joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484e80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484f4a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00624300]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x484f2f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004c21c0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x484f1e
mov edi, 1
lea rsi, [0x004c21c0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005074d8]
lea rsi, [0x00506d10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x4ab5c0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4abcff
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4ab5ed
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4ab871
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4ab89d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x00508b80]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004c20c0]
lea rbx, [0x005073d0]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x4ab8c2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4ab8f7
lea rdi, [0x004c2140]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4ab5e3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4ab8db
jmp 0x4ab8b0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x4abea0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4abeb7
inc rax
cmp rax, 4
jge 0x4abecf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4abeb4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4abee0
inc rax
cmp rax, 4
jge 0x4abeee
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4abf17
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4abefb
jmp 0x4abedd
Function at 0x140003330
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
xor edi, edi
call fcn.140006a84
lea rcx, str.C:_aseprite
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], 0xb
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, [rbp - 0x20]
call fcn.1400018d0
nop
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call fcn.140007290
test eax, eax
jne 0x140003536
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x1400033ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400033c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000731c
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov r8d, 9
lea rdx, str.git_fetch
lea rcx, [rbp - 0x40]
call fcn.140005d40
nop
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, eax
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140003444
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000343f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000343f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000731c
test ebx, ebx
je 0x140003511
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
mov r8d, 0x2c
lea rdx, str.Failed_to_fetch_latest_changes_from_origin._n
lea rcx, [rbp - 0x40]
call fcn.140005d40
nop
lea rdx, str.e_35m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005340
mov rcx, rax
lea rdx, str.__LOG____
call fcn.140005340
mov rcx, rax
lea rdx, str.e_0m
call fcn.140005340
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
mov r8, qword [rbp - 0x30]
mov rcx, rax
call fcn.1400066f0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400034fc
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400034f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000731c
xor al, al
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
lea rcx, str.git_status__uno__find__Your_branch_is_up_to_date_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
sete al
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop rbp
ret
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, str.current_path_const_path_
call fcn.140002720
int3
Function at 0x14000696c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400069a6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400069ab
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400069f4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400093d0]
cmp byte [rcx + rax], 0
je 0x1400069f4
dec r8
sub rdx, 1
jne 0x1400069da
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140007cb8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007d02
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007d02
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007d02
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007d02
cmp dword [rcx + 0x84], 0xe
jbe 0x140007d02
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140007d04
xor al, al
add rsp, 0x28
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004054e0]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x004054f0]
mov dword [rax], 1
mov rax, qword [0x00405500]
mov dword [rax], 1
mov rax, qword [0x004054d0]
mov dword [rax], 1
mov rax, qword [0x004053c0]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x004054c0]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x00405480]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x00405370]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x4015fd
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov dword [rbp - 0x80], 0x70
mov dword [rbp - 0x7c], 0x40
mov qword [rbp - 0x78], 0
lea rax, str.runas
mov qword [rbp - 0x70], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x68], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0
mov eax, dword [rbp + 0x20]
mov dword [rbp - 0x50], eax
mov qword [rbp - 0x48], 0
lea rax, [rbp - 0x80]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0xa0
pop rbp
ret
Function at 0x401688
Capabilities:
Hide graphical window
Query environment variable
Write file on windows

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x550
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x4f0], ecx
mov qword [rbp + 0x4f8], rdx
call sym.__main
lea rax, [rbp + 0xb0]
mov edx, 0x400
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__getcwd]
call rax
lea rax, [rbp + 0xb0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xb0]
add rax, rdx
movabs rbx, 0x6f545c617278655c
mov qword [rax], rbx
movabs rdi, 0x70756b6361426f64
mov qword [rax + 8], rdi
movabs rbx, 0x2e65636976726553
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], 0x657865
mov ecx, 0
call sym.IsRunAsAdmin
test eax, eax
jne 0x401774
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov rax, qword [rbp + 0x4f8]
mov rax, qword [rax]
mov r8d, 1
lea rdx, [0x00405032]
mov rcx, rax
call sym.ManagerRun
mov eax, 1
jmp 0x40198c
lea rax, [rbp - 0x60]
mov r8d, 0x104
mov rdx, rax
lea rcx, str.userprofile
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
mov dword [rbp + 0x4c0], eax
mov eax, dword [rbp + 0x4c0]
cdqe
lea rdx, [rbp - 0x60]
add rax, rdx
movabs rdi, 0x706f746b7365645c
mov qword [rax], rdi
movabs rbx, 0x782e6b636568635c
mov qword [rax + 8], rbx
mov word [rax + 0x10], 0x736c
mov byte [rax + 0x12], 0
lea rax, [rbp - 0x60]
lea rdx, [0x00405040]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x4b8], rax
lea rcx, [0x00405042]
call sym.printf
lea rax, [rbp + 0xb0]
mov r8d, 1
lea rdx, [0x00405032]
mov rcx, rax
call sym.ManagerRun
mov dword [rbp + 0x4cc], 0
jmp 0x40191c
mov ecx, 0x5b
call sym.putchar
mov edi, 5
mov eax, dword [rbp + 0x4cc]
cdq
idiv edi
mov dword [rbp + 0x4b4], eax
mov dword [rbp + 0x4c8], 0
jmp 0x401876
mov eax, dword [rbp + 0x4c8]
cmp eax, dword [rbp + 0x4b4]
jge 0x401865
mov eax, 0x2d
movsx eax, al
mov ecx, eax
call sym.putchar
jmp 0x40186f
mov ecx, 0x20
call sym.putchar
add dword [rbp + 0x4c8], 1
mov eax, 0x14
cmp dword [rbp + 0x4c8], eax
jl 0x401846
lea rcx, [0x00405058]
call sym.printf
mov eax, dword [rbp + 0x4cc]
mov edx, eax
lea rcx, str._3d__
call sym.printf
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
mov eax, 0xf4240
mov ecx, eax
call sym.usleep
mov dword [rbp + 0x4c4], 0
jmp 0x4018e2
mov ecx, 8
call sym.putchar
add dword [rbp + 0x4c4], 1
mov eax, dword [rbp + 0x4c4]
movsxd rbx, eax
mov rax, qword [str._______________________100_]
mov rcx, rax
call sym.strlen
cmp rbx, rax
jb 0x4018d1
mov ecx, 1
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
add dword [rbp + 0x4cc], 1
cmp dword [rbp + 0x4cc], 0x64
jle 0x40181c
lea rcx, [0x00405061]
call sym.puts
mov rax, qword [rbp + 0x4b8]
mov r9, rax
mov r8d, 0xe
mov edx, 1
lea rcx, [0x00405063]
call sym.fwrite
mov r9d, 0
lea r8, [0x00405072]
lea rdx, [0x00405077]
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov rax, qword [rbp + 0x4b8]
mov rcx, rax
call sym.fclose
mov eax, 0
add rsp, 0x550
pop rbx
pop rdi
pop rbp
ret
Function at 0x402a60
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402a70
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402a80
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402ac1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402ab8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x402ac3
add rax, 0x28
cmp rax, r9
jne 0x402aa4
xor eax, eax
ret

Function at 0x402b60
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004053c0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x402bcd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402bcd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402bcd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402bc4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402bcf
add rax, 0x28
cmp rax, r9
jne 0x402bb0
xor eax, eax
add rsp, 0x28
ret

Function at 0x402cd0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x004053c0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x402cf0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402ce8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402d4d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402d44
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402d54
add rax, 0x28
cmp rax, r9
jne 0x402d30
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x402d70
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x004053c0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x402dde
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402dde
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x402dde
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402dde
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x402dd5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x402de5
add rcx, 0x28
cmp rcx, rax
jne 0x402dc0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x402df8
jmp 0x402dde
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x402e06
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x402dde
test r9d, r9d
jg 0x402df0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x4030e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x426400
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x42640d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x42641d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x426405
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x426435
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x426422
sub eax, 3
jb 0x42644f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x426486
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x426476
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x426474
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x426463
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.004263c2
jmp 0x42640d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x13400
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x4264d6
cmp rsi, rcx
jae 0x4264de
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x4264bd
cmp al, 0x8f
ja 0x4264bd
cmp byte [rsi - 2], 0xf
je 0x4264c3
sub al, 0xe8
cmp al, 1
ja 0x4264a7
cmp rsi, rcx
jae 0x4264de
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x4264ad
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x4264de
lodsb al, byte [rsi]
jmp 0x4264bd
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x23000]
mov eax, dword [rdi]
or eax, eax
je 0x42653b
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x26000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x4264eb
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x426535
mov qword [rbx], rax
add rbx, 8
jmp 0x42650b
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x426575
cmp al, 0xef
ja 0x426567
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x426547
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x426556
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.004265f4], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.004265f4
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x4265e4
sub rsp, 0xffffffffffffff80
jmp 0x401500
Function at 0x140057530
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005753d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14005754d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140057535
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140057565
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140057552
sub eax, 3
jb 0x14005757f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400575b6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x1400575a6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400575a4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140057593
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1400574f2
jmp 0x14005753d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2a00
mov dl, 1
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140057602
cmp rsi, rcx
jae 0x14005760a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400575e9
cmp al, 0x8f
ja 0x1400575e9
cmp byte [rsi - 2], 0xf
je 0x1400575ef
sub al, 0xe8
cmp al, 1
ja 0x1400575d3
cmp rsi, rcx
jae 0x14005760a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400575d9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14005760a
lodsb al, byte [rsi]
jmp 0x1400575e9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x55000]
mov eax, dword [rdi]
or eax, eax
je 0x140057667
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x5ca88]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140057617
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140057661
mov qword [rbx], rax
add rbx, 8
jmp 0x140057637
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400576a1
cmp al, 0xef
ja 0x140057693
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140057673
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140057682
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400576f5
sub rsp, 0xffffffffffffff80
jmp 0x140002c40
Function at 0x180001070
Capabilities:
Log keystrokes via application hook

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [sym.HookTestDLL.dll_HookCallback]
mov r8, rax
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1800056d8], rax
add rsp, 0x28
ret
Function at 0x14000db90
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140169340]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [0x140234d68]
test eax, eax
jne 0x14000dbcb
mov rcx, qword [rsp + 0xa0]
call fcn.14000ddc0
jmp 0x14000dda4
mov eax, 8
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1402350b0], eax
jle 0x14000dc17
lea rcx, [0x1402350b0]
call fcn.14011de58
cmp dword [0x1402350b0], 0xffffffff
jne 0x14000dc17
lea rcx, [0x140234d88]
call fcn.140009120
nop
lea rcx, [0x1402350b0]
call fcn.14011ddec
mov rax, qword [rsp + 0xa0]
mov ecx, dword [0x1401bf0ac]
cmp dword [rax + 0xc0], ecx
jbe 0x14000dd7d
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xa0]
add rax, 0xc4
mov qword [rsp + 0x38], rax
movss xmm2, dword [0x1401573f8]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
call fcn.14000d310
mov r8, qword [rax]
lea rdx, [rsp + 0x50]
lea rcx, [0x140234d88]
call fcn.14000d2c0
mov r8, qword [rax]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call fcn.14000d270
mov r8, qword [rax]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
call fcn.14000d2c0
mov rax, qword [rsp + 0xa0]
movss xmm0, dword [rax + 0x110]
mulss xmm0, dword [0x140156ffc]
movss xmm1, dword [rsp + 0x7c]
divss xmm1, xmm0
movaps xmm0, xmm1
mulss xmm0, dword [0x1402354b0]
cvttss2si eax, xmm0
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0xa0]
movss xmm0, dword [rax + 0x110]
mulss xmm0, dword [0x140156ffc]
movss xmm1, dword [rsp + 0x78]
divss xmm1, xmm0
movaps xmm0, xmm1
mulss xmm0, dword [0x1402354b4]
cvttss2si eax, xmm0
mov dword [rsp + 0x30], eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14000dd47
mov eax, dword [rsp + 0x30]
neg eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov edx, dword [rsp + 0x34]
mov ecx, 1
call qword [sym.imp.USER32.dll_mouse_event]
mov rax, qword [rsp + 0xa0]
add rax, 0xc4
mov qword [rsp + 0x40], rax
movss xmm2, dword [0x1401573f8]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call fcn.14000d310
mov rax, qword [rax]
mov qword [0x140234d88], rax
jmp 0x14000dd97
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rsp + 0x68]
call fcn.14000cf90
mov rax, qword [rax]
mov qword [0x140234d88], rax
mov rcx, qword [rsp + 0xa0]
call fcn.14000ddc0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14011dd90
add rsp, 0x98
ret