp 0x140027c40
mov r14, r15
mov qword [rbp - 0x28], r14
lea rax, [rdi + r14]
mov qword [rbp - 0x18], rax
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call fcn.140027180
sub rbx, rsi
sar rbx, 2
lea rax, [r14 + rbx*4]
mov qword [rbp - 0x20], rax
mov byte [rbp - 0x10], 0
lea rdx, [rbp - 0x28]
lea rcx, [0x140027d40]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx ebx, byte [rbp - 0x10]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140027cd7
mov rax, qword [rbp - 0x18]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027cc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027cc6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011ec48
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r15
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140027d18
mov rdx, qword [rbp - 0x30]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027d13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027d13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011ec48
movzx eax, bl
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140010500
nop
int3
Function at 0x140034fa0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401d2800]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140035073
cmp byte [rcx + 0x71], 0
je 0x140035073
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14003506f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140035034
sub eax, 1
je 0x140035038
cmp eax, 2
jne 0x14003506f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14011e980
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140035066
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14003506f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14003501c
xor al, al
jmp 0x14003501c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14011e980
add rsp, 0x60
pop rbx
ret
Function at 0x140035580
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1401d2800]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x1400355ad
xor eax, eax
jmp 0x140035716
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x1400355ed
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x1400355ed
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14003570e
cmp qword [rdi + 0x80], 0
je 0x140035709
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x140035627
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140035652
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14003570e
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400356c1
sub eax, 1
je 0x1400356c1
cmp eax, 2
jne 0x140035709
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14003570e
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x1400356ef
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140035709
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14003570e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14011e980
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400360e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140036111
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140036128
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140036179
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x1400361f1
mov rcx, rbp
call int.1400350b0
cmp rbx, 0xfff
jbe 0x1400361d1
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140036212
cmp rbx, rax
ja 0x1400361a0
test rdi, rdi
je 0x1400361f1
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x1400361f4
Function at 0x140036220
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140036241
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x1400362bc
test rax, rax
jle 0x14003629c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x1400362bc
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400362bc
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret

Function at 0x140039e60
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14003d440
test al, al
je 0x140039e82
mov ecx, 1
call fcn.14003d360
test al, al
je 0x140039ead
jmp 0x140039e96
call fcn.14003e760
mov ecx, 1
call fcn.14003c5b0
cmp eax, 1
jne 0x140039ead
mov rax, qword [rbx + 8]
mov ecx, 1
mov byte [rax + 0x50], 1
add rsp, 0x20
pop rbx
jmp 0x14011b350
add rsp, 0x20
pop rbx
ret
sub rsp, 0x78
mov dword [rsp + 0x28], ecx
lea rax, method.Microsoft::NativeHost::CBootHealthCheck.virtual_16
movups xmm0, xmmword [rsp + 0x28]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
lea rax, vtable.Microsoft::NativeHost::UpdateAvailableBySource.0
mov byte [rsp + 0x38], 6
movsd xmm1, qword [rsp + 0x38]
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], rax
movsd qword [rsp + 0x60], xmm1
call qword [sym.imp.nh.dll_void___cdecl_Microsoft::NativeHost::Log_struct_Microsoft::NativeHost::Logging::ILogEvent_const____ptr64_]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x80], eax
lea rcx, [0x14011b3c0]
call qword [sym.imp.USER32.dll_EnumWindows]
add rsp, 0x78
ret