joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bea0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x46bf0b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x46bec4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x46bee1
cmp rdx, 0
je 0x46bf2d
test rdx, 0xf
je 0x46bebd
test rdx, 7
jne 0x46bee1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x46bebd
ret
Function at 0x47a240
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x47a27f
jb 0x47a294
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x47a300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x47a3d0
jb 0x47a42f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0047a1e0
aeskeygenassist xmm1, xmm0, 1
call fcn.0047a200
aeskeygenassist xmm1, xmm2, 2
call fcn.0047a1e0
aeskeygenassist xmm1, xmm0, 2
call fcn.0047a200
aeskeygenassist xmm1, xmm2, 4
call fcn.0047a1e0
aeskeygenassist xmm1, xmm0, 4
call fcn.0047a200
aeskeygenassist xmm1, xmm2, 8
call fcn.0047a1e0
aeskeygenassist xmm1, xmm0, 8
call fcn.0047a200
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047a1e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047a200
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047a1e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047a200
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047a1e0
jmp 0x47a49d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0047a140
aeskeygenassist xmm1, xmm2, 2
call fcn.0047a1a0
aeskeygenassist xmm1, xmm2, 4
call fcn.0047a140
aeskeygenassist xmm1, xmm2, 8
call fcn.0047a1a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047a140
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047a1a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047a140
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0047a1a0
jmp 0x47a49d
aeskeygenassist xmm1, xmm0, 1
call fcn.0047a100
aeskeygenassist xmm1, xmm0, 2
call fcn.0047a100
aeskeygenassist xmm1, xmm0, 4
call fcn.0047a100
aeskeygenassist xmm1, xmm0, 8
call fcn.0047a100
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047a100
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047a100
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0047a100
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0047a100
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0047a100
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0047a100
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x47a4aa
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x140003d40
Capabilities:
Delete registry value

Disassembly:
push r12
push rbx
sub rsp, 0x28
movzx eax, word [rdx + 2]
mov rbx, rcx
lea r12, [rdx + 2]
cmp ax, 9
je 0x140003d60
cmp ax, 0x20
jne 0x140003d76
nop
movzx eax, word [r12 + 2]
add r12, 2
cmp ax, 0x20
je 0x140003d60
cmp ax, 9
je 0x140003d60
test ax, ax
je 0x140003d98
cmp ax, 0x3b
je 0x140003d98
mov rax, r12
mov dword [rbx + 0x48], 2
add rsp, 0x28
pop rbx
pop r12
ret
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.advapi32.dll_RegDeleteValueW]
jmp 0x140003d81

Function at 0x140003f90
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
je 0x140004148
cmp qword [0x14000d070], 0
je 0x140004100
mov r13, qword [0x14000d060]
test r13, r13
je 0x140004148
mov rdi, qword [sym.imp.ucrtbase.dll_wcspbrk]
mov r12, qword [sym.imp.ucrtbase.dll_memmove]
mov rbp, qword [sym.imp.ucrtbase.dll_fread]
lea rdx, [0x1400092b2]
mov rcx, r13
call rdi
test rax, rax
jne 0x140004154
mov rdx, qword [0x14000d060]
cmp word [rdx], 0
je 0x140004138
mov rax, rdx
nop word cs:[rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140004010
sub rax, rdx
sar rax, 1
movsxd rbx, eax
lea r8, [rbx + rbx + 2]
lea r13, [rbx + rbx]
mov rcx, qword [0x14000d068]
call r12
mov rdx, qword [0x14000d070]
mov rcx, rax
mov rax, rdx
sub rax, rbx
cmp rax, 2
jbe 0x1400040d8
mov rax, rbx
add rcx, r13
mov r9, rsi
not rax
lea r8, [rax + rdx]
mov edx, 2
call rbp
test rax, rax
jne 0x140004090
mov qword [0x14000d060], 0
mov r13, qword [0x14000d068]
mov rax, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r13, qword [0x14000d068]
add rax, rbx
xor ecx, ecx
mov word [r13 + rax*2], cx
mov qword [0x14000d060], r13
test r13, r13
jne 0x140003fdd
nop word [rax + rax]
mov rcx, r13
xor r13d, r13d
call qword [sym.imp.ucrtbase.dll_free]
mov qword [0x14000d070], 0
jmp 0x14000407e
lea r14, [rdx + rdx]
shl rdx, 2
mov qword [0x14000d070], r14
call qword [sym.imp.ucrtbase.dll_realloc]
mov rdx, r14
mov qword [0x14000d068], rax
mov rcx, rax
jmp 0x140004050
mov qword [0x14000d070], 0x1000
mov ecx, 0x2000
call qword [sym.imp.ucrtbase.dll_malloc]
xor r8d, r8d
mov qword [0x14000d068], rax
mov r13, rax
mov word [rax], r8w
mov qword [0x14000d060], rax
jmp 0x140003fc8
xor ebx, ebx
xor r13d, r13d
mov r8d, 2
jmp 0x14000402c
mov r13, qword [0x14000d068]
jmp 0x1400040b8
lea rdx, [rax + 2]
cmp word [rax], 0xd
mov qword [0x14000d060], rdx
je 0x14000416f
xor edx, edx
mov word [rax], dx
jmp 0x14000407e
cmp word [rax + 2], 0xa
jne 0x140004165
lea rdx, [rax + 4]
mov qword [0x14000d060], rdx
jmp 0x140004165
Function at 0x1400043d0
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r14, qword [sym.imp.ucrtbase.dll_free]
mov rsi, rcx
mov rcx, qword [0x14000d090]
call r14
test rsi, rsi
je 0x140004580
cmp qword [0x14000d088], 0
je 0x140004548
mov r12, qword [0x14000d078]
test r12, r12
je 0x140004580
mov rdi, qword [sym.imp.ucrtbase.dll_strpbrk]
mov r13, qword [sym.imp.ucrtbase.dll_strlen]
mov rbp, qword [sym.imp.ucrtbase.dll_memmove]
lea rdx, [0x1400092b8]
mov rcx, r12
call rdi
test rax, rax
jne 0x140004590
mov rcx, r12
call r13
mov rcx, qword [0x14000d080]
mov rdx, r12
mov rbx, rax
lea r8, [rax + 1]
call rbp
mov r12, qword [0x14000d088]
mov rcx, rax
mov rax, r12
sub rax, rbx
cmp rax, 2
jbe 0x140004520
mov rax, rbx
add rcx, rbx
mov r9, rsi
mov edx, 1
not rax
lea r8, [rax + r12]
call qword [sym.imp.ucrtbase.dll_fread]
test rax, rax
jne 0x1400044d0
mov rax, qword [0x14000d080]
mov qword [0x14000d078], 0
test rax, rax
je 0x1400044b5
mov rcx, rax
call sym.GetWideString.part.0
mov qword [0x14000d090], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r12, qword [0x14000d080]
add rbx, r12
mov qword [0x14000d078], r12
mov byte [rbx + rax], 0
test r12, r12
jne 0x14000442e
mov qword [0x14000d090], 0
mov rcx, r12
call r14
xor eax, eax
mov qword [0x14000d088], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
add r12, r12
mov qword [0x14000d088], r12
mov rdx, r12
call qword [sym.imp.ucrtbase.dll_realloc]
mov qword [0x14000d080], rax
mov rcx, rax
jmp 0x140004476
mov qword [0x14000d088], 0x1000
mov ecx, 0x1000
call qword [sym.imp.ucrtbase.dll_malloc]
mov qword [0x14000d080], rax
mov r12, rax
mov byte [rax], 0
mov qword [0x14000d078], rax
jmp 0x140004419
mov r12, qword [0x14000d080]
jmp 0x1400044ee
lea rdx, [rax + 1]
cmp byte [rax], 0xd
mov qword [0x14000d078], rdx
je 0x1400045c0
mov byte [rax], 0
mov rcx, r12
call sym.GetWideString.part.0
mov qword [0x14000d090], rax
jmp 0x1400044bc
cmp byte [rax + 1], 0xa
jne 0x1400045a0
lea rdx, [rax + 2]
mov qword [0x14000d078], rdx
jmp 0x1400045a0

Function at 0x1400046e0
Capabilities:
Delete registry key

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x18], 0
mov rbx, rcx
mov r12, rdx
je 0x140004719
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.ucrtbase.dll_free]
mov qword [rbx + 0x20], 0
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov qword [rbx + 0x18], 0
movzx eax, word [r12]
and eax, 0xffffffdf
cmp ax, 0x48
je 0x140004740
mov rax, r12
mov dword [rbx + 0x48], 2
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
mov rcx, r12
mov edx, 0x5c
call qword [sym.imp.ucrtbase.dll_wcschr]
mov rcx, r12
mov rsi, rax
test rax, rax
je 0x140004780
call sym.path_get_rootkey
test rax, rax
je 0x140004727
cmp word [rsi + 2], 0
je 0x140004727
lea rdx, [rsi + 2]
mov rcx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
jmp 0x140004727
call sym.path_get_rootkey
jmp 0x140004727
Function at 0x140004ad0
Capabilities:
Set registry value

Disassembly:
push r12
push rbx
sub rsp, 0x38
xor r8d, r8d
mov rbx, rcx
mov r12, rdx
mov rdx, qword [rcx + 0x28]
mov rcx, qword [rcx + 0x18]
mov eax, dword [rbx + 0x40]
mov r9d, dword [rbx + 0x34]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [rbx + 0x30]
sub eax, 3
cmp eax, 1
jbe 0x140004b40
cmp word [rbx + 0x10], 1
mov eax, 1
mov qword [rbx + 0x38], 0
sbb eax, 0xffffffff
mov dword [rbx + 0x40], 0
mov dword [rbx + 0x48], eax
mov rax, r12
add rsp, 0x38
pop rbx
pop r12
ret
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.ucrtbase.dll_free]
jmp 0x140004b0d
Function at 0x140005020
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x88
mov rbx, rdx
cmp ecx, 4
jg 0x14000504f
mov dword [rsp + 0x44], 0
jne 0x1400050af
mov rcx, qword [rdx + 0x18]
movzx eax, word [rcx]
and eax, 0xfffffffd
cmp ax, 0x2d
je 0x140005088
mov ecx, 0x69
call sym.output_message
mov rcx, qword [rbx + 8]
call qword [sym.imp.ucrtbase.dll__wcsupr]
mov ecx, 0x6a
mov rdx, rax
call sym.output_message
mov eax, 1
add rsp, 0x88
pop rbx
pop rsi
pop r12
pop r13
ret
lea r12, [rcx + 2]
mov rsi, qword [sym.imp.kernel32.dll_lstrcmpiW]
lea rdx, str.reg:32
mov rcx, r12
call rsi
test eax, eax
jne 0x140005250
mov dword [rsp + 0x44], 0x200
mov r13, qword [rbx + 0x10]
lea rdx, [0x140009328]
mov rcx, r13
call qword [sym.imp.ucrtbase.dll__wfopen]
mov r12, rax
test rax, rax
je 0x140005230
lea rcx, [rsp + 0x2e]
mov r9, rax
mov r8d, 1
mov edx, 2
call qword [sym.imp.ucrtbase.dll_fread]
cmp rax, 1
jne 0x140005210
movzx eax, byte [rsp + 0x2e]
movzx edx, byte [rsp + 0x2f]
xor r8d, r8d
lea rcx, [sym.get_lineA]
cmp al, 0xff
jne 0x14000511f
xor r8d, r8d
lea r9, [sym.get_lineW]
cmp dl, 0xfe
cmove rcx, r9
sete r8b
mov word [rsp + 0x38], ax
mov eax, 0xffffffff
lea rbx, [rsp + 0x30]
mov word [rsp + 0x3a], dx
lea rsi, sym.header_state
lea rdx, [rsp + 0x38]
mov word [rsp + 0x40], ax
lea rax, [sym.header_state]
mov dword [rsp + 0x3c], r8d
mov qword [0x14000d098], rcx
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x78], 0
jmp 0x1400051a8
mov eax, dword [rsp + 0x78]
mov rax, qword [rsi + rax*8]
mov rcx, rbx
call rax
mov rdx, rax
test rax, rax
jne 0x1400051a0
cmp word [rsp + 0x40], 4
je 0x140005210
mov rcx, qword [rsp + 0x58]
mov rbx, qword [sym.imp.ucrtbase.dll_free]
call rbx
cmp qword [rsp + 0x48], 0
je 0x1400051f7
mov rcx, qword [rsp + 0x50]
call rbx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], 0
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov qword [rsp + 0x48], 0
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_fclose]
xor eax, eax
add rsp, 0x88
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_fclose]
mov eax, 1
add rsp, 0x88
pop rbx
pop rsi
pop r12
pop r13
ret
mov rdx, r13
mov ecx, 0x192
call sym.output_message
mov eax, 1
jmp 0x140005075
lea rdx, [0x14000931a]
mov rcx, r12
call rsi
test eax, eax
jne 0x14000504f
mov dword [rsp + 0x44], 0x100
jmp 0x1400050af
Function at 0x140005550
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rax, qword [sym.imp.ucrtbase.dll_malloc]
mov r14d, 0x800
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov rsi, rdx
mov ecx, 0x800
mov qword [rsp + 0xd0], r8
lea r12, [rsp + 0x64]
lea rbp, [rsp + 0x5c]
mov dword [rsp + 0xd8], r9d
call rax
mov rdi, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov r13, qword [sym.imp.ucrtbase.dll_realloc]
mov r15, rax
jmp 0x1400055c0
mov edx, dword [rsp + 0x5c]
mov rcx, r15
mov r14, rdx
call r13
mov r15, rax
xor r8d, r8d
mov dword [rsp + 0x5c], r14d
mov r9, r12
mov rdx, rsi
mov qword [rsp + 0x28], rbp
mov rcx, rbx
mov qword [rsp + 0x20], r15
call rdi
cmp eax, 0xea
je 0x1400055b0
test eax, eax
je 0x140005660
mov dword [rsp + 0x4c], eax
mov rdi, qword [sym.imp.ucrtbase.dll_free]
mov rcx, r15
call rdi
mov eax, dword [rsp + 0xd8]
test eax, eax
jne 0x1400056b5
mov eax, dword [rsp + 0x4c]
cmp eax, 2
jne 0x1400057ad
test rsi, rsi
je 0x140005623
cmp word [rsi], 0
jne 0x1400057e0
mov rdx, qword [rsp + 0xd0]
lea rcx, [0x1400094e8]
call sym.output_string
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call sym.output_value
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0xd0]
lea rcx, [0x1400094e8]
call sym.output_string
mov edx, dword [rsp + 0x64]
mov r8, r15
mov rcx, rsi
mov r9d, dword [rsp + 0x5c]
call sym.output_value
lea rcx, [0x1400094c2]
call sym.output_string
inc dword [0x14000d0a4]
mov rdi, qword [sym.imp.ucrtbase.dll_free]
mov rcx, r15
call rdi
mov edx, dword [rsp + 0xd8]
test edx, edx
je 0x1400057ad
mov rax, qword [rsp + 0x40]
mov ecx, 0x202
call rax
mov r12, rax
mov rax, qword [rsp + 0xd0]
cmp word [rax], 0
je 0x1400057f4
mov r15, rax
nop dword [rax]
add r15, 2
cmp word [r15], 0
jne 0x1400056e0
sub r15, qword [rsp + 0xd0]
sar r15, 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0xc8], rsi
xor ebp, ebp
mov rsi, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rax
lea r14, [rsp + 0x60]
mov dword [rsp + 0x60], 0x101
mov r9, r14
mov r8, r12
mov edx, ebp
mov qword [rsp + 0x38], 0
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400057a8
mov r9d, dword [rsp + 0x60]
mov r8, r12
mov edx, r15d
mov rcx, rsi
call sym.build_subkey_path
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
mov r9d, dword [0x14000d0a0]
mov r13, rax
mov rax, qword [rsp + 0x40]
or r9d, 0x20019
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400057b8
mov rcx, r13
inc ebp
call rdi
jmp 0x140005717
mov rcx, r12
call rdi
xor eax, eax
jmp 0x14000564b
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xc8]
mov r9d, 1
mov r8, r13
call sym.query_value
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x140005799
mov ecx, 0x6f
call sym.output_message
mov eax, 1
jmp 0x14000564b
xor r15d, r15d
jmp 0x1400056f6
Function at 0x140006240
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbp, qword [sym.imp.kernel32.dll_GetStdHandle]
mov esi, edx
mov rbx, rcx
lea rdi, [rsp + 0x4c]
mov ecx, 0xfffffff5
call rbp
mov r9, rdi
mov r8d, esi
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, rax
call qword [sym.imp.kernel32.dll_WriteConsoleW]
test eax, eax
je 0x1400062a0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [sym.imp.kernel32.dll_GetOEMCP]
call r15
mov r9d, esi
mov r8, rbx
xor edx, edx
mov r14, qword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [rsp + 0x28], 0
mov ecx, eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call r14
mov ecx, eax
mov r13, rcx
call qword [sym.imp.ucrtbase.dll_malloc]
mov r12, rax
call r15
mov r9d, esi
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x38], 0
mov ecx, eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r12
call r14
mov ecx, 0xfffffff5
call rbp
mov r9, rdi
mov r8d, r13d
mov rdx, r12
mov qword [rsp + 0x20], 0
mov rcx, rax
call qword [sym.imp.kernel32.dll_WriteFile]
mov rcx, r12
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.ucrtbase.dll_free]

Function at 0x140006e90
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
call qword [sym.imp.ucrtbase.dll_strlen]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x140006ee3
cmp byte [r12 + rbx - 1], 0xa
je 0x140006ebe
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
xchg dword [0x14000d1e4], eax
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov edx, 1
mov r9, rax
mov r8, rbx
mov rcx, r12
call qword [sym.imp.ucrtbase.dll_fwrite]
add rsp, 0x28
pop rbx
pop r12
ret
Function at 0x140007af0
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov ecx, 1
call sym._configure_wide_argv
call sym._initialize_wide_environment
call sym.__p___argc
mov r12d, dword [rax]
call sym.__p___wargv
mov r13, qword [rax]
call sym._get_initial_wide_environment
xor ecx, ecx
mov rbx, rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x10]
mov edx, dword [rax + 0x3c]
cmp word [rax + rdx + 0x5c], 2
sete cl
inc ecx
call sym._set_app_type
mov ecx, r12d
mov r8, rbx
mov rdx, r13
call sym.wmain
mov ecx, eax
call sym.exit
nop
nop
nop
nop
nop
Function at 0x140002ef4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002f3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002f3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002f3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002f3e
cmp dword [rcx + 0x84], 0xe
jbe 0x140002f3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002f40
xor al, al
add rsp, 0x28
ret
Function at 0x1400012a4
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0xf78]
mov eax, 0x1070
call fcn.140006620
sub rsp, rax
mov rax, qword [0x14000b0c8]
xor rax, rsp
mov qword [rbp + 0xf60], rax
and qword [rsp + 0x48], 0
lea rdx, [rbp + 0x760]
and qword [rsp + 0x40], 0
mov r14d, 0x400
and qword [rsp + 0x50], 0
mov r8d, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
dec eax
cmp eax, 0x3fe
ja 0x1400014f0
lea r8, [rsp + 0x30]
xor ecx, ecx
lea rdx, [rbp + 0x760]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
nop dword [rax + rax]
mov edi, eax
mov dword [rsp + 0x30], edi
test eax, eax
je 0x1400014f0
mov ecx, edi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400014f0
mov r9d, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x760]
xor ecx, ecx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
nop dword [rax + rax]
test eax, eax
je 0x1400014e1
and qword [rsp + 0x38], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov rcx, rbx
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000149b
movzx eax, word [rcx + 2]
lea rdi, str.StringFileInfo_04x_04x_s
movzx r9d, word [rcx]
mov r8, rdi
lea rcx, [0x1400075b8]
mov edx, r14d
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], eax
call fcn.1400011dc
lea r9, [rsp + 0x30]
mov rcx, rbx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
mov rax, qword [rsp + 0x38]
mov r8, rdi
mov edx, r14d
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
lea rax, [0x140007610]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x60]
call fcn.1400011dc
lea r9, [rsp + 0x30]
mov rcx, rbx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
mov rax, qword [rsp + 0x38]
mov r8, rdi
mov edx, r14d
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
lea rax, [0x140007638]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x60]
call fcn.1400011dc
lea r9, [rsp + 0x30]
mov rcx, rbx
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1400014ce
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x1400014ce
mov r9, qword [rsp + 0x50]
test r9, r9
je 0x1400014ce
lea rcx, str._nMicrosoft__R___s___s__n_s_n_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400014e1
lea rcx, [0x140007690]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [rbp + 0xf60]
xor rcx, rsp
call fcn.140005e90
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret