joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180080c70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
imul r12d, edx, 0x1f8
mov r13, r9
mov rsi, r8
mov r14d, edx
mov rdi, rcx
mov ebx, edx
cmp edx, r12d
ja 0x180080dbe
mov r15, qword [rsp + 0x30]
xor edx, edx
mov rbp, qword [rsp + 0x30]
nop word [rax + rax]
cmp ebx, 0x1b6
ja 0x180080d8b
je 0x180080d48
cmp ebx, 3
je 0x180080e95
cmp ebx, 6
je 0x180080d16
cmp ebx, 0x127
jne 0x180080e80
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x180080d06
mov qword [rax + 0x30], rdi
mov rax, qword [rsi + 0x10]
mov qword [rdi + 0x38], rax
mov qword [rsi + 0x10], rdi
jmp 0x180080e80
mov rax, qword [rsi + 8]
mov qword [rax], rdi
mov qword [rsi + 0x10], rdi
jmp 0x180080e80
cmp dword [rsi], 2
jge 0x180080e80
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rdi]
lea rdx, str.Kernel_launch_failed__CUresult_d
mov rcx, rax
call fcn.1800ba9c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rdi + 8]
lea rdx, [0x1800e8070]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbp, rax
test rax, rax
jne 0x180080e7e
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rdi + 8]
lea rdx, str.cmpnleps__0__1
mov rcx, rax
call fcn.1800ba9c0
lea ecx, [rbp + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp ebx, 0x366
je 0x180080e39
cmp ebx, 0x516
je 0x180080df3
cmp ebx, 0x6c6
jne 0x180080e80
mov ecx, 0x9d
mov eax, ecx
sub eax, 0x9e
je 0x180080de0
cmp eax, 1
jne 0x180080de4
mov eax, dword [rsp + 0x30]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov dword [rsp + 0x30], edx
inc ecx
cmp ecx, 0xa0
jb 0x180080db0
jmp 0x180080e80
mov eax, dword [rsi]
lea r8, [rdi + 0x10]
sub eax, 2
lea rdx, [rsp + 0x78]
mov r9d, 0xd6
mov dword [rsp + 0x78], eax
mov rcx, r15
call fcn.180088bf0
mov r9, r15
xor edx, edx
xor ecx, ecx
mov r8d, 0xd2
call fcn.180081e00
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
lea edx, [r9 + 0x45]
call fcn.18000c730
jmp 0x180080e7e
lea rdx, [0x1800e3d02]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf8
xor ecx, ecx
call fcn.18007b790
mov r15, rax
mov r8, rbp
xor eax, eax
mov r9, r15
mov qword [rsp + 0x28], rax
xor edx, edx
mov ecx, 0x10c
mov qword [rsp + 0x20], rax
call fcn.18000aee0
xor edx, edx
lea ecx, [r14 + r14*8]
lea ebx, [rbx + rcx*8]
cmp ebx, r12d
jbe 0x180080cc0
jmp 0x180080dbe
movzx eax, byte [r13]
lea r8, [rsp + 0x78]
mov r9, rdi
mov byte [rsp + 0x78], al
mov edx, 0x8d
mov rcx, rsi
call fcn.180067800
mov byte [rsp + 0x30], al
jmp 0x180080dbe
Function at 0x18008a040
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov esi, dword [rsp + 0xb0]
mov r15, r9
imul ebp, esi, 0x14a
mov rdi, r8
mov r12, rdx
mov r14, rcx
mov ebx, esi
cmp esi, ebp
ja 0x18008a1d1
xor r13d, r13d
movabs rax, 0x40549f5c28f5c28f
cmp ebx, 0x242
ja 0x18008a15a
je 0x18008a146
mov eax, ebx
sub eax, 0xa
je 0x18008a210
sub eax, 7
je 0x18008a13d
sub eax, 0x6e
je 0x18008a0de
sub eax, 0x6e
je 0x18008a1f4
cmp eax, 0x10
jne 0x18008a1c4
lea r9d, [rax + 0x25]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call fcn.180087cd0
jmp 0x18008a1c4
mov qword [rsp + 0x28], r13
lea r8, [rsp + 0x40]
mov r9d, ILFree
mov qword [rsp + 0x20], r13
mov rdx, r14
xor ecx, ecx
call fcn.18005ad00
test al, al
je 0x18008a209
movzx eax, word [r12]
lea r9, [rsp + 0x48]
mov word [rsp + 0xb0], ax
lea rdx, [rsp + 0xb0]
mov eax, dword [rsp + 0x40]
mov r8, rdi
mov ecx, 0x116
mov dword [rsp + 0x48], eax
call fcn.18006f8e0
mov byte [rsp + 0x50], al
jmp 0x18008a1c4
mov qword [rdi + 0xd8], r13
jmp 0x18008a1c4
mov dword [rdi + 0x88], 0x6a
mov rax, qword [r15]
mov qword [rsp + 0x50], rax
jmp 0x18008a1c4
cmp ebx, 0x473
je 0x18008a1d1
cmp ebx, 0x10de
je 0x18008a1d1
cmp ebx, 0x219a
je 0x18008a183
cmp ebx, 0x4237
jne 0x18008a1c4
mov qword [rdi + 0xa8], rax
jmp 0x18008a1c4
mov qword [rsp + 0x38], r13
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov qword [rsp + 0x28], r13
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0xdd
mov dword [rdi + 0xb0], 0x3c
mov dword [rdi + 0xb4], 0x3840
call fcn.18005da70
mov qword [rdi + 0xb8], rax
imul eax, esi, 0x21
add ebx, eax
cmp ebx, ebp
jbe 0x18008a082
mov rax, qword [rsp + 0x50]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str._n_has_no_member_class__sq
call fcn.1800bf220
mov ecx, dword [rdi]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov byte [rsp + 0x50], r13b
jmp 0x18008a1d1
movzx eax, byte [r12]
lea r9, [rsp + 0xb0]
mov rdx, qword [rdi + 0x40]
xor r8d, r8d
mov dword [rsp + 0x28], pe_nt_image_headers64
xor ecx, ecx
mov byte [rsp + 0xb0], al
mov qword [rsp + 0x20], r14
call fcn.180082f30
jmp 0x18008a1d6
Function at 0x18008e830
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebx, dword [rsp + 0x78]
mov r14, r8
mov r15, rcx
lea edi, [rbx + 7]
cmp ebx, edi
jae case.0x18008e883.10
mov rsi, qword [rsp + 0x70]
lea rbp, [0x180000000]
add ebx, 0xffffff51
nop
cmp ebx, 0xa
ja case.0x18008e883.3
mov ecx, dword [rbp + rbx*4 + 0x8e930]
add rcx, rbp
jmp rcx
mov edx, 2
lea rcx, [rsp + 0x78]
mov r9, rsi
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
je case.0x18008e883.3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, qword [r15]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x18008e8a2
jmp case.0x18008e883.3
mov rax, qword [rsi + 0xc0]
test rax, rax
je case.0x18008e883.3
mov rdx, r15
mov rcx, rsi
call rax
jmp case.0x18008e883.3
movzx ecx, byte [rsp + 0x79]
movzx eax, byte [rsp + 0x78]
shl ecx, 8
or ecx, eax
mov dword [rsp + 0x20], ecx
jmp case.0x18008e883.3
inc qword [rsi + 0xd0]
inc ebx
lea eax, [rbx + 0xaf]
cmp eax, edi
jb 0x18008e870
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov rax, qword [r14]
jmp 0x18008e912
Function at 0x180091200
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x50
lea eax, [r8 + 5]
mov ebx, r8d
mov dword [rsp + 0x30], ebx
mov esi, r8d
mov rdi, rcx
cmp r8d, eax
jae 0x180091358
xor ebp, ebp
nop word [rax + rax]
mov eax, ebx
sub eax, 0xf2
je 0x18009132a
sub eax, 1
je 0x180091318
sub eax, 1
je 0x180091358
sub eax, 3
je 0x18009128c
cmp eax, 1
jne 0x180091347
mov qword [rsp + 0x28], rdi
lea ecx, [rax + 0x77]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
xor r8d, r8d
xor edx, edx
call fcn.18005e1c0
jmp 0x180091347
lea rcx, [rdi + 0x70]
mov rdx, rsp
call sub.VCRUNTIME140.dll___intrinsic_setjmp
test eax, eax
jne 0x1800912bb
cmp dword [rsp + 0x34], ebp
jne 0x18009136d
mov esi, dword [rsp + 0x80]
mov rdi, qword [rsp + 0x70]
mov ebx, dword [rsp + 0x30]
jmp 0x180091347
mov rdi, qword [rsp + 0x70]
mov ebx, 0x118
cmp ebx, 0x118
jne 0x1800912fd
xor r9d, r9d
lea edx, [rbx + 0xb]
mov r8, rdi
xor ecx, ecx
call fcn.18002c680
mov r9, rdi
mov dword [rsp + 0x38], ebp
mov r8d, 0x8c
lea rdx, [rsp + 0x38]
xor ecx, ecx
call fcn.1800b84f0
mov dword [rdi + 0x58], 6
add ebx, 0x88
cmp ebx, 0x1a0
jb 0x1800912c5
mov esi, dword [rsp + 0x80]
mov ebx, dword [rsp + 0x30]
jmp 0x180091347
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
jmp 0x180091347
inc qword [rdi + 0xd0]
mov rax, qword [rdi + 0xc0]
test rax, rax
je 0x180091347
mov rdx, qword [rsp + 0x78]
mov rcx, rdi
call rax
inc ebx
lea eax, [rsi + 5]
mov dword [rsp + 0x30], ebx
cmp ebx, eax
jb 0x180091240
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.boralibdnddndCommon.c
call fcn.1800ba9c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x18009c650
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x180106b38]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea r15d, [rcx + 5]
mov rsi, r9
mov r14, r8
mov ebp, ecx
cmp ecx, r15d
jae 0x18009c6cb
mov edi, dword [rsp + 0x30]
lea r12, [0x1800be890]
xor r13d, r13d
nop dword [rax + rax]
mov eax, ebp
sub eax, 0x70
je 0x18009c800
sub eax, 1
je 0x18009c863
sub eax, 4
je 0x18009c743
sub eax, 5
je 0x18009c6fa
cmp eax, 1
jne 0x18009c849
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1800bfc40
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], 0x104
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov ecx, 0xd6
call fcn.18005fea0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb ecx, ecx
neg ecx
dec ecx
mov dword [rsp + 0x30], ecx
jmp 0x18009c849
mov ecx, dword [r14]
sub ecx, 1
je 0x18009c859
sub ecx, 9
je 0x18009c78c
cmp ecx, 0xd
jne 0x18009c7c1
mov ecx, 0x4f
nop
mov eax, ecx
sub eax, 0x4f
je 0x18009c77e
sub eax, 1
je 0x18009c777
cmp eax, 1
je 0x18009c6cb
jmp 0x18009c785
mov byte [rsp + 0x30], 1
jmp 0x18009c785
mov qword [rsi + 0x98], r12
inc ecx
cmp ecx, 0x52
jb 0x18009c760
mov ecx, 0x26
mov eax, ecx
sub eax, 0x26
je 0x18009c7af
sub eax, 0x35
je 0x18009c7a8
cmp eax, 0x35
je 0x18009c6cb
jmp 0x18009c7b6
mov byte [rsp + 0x30], r13b
jmp 0x18009c7b6
mov qword [rsi + 0x98], r12
add ecx, 0x35
cmp ecx, 0xc5
jb 0x18009c791
mov ebx, 0x70
mov eax, ebx
sub eax, 0x70
je 0x18009c7dc
cmp eax, 1
jne 0x18009c7f7
mov byte [rsp + 0x30], r13b
jmp 0x18009c6cb
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov r9, rsi
mov qword [rsp + 0x20], r13
xor ecx, ecx
lea edx, [r8 + 0x69]
call fcn.18009da50
inc ebx
cmp ebx, 0x72
jb 0x18009c7c6
jmp 0x18009c849
mov rcx, r14
mov dword [rsp + 0x20], 0xa8
mov rdi, rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
inc rsi
inc r14
call fcn.180044b90
xor r9d, r9d
mov dword [rsp + 0x20], 0xa8
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov rbx, rax
call fcn.180044b90
mov rdi, rax
sub edi, ebx
jne 0x18009c849
cmp byte [rsi - 1], r13b
jne 0x18009c800
inc ebp
cmp ebp, r15d
jb 0x18009c6a0
jmp 0x18009c6cb
mov byte [rsp + 0x30], 1
jmp 0x18009c6cb
mov eax, edi
jmp 0x18009c6cf
Function at 0x18009c870
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
imul r12d, ecx, 0xe
mov rsi, r9
mov r14, rdx
mov r15d, ecx
mov edi, ecx
cmp ecx, r12d
ja 0x18009ca37
mov r13, qword [rsp + 0x90]
lea rax, [0x1800be830]
mov rbp, qword [rsp + 0x30]
mov edx, 0x5e
xor ecx, ecx
nop
cmp edi, 0x1aa
ja 0x18009c952
je 0x18009ca37
mov eax, edi
sub eax, 0x8e
je 0x18009c932
sub eax, 0x4b
je 0x18009c910
cmp eax, 0xf
jne 0x18009c9ee
lea ecx, [rax - 0xd]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rsi
lea rdx, [0x1800e9590]
mov rcx, rax
call fcn.1800ba9c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [r14]
cmp eax, 1
je 0x18009ca32
cmp eax, 0xa
jne 0x18009ca10
mov rax, qword [rsi + 0x58]
mov rbp, qword [rax + 0x10]
jmp 0x18009c9ee
cmp dword [r14], 0x13
mov eax, 0x60
cmovne eax, edx
mov dword [rsi + 0x88], eax
mov rax, qword [r13]
mov qword [rsp + 0x30], rax
jmp 0x18009c9ee
cmp edi, 0x28b
je 0x18009c981
cmp edi, 0x43d
je 0x18009c973
cmp edi, 0x5ef
je 0x18009ca37
jmp 0x18009c9f5
mov qword [rsi + 0x98], rax
mov byte [rsp + 0x30], 1
jmp 0x18009c9f5
cmp qword [rbp + 8], 0
jne 0x18009c9cd
mov ebx, 0xff
nop dword [rax]
mov eax, ebx
sub eax, 0xfe
je 0x18009ca37
cmp eax, 1
jne 0x18009c9c3
mov qword [rsp + 0x28], rcx
lea edx, [rax + 0x68]
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor ecx, ecx
xor r8d, r8d
call fcn.18009da50
xor ecx, ecx
mov byte [rsp + 0x30], 0
dec ebx
cmp ebx, 0xfd
ja 0x18009c990
mov rdx, qword [rbp + 8]
xor r8d, r8d
add rdx, 0x10
mov qword [rsp + 0x20], rsi
mov r9, r14
lea ecx, [r8 + 7]
call fcn.18009d6d0
xor ecx, ecx
lea edx, [rcx + 0x5e]
lea rax, [0x1800be830]
lea edi, [rdi + r15*2]
cmp edi, r12d
jbe 0x18009c8c0
jmp 0x18009ca37
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov r9, rsi
xor ecx, ecx
lea edx, [r8 + 0x69]
call fcn.18009da50
mov byte [rsp + 0x30], 0
jmp 0x18009ca37
mov byte [rsp + 0x30], 1
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800b2120
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
imul r13d, r9d, 0x32c
mov r15d, r9d
mov r14, rdx
mov edi, r9d
cmp r9d, r13d
ja 0x1800b2287
mov r12, qword [rsp + 0xa0]
xor ebx, ebx
mov rsi, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0x38]
nop dword [rax]
cmp edi, 0x1e9f
ja 0x1800b224f
je 0x1800b2287
mov eax, edi
sub eax, 0x43
je 0x1800b21ef
sub eax, 0x40
je 0x1800b21a9
cmp eax, 0x38
jne 0x1800b2278
test rsi, rsi
je 0x1800b22c4
mov rbp, qword [rsi - 8]
jmp 0x1800b2278
lea rax, [rsp + 0x98]
mov byte [rsp + 0x98], bl
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov edx, 0x119
mov rcx, r14
call fcn.180018430
mov rax, qword [rsp + 0x90]
cmp byte [rax], bl
jne 0x1800b22b0
mov qword [rsp + 0x38], r14
jmp 0x1800b2278
mov rdx, qword [r12]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x1800b22c9
mov r9, rsi
lea edx, [rax + 4]
lea r8d, [rax + 1]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
jne 0x1800b22c9
movzx eax, byte [rsp + 0x32]
movzx ecx, byte [rsp + 0x33]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x31]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x30]
shl ecx, 8
or ecx, eax
mov dword [rsp + 0x38], ecx
jmp 0x1800b2278
cmp edi, 0x3bdf
je 0x1800b2287
cmp edi, 0x5577
je 0x1800b226c
cmp edi, 0xaa33
jne 0x1800b2278
mov rax, rsi
jmp 0x1800b228c
add rsi, qword [r12]
sub rbp, qword [r12]
mov qword [rsi - 8], rbp
imul eax, r15d, 0x74
add edi, eax
cmp edi, r13d
jbe 0x1800b2170
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r9, qword [rsi + 0x30]
mov r8d, 0x2c
mov rdx, r14
xor ecx, ecx
call fcn.18009a6f0
mov rax, rbx
jmp 0x1800b228c
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1800b22e0
Capabilities:
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rsp + 0x60]
mov rsi, r9
mov r15, r8
mov r14, rdx
mov rdi, rcx
lea ebp, [rbx - 4]
cmp ebx, ebp
jbe 0x1800b23a1
mov eax, ebx
sub eax, 0x77
je 0x1800b238d
sub eax, 3
je 0x1800b2370
sub eax, 1
je 0x1800b2349
cmp eax, 4
jne 0x1800b2397
movzx eax, byte [r14]
lea rcx, [rsp + 0x60]
mov r9, rsi
mov byte [rsp + 0x60], al
mov r8d, 0x73
mov rdx, rdi
call fcn.1800a0550
jmp 0x1800b23a6
mov rdx, qword [rsi]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
je 0x1800b2397
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsxd rdx, dword [r15]
mov r9, rdi
mov r8d, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 1
jne 0x1800b235c
jmp 0x1800b2397
mov rax, qword [rsi]
mov qword [rdi + 0xb0], rax
dec ebx
cmp ebx, ebp
ja 0x1800b2313
movzx eax, byte [rsp + 0x60]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1800b3860
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x20
mov ebx, ecx
test rdx, rdx
je 0x1800b3898
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rcx, rax
call fcn.1800bf3a0
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14001179e
Capabilities:
Terminate process

Disassembly:
jmp 0x14002b0e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011979
Capabilities:
Parse pe header

Disassembly:
jmp 0x14002bc10
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002bc30
xor al, al
jmp 0x14002bcb1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14002bc43
xor al, al
jmp 0x14002bcb1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002bc6d
xor al, al
jmp 0x14002bcb1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14002bc81
xor al, al
jmp 0x14002bcb1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14002bc93
xor al, al
jmp 0x14002bcb1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002bcaf
xor al, al
jmp 0x14002bcb1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011cb2
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001d870
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x14003e040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x140048066]
call fcn.140011d98
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x14001d8d6
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x14001d8dd
mov al, 1
jmp 0x14001da32
call fcn.1400114c4
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
movzx edx, ax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov word [rbp + 0x160], ax
call fcn.1400114c4
movzx ecx, word [rbp + 0x160]
movzx edx, cx
movzx ecx, ax
call fcn.140011591
movzx eax, al
test eax, eax
je 0x14001d933
xor al, al
jmp 0x14001da32
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14001d998
cmp dword [rbp + 0x154], 1
je 0x14001d9a3
cmp dword [rbp + 0x154], 3
je 0x14001da21
jmp 0x14001da30
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x72], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14001d9f3
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14001d9f3
xor al, al
jmp 0x14001da32
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x14001da0e
mov dword [rbp + 0x154], 1
jmp 0x14001da18
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001da32
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x72], 0
mov al, 1
jmp 0x14001da32
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140034ec0]
call fcn.140011b45
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140011668
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x180029d30
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180029d58
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x180029d7e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180029d80
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180029dd9
test ecx, ecx
jle 0x180029db9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180029dd9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180029dd9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x180029e00
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180029e22
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180029e38
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180029e54
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180029e56
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180029e92
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180029f2e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180029ecd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x180029f0e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180029f2e
cmp rbx, rax
ja 0x180029ee0
test rbx, rbx
je 0x180029f2e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret