joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d5a50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d6b30
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d6452
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d64ea
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d64ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d64c2
cmp qword [rbp - 0x10], 0
je 0x2fc4d64c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d6488
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d64eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d65f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6618
mov eax, 0
jmp 0x2fc4d6666
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d6641
mov eax, 0
jmp 0x2fc4d6666
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6661
mov eax, 0
jmp 0x2fc4d6666
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d666c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d66ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d66e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d66e1
mov rax, qword [rbp - 8]
jmp 0x2fc4d66ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d66b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d0b60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d1c40
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d1562
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f4108]
test eax, eax
je 0x2fc4d15fa
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f4110]
mov qword [rbp - 8], rax
jmp 0x2fc4d15de
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d15d2
cmp qword [rbp - 0x10], 0
je 0x2fc4d15d2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d1598
lea rax, [0x2fc4f40e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d15fb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d1700
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d1728
mov eax, 0
jmp 0x2fc4d1776
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d1751
mov eax, 0
jmp 0x2fc4d1776
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d1771
mov eax, 0
jmp 0x2fc4d1776
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d177c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d17fa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d17f1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d17f1
mov rax, qword [rbp - 8]
jmp 0x2fc4d180f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d17c4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001d60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140001d90
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140001db8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001dba
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001e13
test ecx, ecx
jle 0x140001df3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001e13
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001e13
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
xchg ebp, eax
invalid
Function at 0x140001e40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140001e71
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140001e88
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001eb0
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001eb2
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140001ee4
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
mov rbx, rdi
je 0x140001f81
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140001f22
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x140001f61
nop dword [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x140001fa2
cmp rdi, rax
ja 0x140001f30
test rbx, rbx
je 0x140001f81
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
sub rbp, rdi
jmp 0x140001f84
add byte [rax], al
and byte [rax - 0x80], dl
and dword [0x1af047486], esp
outsd dx, dword [rsi]
outsd dx, dword [rsi]
movabs byte [0xb05d000000400022], al
xchg ebp, eax
add ax, 0
or dword [rcx + 0x400024], 0
add byte [rcx + rcx*8 + 0x526a355], bh
add byte [rax], al
and eax, 0x4000246a
add byte [rax], al
add al, cl
cmp edi, 0xa
xor al, byte [0x162a374b2]
and al, 0
add byte [rax], al
add ch, ch
add byte [rax], al
add byte [rax], al
in eax, dx
mov esi, dword [rdi]
or dword [rax + 5], edx
add byte [rax], al
sal dword [rbx], cl
and al, 0
add byte [rax], al
add byte [rcx + rsi*4], ch
jle 0x1400474b3
pop rsi
add eax, 0xd6950000
xchg ebp, eax
invalid
and eax, dword [rax]
add byte [rax], al
add byte [rax + 0x7f204c1b], dl
add eax, 0x2ac10000
and al, 0
add byte [rax], al
add byte [rbx], ch
stc
js 0x140047476
int3
Function at 0x1400023b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400023d4
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000240b
mov rax, qword [rcx + 0x58]
movsxd rcx, dword [rax]
add rcx, rdx
cmp rdx, rcx
jae 0x14000240b
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140002534
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000244e
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002479
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002539
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400024ee
sub eax, 1
je 0x1400024ee
cmp eax, 2
jne 0x140002534
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002539
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14000251f
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002534
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov eax, edi
jne 0x140002539
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140002930
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400029f9
cmp byte [rcx + 0x71], 0
je 0x1400029f9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400029ec
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400029a8
sub eax, 1
je 0x1400029ac
cmp eax, 2
jne 0x1400029ec
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1400029da
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400029ec
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x140009530
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 1
lea r9, [0x140000000]
xor ebx, ebx
mov edx, ebx
lea r8d, [rcx + 0x1f]
nop word [rax + rax]
mov eax, ecx
mov dword [rdx + r9 + 0xb3380], ecx
not eax
rol ecx, 1
mov dword [rdx + r9 + 0xb3400], eax
lea rdx, [rdx + 4]
sub r8, 1
jne 0x140009550
mov ecx, 0x8d7c
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, 0x8d7c
mov qword [0x1400b3370], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, 0x3d0904
mov qword [0x1400b0f58], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, 0x3d0900
mov qword [0x1400b3360], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
cmp qword [0x1400b3370], rbx
mov qword [0x1400b3368], rax
je 0x1400096e8
cmp qword [0x1400b0f58], rbx
je 0x1400096e8
mov rdx, qword [0x1400b3360]
test rdx, rdx
je 0x1400096e8
test rax, rax
je 0x1400096e8
mov ecx, 0xf4241
call fcn.14000bb10
mov rcx, qword [0x1400b3360]
mov r8d, 0x3d0900
lea rdx, [rcx + 4]
call sub.VCRUNTIME140.dll_memmove
lea r10, [0x1400b0f60]
mov edx, ebx
mov r9, r10
lea rax, [0x1400b0f80]
mov r8, rbx
mov ecx, ebx
mov dword [rax], ebx
test dl, 1
je 0x140009633
mov dword [r9], ebx
mov ecx, dword [rax]
inc ecx
mov dword [rax], ecx
test dl, 2
je 0x140009649
add rcx, r8
mov dword [r10 + rcx*4], 1
mov ecx, dword [rax]
inc ecx
mov dword [rax], ecx
test dl, 4
je 0x14000965f
add rcx, r8
mov dword [r10 + rcx*4], 2
mov ecx, dword [rax]
inc ecx
mov dword [rax], ecx
test dl, 8
je 0x140009675
add rcx, r8
mov dword [r10 + rcx*4], 3
mov ecx, dword [rax]
inc ecx
mov dword [rax], ecx
test dl, 0x10
je 0x14000968b
add rcx, r8
mov dword [r10 + rcx*4], 4
mov ecx, dword [rax]
inc ecx
mov dword [rax], ecx
test dl, 0x20
je 0x1400096a1
add rcx, r8
mov dword [r10 + rcx*4], 5
mov ecx, dword [rax]
inc ecx
mov dword [rax], ecx
test dl, 0x40
je 0x1400096b7
add rcx, r8
mov dword [r10 + rcx*4], 6
mov ecx, dword [rax]
inc ecx
mov dword [rax], ecx
test dl, dl
jns 0x1400096c8
add rcx, r8
mov dword [r10 + rcx*4], 7
inc dword [rax]
inc edx
add rax, 0x24
add r8, 9
add r9, 0x24
cmp edx, 0x100
jb 0x140009621
add rsp, 0x20
pop rbx
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.ERROR:_out_of_memory_n
call fcn.140001740
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140009d70
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x140009d87
lea eax, [rcx - 1]
add rsp, 0x20
pop rdi
ret
cmp qword [0x1400b3488], 0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
jne 0x140009dba
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__getcwd]
mov qword [0x1400b3488], rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__getdrive]
mov dword [0x1400b337c], eax
jmp 0x140009dc0
mov eax, dword [0x1400b337c]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chdrive]
test eax, eax
jne 0x140009ddd
mov rcx, qword [0x1400b3488]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chdir]
test eax, eax
je 0x140009dfe
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [0x1400b3488]
lea rdx, str._nWarning:_Current_Directory___s__is_not_available._n
mov rcx, rax
call fcn.140001740
mov ecx, dword [0x1400b39e0]
xor ebx, ebx
test ecx, ecx
je 0x140009e22
lea rax, [0x1400b3498]
cmp qword [rax], rdi
je 0x140009e57
inc ebx
add rax, 0x110
cmp ebx, ecx
jb 0x140009e11
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.File_was_not_locked__n
call fcn.140001740
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x30]
mov esi, eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
mov qword [rsp + 0x38], rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, ebx
lea rbp, [0x1400b3490]
imul rdi, rcx, 0x110
mov esi, eax
mov ecx, dword [rdi + rbp]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
test eax, eax
je 0x140009e91
lea rcx, str.Failed_to_close_lockfile
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
lea rcx, [rbp + 0x10]
add rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x140009eaf
lea rcx, str.Failed_to_delete_lockfile
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov r11d, dword [0x1400b39e0]
inc ebx
cmp ebx, r11d
jae 0x140009f35
mov eax, ebx
lea r9, [rbp + 8]
imul rcx, rax, 0x110
lea r10, [rbp + 0x10]
add r9, rcx
add r10, rcx
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r9 - 8]
lea ecx, [rbx - 1]
imul rdx, rcx, 0x110
mov dword [rdx + rbp], eax
mov rax, qword [r9]
mov qword [rdx + rbp + 8], rax
sub rdx, r10
mov rax, r10
lea r8, [rdx + rbp]
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax]
mov byte [r8 + rax + 0x10], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140009f10
inc ebx
add r10, 0x110
add r9, 0x110
cmp ebx, r11d
jb 0x140009ee0
mov rbp, qword [rsp + 0x38]
dec r11d
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x40]
mov dword [0x1400b39e0], r11d
add rsp, 0x20
pop rdi
ret
Function at 0x14000bb10
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
lea ebp, [rcx + rcx*4]
mov r14, rdx
mov r12d, ecx
shl ebp, 3
mov esi, ebp
mov ebx, 1
shr esi, 1
mov edx, ebx
mov ecx, esi
mov r15d, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
jne 0x14000bb6d
lea rcx, str.error_allocating_tiny_soe_flags_n
call fcn.140001020
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, r15
mov edx, ebx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov eax, ebp
mov dword [r14], 2
mov edx, ebx
cvtsi2sd xmm0, rax
sqrtpd xmm1, xmm0
cvttsd2si r10, xmm1
cmp r10d, ebx
jbe 0x14000bbdd
lea r9, [rdi + 1]
nop
cmp byte [r9], 1
jne 0x14000bbd3
movzx eax, dx
add ax, ax
inc ax
movzx r8d, ax
lea ecx, [r8 + rdx]
cmp ecx, esi
jae 0x14000bbcb
nop dword [rax + rax]
mov byte [rcx + rdi], 0
add ecx, r8d
cmp ecx, esi
jb 0x14000bbc0
mov eax, ebx
inc ebx
mov dword [r14 + rax*4], r8d
inc edx
inc r9
cmp edx, r10d
jb 0x14000bba0
cmp ebx, r12d
jae 0x14000bc0b
lea r8d, [rdx*2 + 1]
nop word [rax + rax]
mov eax, edx
cmp byte [rax + rdi], 1
jne 0x14000bc00
mov eax, ebx
inc ebx
mov dword [r14 + rax*4], r8d
inc edx
add r8d, 2
cmp ebx, r12d
jb 0x14000bbf0
cmp edx, esi
jb 0x14000bc29
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Warning:_tiny_soe_memory_overrun__n
call fcn.140001740
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14144f5b8
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14144f5e1
pop rbp
sub rbp, 0x29
sub rbp, 0x144f5b8
jmp 0x14144f641
sub rsp, 0x20
jmp 0x14144f651
mov rax, 0x144f5b8
add rax, rbp
add rax, 0xcb
mov rcx, 0x64a
mov rdx, 0x6acfe568
xor byte [rax], dl
inc rax
dec rcx
jne 0x14144f670
jmp 0x14144f687
and cl, ah
and ebx, 0x686854e1
push 0x60a9e920
imul ebp, dword [rax + 0x68], 0x20816920
scasd eax, dword [rdi]
test al, 0x66
push 0xffffffffaf206868
stosb byte [rdi], al
push 0xffffffff9f206868
mov ah, byte [rax]
imul ebp, dword [rcx + 0x6864e9e3], 0x69206868
cmp byte [rax], 0x38
and al, dl
in al, 0xfa
jp 0x14144f727
push 0x20686868
rol dword [rbx + rcx + 0x5a], 1
imul ebp, dword [rax + 0x68], 0x69206868
and dword [rax], 0xa9a8a7d2
movsb byte [rdi], byte [rsi]
push 0xffffffff80686868
insd dword [rdi], dx
push 0x7e816868
push 0xffffffff80a96868
push 0x59
jns 0x14144f70a
jmp 0x1a9ad6398
or r11d, dword [rdx + 0x69]
push 0x20686868
imul eax, dword [rcx + 0x68686d80], 0x6ae58168
push 0x15803a68
push 0x3f326868
and cl, ah
mov edi, 0x20a15920
pop rcx
mov edx, 0x206d80eb
xchg edi, eax
movabs al, byte [0xe0676868680cec67]
push 0xffffffffe30e6868
je 0x14144f797
call 0x12dac77de
je 0x14144f7b5
push 0xffffffff8193e868
in al, dx
jnp 0x14144f7be
push 0xffffffff93e90e68
xchg edi, eax
in al, dx
ja 0x14144f7c9
push 0xffffffffa9972068
and dword [rax + 0x41979797], 0x20695124
jmp 0x1a9ad651e
push 0xffffffffe9206868
and cl, ch
sub byte [rbp + 0x68], 0x68
push 0xffffffff9797fb81
insd dword [rdi], dx
push 0xfffffffffb816868
xchg edi, eax
xchg edi, eax
xchg edi, eax
invalid
push 0x6fe06868
and cl, ch
scasd eax, dword [rdi]
imul ebp, dword [rax + 0x68], 0xabaf2068
push 0xffffffffaf206868
stosd dword [rdi], eax
push 0x68
push 0x67ba6a68
in eax, dx
outsd dx, dword [rsi]
push 0x7ee26868
and byte [rdi + 0x67ba7aae], dl
jmp 0x14144f794
mov edx, 0x686fed67
push 0x207ee268
xchg edi, eax
scasb al, byte [rdi]
jp 0x14144f791
jmp 0x14144f794