joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ad3e0
Capabilities:
Query environment variable
Query or enumerate registry value
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rcx, str.GLUT_DIALS_SERIAL
call sub.msvcrt.dll_getenv
test rax, rax
mov rcx, rax
je 0x1400ad560
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x74], 0
mov edx, 0xc0000000
mov qword [rsp + 0x7c], 0
mov qword [rsp + 0x84], 0
mov dword [rsp + 0x70], 0x1c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
test rax, rax
mov rbx, rax
je 0x1400ad5d8
mov ecx, 0x38
call sub.msvcrt.dll_malloc
mov ecx, 6
lea rbp, [rax + 8]
mov rsi, rax
xor eax, eax
lea rdx, [rsi + 0x1c]
mov rdi, rbp
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x70]
mov rcx, rbx
mov qword [rsi], rbx
call qword [sym.imp.KERNEL32.dll_GetCommState]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
lea rbp, [rsp + 0x50]
mov rdx, rdi
mov dword [rsp + 0x70], 0x1c
lea rcx, str.96_n_8_1
call qword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCommState]
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x60], 1
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rsi]
mov r9, rdi
mov rdx, rbp
mov r8d, 1
mov qword [0x14087fce0], rsi
mov byte [rsp + 0x50], 0x20
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r8d, r8d
mov ecx, 0xa
lea rdx, [0x1400ad600]
call fcn.1400ab2a0
mov rax, qword [0x1401c19c0]
mov byte [rax + 0xb0], 1
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsp + 0x4c], 0x100
lea r8, [rsp + 0x70]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], 1
lea rdx, str.SOFTWAREFreeGLUT
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1400ad54a
lea rax, [rsp + 0x4c]
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
lea rbx, [0x14087fbe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
lea rdx, str.DialboxSerialPort
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x70]
test eax, eax
jne 0x1400ad5f0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
jmp 0x1400ad403
mov qword [0x14087fce0], 0
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400ad54a

Function at 0x1400ad8b0
Capabilities:
Query environment variable
Query or enumerate registry value
Write file on windows

Disassembly:
mov rax, qword [0x1401c19c0]
cmp byte [rax + 0xb0], 0
je 0x1400ad8c8
ret
jmp fcn.1400ad3e0
Function at 0x1400ad940
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
cmp byte [rcx + 0x1d0], 0
mov r13, rcx
mov rbx, rdx
je 0x1400ad980
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.CurrentJoystickSettings
mov edx, 0x100
mov rdi, qword [sym.imp.msvcrt.dll__snprintf]
lea rsi, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r12, [rsp + 0x48]
lea rax, [rcx + 0x70]
mov rcx, rsi
lea r9, str.SystemCurrentControlSetControlMediaResourcesJoystick
mov qword [rsp + 0x20], rax
lea r8, str._s_s_s
call rdi
xor r8d, r8d
mov rbp, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rdx, rsi
mov qword [rsp + 0x20], r12
mov r9d, 1
mov rcx, 0xffffffff80000002
call rbp
test eax, eax
jne 0x1400ad962
mov eax, dword [r13 + 0x1c8]
lea rdx, str.OEMName
mov rcx, rsi
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x20], rdx
lea r15, [rsp + 0x44]
mov edx, 0x100
lea r8, str.Joystick_d_s
lea r9d, [rax + 1]
call rdi
lea r10, [rsp + 0x150]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], r10
mov rdx, rsi
mov qword [rsp + 0x38], r10
mov r14, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov qword [rsp + 0x28], r15
call r14
mov rcx, qword [rsp + 0x48]
mov r13, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x34], eax
call r13
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x1400ad962
mov r10, qword [rsp + 0x38]
lea r9, str.SystemCurrentControlSetControlMediaPropertiesPrivatePropertiesJoystickOEM
mov edx, 0x100
mov rcx, rsi
lea r8, str._s_s
mov qword [rsp + 0x20], r10
call rdi
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov r9d, 1
mov rdx, rsi
mov rcx, 0xffffffff80000002
call rbp
test eax, eax
jne 0x1400ad962
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rbx
lea rdx, str.OEMName
mov dword [rsp + 0x44], pe_nt_image_headers64
mov qword [rsp + 0x28], r15
call r14
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call r13
xor eax, eax
test ebx, ebx
sete al
jmp 0x1400ad964

Function at 0x1400ae9a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xa0
mov ebx, 1
call rsi
test ax, ax
js 0x1400ae9cb
mov ecx, 0xa1
call rsi
movsx ebx, ax
shr ebx, 0x1f
mov ecx, 0xa2
call rsi
mov edx, eax
mov eax, 2
test dx, dx
js 0x1400ae9eb
mov ecx, 0xa3
call rsi
shr eax, 0xe
and eax, 2
or ebx, eax
mov ecx, 0xa4
call rsi
mov edx, eax
mov eax, 4
test dx, dx
js 0x1400aea0d
mov ecx, 0xa5
call rsi
shr eax, 0xd
and eax, 4
or eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1400b4e30
Capabilities:
Hide graphical window

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x1401c19c0]
cmp byte [rsi + 0x1c], 0
je 0x1400b4e70
mov rbx, qword [0x1401c19f0]
mov rax, qword [rbx + 0x30]
test rax, rax
je 0x1400b4e93
mov rcx, qword [rax + 0x18]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rbx + 0x30]
mov byte [rax + 0x54], 0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rdx, str.glutHideWindow
lea rcx, [0x1401a5aa0]
call fcn.1400aea50
mov rbx, qword [0x1401c19f0]
mov rax, qword [rbx + 0x30]
test rax, rax
jne 0x1400b4e53
cmp dword [rsi + 0x94], 2
je 0x1400b4e53
lea rdx, str.glutHideWindow
lea rcx, str._ERROR:__Function___s__called_with_no_current_window_defined.
call fcn.1400aea50
mov rax, qword [rbx + 0x30]
jmp 0x1400b4e53
Function at 0x1400b5a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x50], xmm7
mov rax, qword [0x1401c19c0]
cmp byte [rax + 0x1c], 0
mov rsi, rcx
mov rdi, rdx
je 0x1400b5c50
cmp rsi, 3
je 0x1400b5c6d
cmp rsi, 2
je 0x1400b5cb8
cmp rsi, 6
je 0x1400b5cc8
cmp rsi, 7
je 0x1400b5ca8
cmp rsi, 8
je 0x1400b5cd8
cmp rsi, 4
je 0x1400b5ce8
cmp rsi, 5
mov rbx, qword [0x1401c19b0]
jne 0x1400b5c80
nop word cs:[rax + rax]
test rdi, rdi
je 0x1400b5c38
cmp byte [rdi], 0
je 0x1400b5c38
mov ecx, 1
pxor xmm6, xmm6
call qword [sym.imp.OPENGL32.dll_glPushClientAttrib]
mov rsi, qword [sym.imp.OPENGL32.dll_glPixelStorei]
xor edx, edx
mov ecx, 0xcf0
call rsi
xor edx, edx
mov ecx, 0xcf1
call rsi
xor edx, edx
mov ecx, 0xcf2
call rsi
xor edx, edx
mov ecx, 0xcf3
call rsi
xor edx, edx
mov ecx, 0xcf4
call rsi
mov edx, 1
mov ecx, 0xcf5
call rsi
movzx eax, byte [rdi]
lea rsi, [rdi + 1]
movss xmm7, dword [0x1401a5e00]
mov rdi, qword [sym.imp.OPENGL32.dll_glBitmap]
test al, al
jne 0x1400b5bd3
jmp 0x1400b5c19
mov rcx, qword [rbx + 0x10]
pxor xmm0, xmm0
add rsi, 1
movss xmm3, dword [rbx + 0x1c]
movss xmm2, dword [rbx + 0x18]
mov rbp, qword [rcx + rax*8]
movzx ecx, byte [rbp]
lea rax, [rbp + 1]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
cvtsi2ss xmm0, ecx
movss dword [rsp + 0x20], xmm0
call rdi
movzx eax, byte [rbp]
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
movzx eax, byte [rsi - 1]
test al, al
addss xmm6, xmm0
je 0x1400b5c19
cmp al, 0xa
mov edx, dword [rbx + 0xc]
jne 0x1400b5b80
neg edx
pxor xmm0, xmm0
add rsi, 1
xor ecx, ecx
cvtsi2ss xmm0, edx
xorps xmm6, xmm7
xor edx, edx
movss dword [rsp + 0x20], xmm6
pxor xmm3, xmm3
movaps xmm2, xmm3
pxor xmm6, xmm6
mov qword [rsp + 0x30], 0
movss dword [rsp + 0x28], xmm0
call rdi
movzx eax, byte [rsi - 1]
test al, al
jne 0x1400b5bd3
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.OPENGL32.dll_glPopClientAttrib]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, str.glutBitmapString
lea rcx, [0x1401a5ce8]
call fcn.1400aea50
cmp rsi, 3
jne 0x1400b5ab3
mov rbx, qword [str.__e_]
jmp 0x1400b5b00
movaps xmm6, xmmword [rsp + 0x40]
mov rdx, rsi
movaps xmm7, xmmword [rsp + 0x50]
lea rcx, str.font_0x_08x_not_found
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400aeb30
mov rbx, qword [0x1401c1980]
jmp 0x1400b5b00
mov rbx, qword [0x1401c1960]
jmp 0x1400b5b00
mov rbx, qword [0x1401c1970]
jmp 0x1400b5b00
mov rbx, qword [0x1401c1990]
jmp 0x1400b5b00
mov rbx, qword [0x1401c19a0]
jmp 0x1400b5b00
Function at 0x1400c0d90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400d3960
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400d3960
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x1400c0e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14087fea4]
test esi, esi
mov rbx, rcx
jle 0x1400c0f30
mov rax, qword [0x14087fea8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400c0e4b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400c0ed5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400c0e30
mov rcx, rbx
call fcn.1400c1870
test rax, rax
mov rdi, rax
je 0x1400c0f52
mov rax, qword [0x14087fea8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400c19b0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14087fea8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400c0f37
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400c0ece
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400c0ee0
add dword [0x14087fea4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x14087fea8]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400c0ece
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400c0d90
nop dword [rax]
xor esi, esi
jmp 0x1400c0e58
mov rax, qword [0x14087fea8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call fcn.1400c0d90
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.1400c0d90
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400c14c0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14087ff00]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14087fee0]
test rbx, rbx
je 0x1400c151c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x1400c1513
test rsi, rsi
je 0x1400c1513
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400c14f8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400c1730
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400c1768
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400c1770
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400c1740
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400c1768
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400c1770
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400c1750
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.msvcrt.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400c1768
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400c1770
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400c1870
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1401c1610]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400c1890
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400c1898
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400c1890
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400c18ed
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x1400c18e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400c1890
add rax, 0x28
cmp rax, r9
jne 0x1400c18d0
xor eax, eax
ret

Function at 0x1400c18f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401c1610]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400c190f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400c1918
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400c190f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400c19b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401c1610]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400c19cf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400c19d8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400c2d60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rbx, rcx
call sub.msvcrt.dll__errno
test rbx, rbx
mov dword [rax], 0
je 0x1400c2ea0
cmp byte [rbx], 0
je 0x1400c2e68
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400c2eb0
test al, 0x10
je 0x1400c2e68
lea rdi, [rsp + 0x20]
mov rdx, rbx
mov r8d, 0x104
mov rcx, rdi
call sub.msvcrt.dll__fullpath
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rcx, [rax + 0x24b]
mov rsi, rax
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x1400c2ebf
lea rbp, [rsi + 1]
mov rdx, rdi
lea rcx, [rax + 0x244]
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rbx + 0x244], 0
mov rcx, rax
je 0x1400c2e10
movzx eax, byte [rbx + rsi + 0x243]
cmp al, 0x5c
je 0x1400c2e10
cmp al, 0x2f
jne 0x1400c2e88
lea rdx, [rbx + 0x130]
mov eax, 0x2a
mov word [rcx + rsi], ax
mov rdi, rdx
xor eax, eax
mov ecx, 0x20
mov qword [rbx + 0x238], 0xffffffffffffffff
mov dword [rbx + 0x240], 0
mov qword [rbx + 0x128], 0
rep stosq qword [rdi], rax
mov rax, rbx
mov dword [rdi], 0
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 0x14
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, 0x5c
mov word [rcx + rsi], dx
mov rsi, rbp
jmp 0x1400c2e10
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 0xe
jmp 0x1400c2e75
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 2
jmp 0x1400c2e75
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 0xc
jmp 0x1400c2e75
Function at 0x140137710
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
movsxd rbp, eax
je 0x140137758
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14013772a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1401722a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14017bec0]
jmp 0x1400c26d0

Function at 0x1401722b0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14017bec0]
jmp 0x1400c26d0
Function at 0x140011262
Capabilities:
Terminate process

Disassembly:
jmp 0x140013c90
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011302
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014fe0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015000
xor al, al
jmp 0x140015081
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015013
xor al, al
jmp 0x140015081
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001503d
xor al, al
jmp 0x140015081
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015051
xor al, al
jmp 0x140015081
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015063
xor al, al
jmp 0x140015081
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001507f
xor al, al
jmp 0x140015081
mov al, 1
add rsp, 0x38
ret
Function at 0x1400110b4
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001c5b0
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x20]
lea rcx, [0x14003c0fe]
call fcn.140011ad7
mov eax, dword [rbp + 0xf0]
mov dword [rbp + 0xc0], eax
cmp dword [rbp + 0xc0], 0x4f
ja case.default.0x14001c5ff
movsxd rax, dword [rbp + 0xc0]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x1c8fc]
add rax, rcx
jmp rax
mov eax, 0x41
jmp 0x14001c8f0
mov eax, 0x42
jmp 0x14001c8f0
mov eax, 0x43
jmp 0x14001c8f0
mov eax, 0x44
jmp 0x14001c8f0
mov eax, 0x45
jmp 0x14001c8f0
mov eax, 0x46
jmp 0x14001c8f0
mov eax, 0x47
jmp 0x14001c8f0
mov eax, 0x48
jmp 0x14001c8f0
mov eax, 0x49
jmp 0x14001c8f0
mov eax, 0x4a
jmp 0x14001c8f0
mov eax, 0x4b
jmp 0x14001c8f0
mov eax, 0x4c
jmp 0x14001c8f0
mov eax, 0x4d
jmp 0x14001c8f0
mov eax, 0x4e
jmp 0x14001c8f0
mov eax, 0x4f
jmp 0x14001c8f0
mov eax, 0x50
jmp 0x14001c8f0
mov eax, 0x51
jmp 0x14001c8f0
mov eax, 0x52
jmp 0x14001c8f0
mov eax, 0x53
jmp 0x14001c8f0
mov eax, 0x54
jmp 0x14001c8f0
mov eax, 0x55
jmp 0x14001c8f0
mov eax, 0x56
jmp 0x14001c8f0
mov eax, 0x57
jmp 0x14001c8f0
mov eax, 0x58
jmp 0x14001c8f0
mov eax, 0x59
jmp 0x14001c8f0
mov eax, 0x5a
jmp 0x14001c8f0
mov eax, 0x25
jmp 0x14001c8f0
mov eax, 0x27
jmp 0x14001c8f0
mov eax, 0x28
jmp 0x14001c8f0
mov eax, 0x26
jmp 0x14001c8f0
mov eax, 0x70
jmp 0x14001c8f0
mov eax, 0x71
jmp 0x14001c8f0
mov eax, 0x72
jmp 0x14001c8f0
mov eax, 0x73
jmp 0x14001c8f0
mov eax, 0x74
jmp 0x14001c8f0
mov eax, 0x75
jmp 0x14001c8f0
mov eax, 0x76
jmp 0x14001c8f0
mov eax, 0x77
jmp 0x14001c8f0
mov eax, 0x78
jmp 0x14001c8f0
mov eax, 0x79
jmp 0x14001c8f0
mov eax, 0x7a
jmp 0x14001c8f0
mov eax, 0x7b
jmp 0x14001c8f0
mov eax, 0x2e
jmp 0x14001c8f0
mov eax, 0x24
jmp 0x14001c8f0
mov eax, 0x23
jmp 0x14001c8f0
mov eax, 0x21
jmp 0x14001c8f0
mov eax, 0x22
jmp 0x14001c8f0
mov eax, 0x2d
jmp 0x14001c8f0
mov eax, 0xa2
jmp 0x14001c8f0
mov eax, 0xa3
jmp 0x14001c8f0
mov eax, 0xa4
jmp 0x14001c8f0
mov eax, 0xa5
jmp 0x14001c8f0
mov eax, 0xbd
jmp 0x14001c8f0
mov eax, 0xbb
jmp 0x14001c8f0
mov eax, 0xbd
jmp 0x14001c8f0
mov eax, 0xbb
jmp 0x14001c8f0
mov eax, 0xbf
jmp 0x14001c8f0
mov eax, 0xdc
jmp 0x14001c8f0
mov eax, 0xdc
jmp 0x14001c8f0
mov eax, 0x21
jmp 0x14001c8f0
mov eax, 0x40
jmp 0x14001c8f0
mov eax, 0x3e
jmp 0x14001c8f0
mov eax, 0x3c
jmp 0x14001c8f0
mov eax, 0x5e
jmp 0x14001c8f0
mov eax, 0xba
jmp 0x14001c8f0
mov eax, 0xba
jmp 0x14001c8f0
mov eax, 0xde
jmp 0x14001c8f0
mov eax, 0xde
jmp 0x14001c8f0
mov eax, 0xbe
jmp 0x14001c8f0
mov eax, 0xbc
jmp 0x14001c8f0
mov eax, 0x3f
jmp 0x14001c8f0
mov eax, 0xdd
jmp 0x14001c8f0
mov eax, 0xdb
jmp 0x14001c8f0
mov eax, 0xdd
jmp 0x14001c8f0
mov eax, 0xdb
jmp 0x14001c8f0
mov eax, 0x23
jmp 0x14001c8f0
mov eax, 0x24
jmp 0x14001c8f0
mov eax, 0x25
jmp 0x14001c8f0
mov eax, 0x26
jmp 0x14001c8f0
mov eax, 0x2a
jmp 0x14001c8f0
mov eax, 0x2d
lea rsp, [rbp + 0xd8]
pop rdi
pop rbp
ret
Function at 0x140011122
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400213b0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14003c0fc]
call fcn.140011ad7
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140021407
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140021513
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x1400214ac
cmp qword [rbp + 0x28], 0
jle 0x1400214ac
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14002144c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011a3c
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x140021502
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140021502
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret