joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020fd0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov r12, rcx
movsxd rdi, edx
mov ecx, 1
test r12, r12
je 0x140021090
call rbp
lea r13d, [rdi + 1]
mov rcx, rax
movsxd rbx, r13d
call sub.ucrtbase.dll_fflush
mov ecx, 2
call rbp
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov rcx, rbx
call fcn.140011340
mov r8, rdi
mov rdx, r12
mov rsi, rax
mov rcx, rax
call sub.ucrtbase.dll_memcpy
mov byte [rsi + rdi], 0xa
test r13d, r13d
jg 0x140021058
mov ecx, 2
call rbp
mov rcx, rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.ucrtbase.dll_fflush
mov ecx, 1
call rbp
mov ecx, 2
call rbp
mov rdi, rax
nop dword [rax]
mov r8, rbx
mov rcx, rsi
mov r9, rdi
mov edx, 1
call sub.ucrtbase.dll_fwrite
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x140021070
jmp 0x140021039
call rbp
mov ebx, 0xe
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov ecx, 2
call rbp
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov ecx, 0xe
call fcn.140011340
mov ecx, 1
mov rsi, rax
movabs rax, 0x6e6c746e69727065
mov qword [rsi], rax
movabs rax, 0x294c494e286e6c74
mov qword [rsi + 5], rax
mov byte [rsi + 0xd], 0xa
call rbp
mov ecx, 2
call rbp
mov rdi, rax
jmp 0x140021070

Function at 0x1400210f0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbp, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
lea rsi, str.V_panic:
mov ebx, 9
mov r13d, edx
mov r12, rcx
mov ecx, 1
call rbp
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov ecx, 2
call rbp
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov ecx, 1
call rbp
mov ecx, 2
call rbp
mov rdi, rax
mov r8, rbx
mov rcx, rsi
mov r9, rdi
mov edx, 1
call sub.ucrtbase.dll_fwrite
sub rbx, rax
add rsi, rax
test rbx, rbx
jg 0x140021147
mov ecx, 2
call rbp
mov rcx, rax
call sub.ucrtbase.dll_fflush
mov edx, r13d
mov rcx, r12
call fcn.140020fd0
lea rax, str.v_hash:
pxor xmm0, xmm0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [0x14002c2a0]
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x44], xmm0
mov qword [rsp + 0x38], rax
lea rax, str.e863191
mov qword [rsp + 0x48], rax
lea rax, [0x14002bed8]
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x40], 0xfe10
mov dword [rsp + 0x50], 7
mov dword [rsp + 0x64], 1
call fcn.14001d570
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call fcn.140020fd0
lea rcx, str.print_backtrace_skipping_top_frames_is_not_implemented
mov edx, 0x36
call fcn.140020fd0
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
nop dword [rax + rax]
Function at 0x1400228e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.ucrtbase.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.140023e90
call sub.ucrtbase.dll_abort
nop

Function at 0x1400235b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140060968]
test eax, eax
je 0x14002364a
lea rax, [0x140060940]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140060970]
mov qword [rbp - 8], rax
jmp 0x14002362e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140023622
cmp qword [rbp - 0x10], 0
je 0x140023622
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400235e8
lea rax, [0x140060940]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14002364b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140023750
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140023778
mov eax, 0
jmp 0x1400237c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400237a1
mov eax, 0
jmp 0x1400237c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400237c1
mov eax, 0
jmp 0x1400237c6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400237cc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14002384a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140023841
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140023841
mov rax, qword [rbp - 8]
jmp 0x14002385f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140023814
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140002430
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140002458
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000247e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002480
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400024d9
test ecx, ecx
jle 0x1400024b9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400024d9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400024d9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140002500
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002522
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140002538
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140002554
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140002556
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002592
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000262e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400025cd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000260e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000262e
cmp rbx, rax
ja 0x1400025e0
test rbx, rbx
je 0x14000262e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140002a90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002abd
xor eax, eax
jmp 0x140002c29
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002af7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002af7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002c29
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002c1c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002b3a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002b65
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002c21
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002bd4
sub eax, 1
je 0x140002bd4
cmp eax, 2
jne 0x140002c1c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002c21
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002c02
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002c1c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002c21
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004290
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400035d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400036a3
cmp byte [rcx + 0x71], 0
je 0x1400036a3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000369f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003664
sub eax, 1
je 0x140003668
cmp eax, 2
jne 0x14000369f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004290
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003696
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000369f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000364c
xor al, al
jmp 0x14000364c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004290
add rsp, 0x60
pop rbx
ret

Function at 0x140004c10
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004c5a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004c5a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004c5a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004c5a
cmp dword [rcx + 0x84], 0xe
jbe 0x140004c5a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004c5c
xor al, al
add rsp, 0x28
ret
Function at 0x140011249
Capabilities:
Terminate process

Disassembly:
jmp 0x140013a20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112e4
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014d70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014d90
xor al, al
jmp 0x140014e11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014da3
xor al, al
jmp 0x140014e11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014dcd
xor al, al
jmp 0x140014e11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014de1
xor al, al
jmp 0x140014e11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014df3
xor al, al
jmp 0x140014e11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014e0f
xor al, al
jmp 0x140014e11
mov al, 1
add rsp, 0x38
ret
Function at 0x140011208
Capabilities:
Terminate process

Disassembly:
jmp 0x140013330
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001128a
Capabilities:
Execute command

Disassembly:
jmp 0x140011be0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rcx, [0x14002301c]
call fcn.140011393
nop
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 2
lea rdx, [0x14001b354]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_setlocale]
nop
call fcn.140011320
nop
cmp dword [rbp + 0x140], 1
jne 0x140011c65
lea rcx, str.dolbaeb
call qword [sym.imp.ucrtbased.dll_puts]
nop
lea rcx, str.amogus.exe__int_
call qword [sym.imp.ucrtbased.dll_puts]
nop
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
nop
mov eax, 0xe4
jmp 0x140011d96
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x148]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_atoi]
test eax, eax
jne 0x140011c9b
lea rcx, [0x14001b388]
call qword [sym.imp.ucrtbased.dll_puts]
nop
mov eax, 0x5d0
jmp 0x140011d96
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x148]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_atoi]
mov edx, eax
lea rcx, str._n_d_n
call fcn.1400111ae
nop
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x148]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_atoi]
cmp dword [rbp + 4], eax
je 0x140011d90
mov dword [rbp + 0x44], 0
jmp 0x140011cf8
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0xbb8
jge 0x140011d60
mov eax, dword [rbp + 0x24]
imul eax, dword [rbp + 0x44]
mov dword [rbp + 4], eax
mov r9d, dword [rbp + 4]
mov r8d, dword [rbp + 0x44]
mov edx, dword [rbp + 0x24]
lea rcx, str._d___d___d_n
call fcn.1400111ae
nop
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x148]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_atoi]
cmp dword [rbp + 4], eax
jne 0x140011d5e
lea rcx, [0x14001b3b0]
call qword [sym.imp.ucrtbased.dll_puts]
nop
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
nop
jmp 0x140011cf0
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x148]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_atoi]
cmp dword [rbp + 0x24], eax
jle 0x140011d83
xor eax, eax
jmp 0x140011d96
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
jmp 0x140011cc4
jmp 0x140011d94
xor eax, eax
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140011294
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014680
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400146a0
xor al, al
jmp 0x140014721
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400146b3
xor al, al
jmp 0x140014721
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400146dd
xor al, al
jmp 0x140014721
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400146f1
xor al, al
jmp 0x140014721
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014703
xor al, al
jmp 0x140014721
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001471f
xor al, al
jmp 0x140014721
mov al, 1
add rsp, 0x38
ret
Function at 0x140012570
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113bb
movzx eax, al
test eax, eax
jne 0x140012590
mov ecx, 7
call fcn.140011334
nop
mov byte [rsp + 0x20], 0
call fcn.140011348
mov byte [rsp + 0x21], al
cmp dword [0x14001e868], 1
jne 0x1400125b4
mov ecx, 7
call fcn.140011334
nop
jmp 0x14001260c
cmp dword [0x14001e868], 0
jne 0x140012607
mov dword [0x14001e868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111b3
test eax, eax
je 0x1400125e8
mov eax, 0xff
jmp 0x140012711
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.14001133e
mov dword [0x14001e868], 2
jmp 0x14001260c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001131b
call fcn.1400112b7
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012669
mov rcx, qword [rsp + 0x30]
call fcn.14001115e
movzx eax, al
test eax, eax
je 0x140012669
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140024020]
nop
call fcn.1400112e9
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001269d
mov rcx, qword [rsp + 0x38]
call fcn.14001115e
movzx eax, al
test eax, eax
je 0x14001269d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001137a
nop
call fcn.1400127c0
mov dword [rsp + 0x28], eax
call fcn.140011294
movzx eax, al
test eax, eax
jne 0x1400126bc
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400126cb
call fcn.140011384
nop
xor edx, edx
mov cl, 1
call fcn.14001114a
mov eax, dword [rsp + 0x28]
jmp 0x140012711
add rsp, 0x68
ret
Function at 0x140005600
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140005622
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000569c
mov rdi, r14
mov rcx, rbx
call fcn.140008760
test rax, rax
jle 0x140005674
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1400170e0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000568c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140005694
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140005636
sub r14, rdi
jmp 0x14000577f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400056b3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400056b5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400056e7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400170e0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000577c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140005722
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000575d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140020280
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000577c
cmp rbp, rax
ja 0x140005730
test rbp, rbp
je 0x14000577c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140020280
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret