joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025d50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140025db1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140025d70
mov ecx, dword [r9]
jmp 0x140025e9b
cmp ecx, 0x4e0
jb 0x140025e9b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140025dd0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140025e20
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140025ee0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 2]
and rax, 0xff
ret

Function at 0x140025ef7
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0xbc]
and rax, 0x70
ret

Function at 0x140025f2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov qword [rcx], rdx
mov qword [rcx + 8], rax
xor rax, rax
mov rax, 5
shr rax, 2
sub rax, rbx
cmp rax, rcx
rdtsc
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rax
ret
Function at 0x140035fc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
mov r9, r8
mov r8, rdx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rbx
jb 0x14003600d
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140037d80
add rsp, 0xd0
pop rbx
ret
lea rax, str.cannot_write_to_file
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x14
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
movaps xmm0, xmmword [rsp + 0xb0]
movdqa xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x38], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov edx, dword [rax]
lea rcx, [rsp + 0x58]
call fcn.140037590
nop
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x80]
call fcn.140031b30
lea rdx, [0x14004d838]
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1400387e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003882e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003882e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003882e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003882e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003882e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140038830
xor al, al
add rsp, 0x28
ret
Function at 0x14000c960
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
movapd xmmword [rsp + 0x40], xmm7
movapd xmmword [rsp + 0x30], xmm6
mov r12, qword [rcx]
cmp dword [r12 + 4], 0
jne 0x14000cb20
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
movsxd r15, dword [r12]
mov rcx, qword [rcx + 8]
cmp rcx, rdx
je 0x14000c9c2
mov qword [rsp + 0x28], r12
add r12, 8
mov qword [rsp + 0x20], r12
mov r8d, 1
mov rdx, rbx
mov r9d, 1
call fcn.14000bbb0
jmp 0x14000ca12
mov rcx, r15
shl rcx, 4
call fcn.14007202c
mov r14, rax
lea rax, [r12 + 8]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
mov r8d, 1
mov rcx, r14
mov rdx, rbx
mov r9d, 1
call fcn.14000bbb0
movsxd r8, dword [r12]
shl r8, 4
mov rcx, rbx
mov rdx, r14
call fcn.140094760
mov rcx, r14
call fcn.140071418
mov rax, qword [rdi + 8]
movsd xmm0, qword [rax]
movsd xmm1, qword [rax + 8]
movapd xmm2, xmm0
addsd xmm2, xmm1
movsd qword [rsi], xmm2
subsd xmm0, xmm1
mov rax, r15
shl rax, 4
movsd qword [rsi + rax], xmm0
mov qword [rsi + 8], 0
mov qword [rsi + rax + 8], 0
cmp r15d, 2
jl 0x14000cb08
add rax, 0xfffffffffffffff0
shr r15d, 1
shl r15, 4
xor ecx, ecx
movapd xmm0, xmmword [0x140096020]
movapd xmm1, xmmword [0x1400967b0]
nop word cs:[rax + rax]
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
movupd xmm3, xmmword [rdx + rcx + 0x10]
movupd xmm4, xmmword [rdx + rax]
movapd xmm2, xmm3
addpd xmm2, xmm4
subpd xmm3, xmm4
movapd xmm4, xmm3
movsd xmm4, xmm2
movupd xmm5, xmmword [r8 + rcx]
movapd xmm6, xmm2
xorpd xmm6, xmm0
unpckhpd xmm6, xmm2
movapd xmm7, xmm3
unpcklpd xmm7, xmm3
mulpd xmm7, xmm5
shufpd xmm5, xmm5, 1
mulpd xmm5, xmm6
addpd xmm7, xmm5
addpd xmm4, xmm7
mulpd xmm4, xmm1
movupd xmmword [rsi + rcx + 0x10], xmm4
shufpd xmm2, xmm7, 2
shufpd xmm7, xmm3, 2
subpd xmm2, xmm7
mulpd xmm2, xmm1
movupd xmmword [rsi + rax], xmm2
add rax, 0xfffffffffffffff0
add rcx, 0x10
cmp r15, rcx
jne 0x14000ca80
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 2
call fcn.14005ed8c
lea rcx, str.kiss_fft_usage_error:_improper_alloc_n
mov edx, 0x25
mov r8d, 1
mov r9, rax
call fcn.14007155c
mov ecx, 1
call fcn.140066cc4
int3

Function at 0x14000ccf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx + 0x20]
jmp fcn.14000cd00
Function at 0x1400243b0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x1400243bd
cmp edx, 4
jae 0x1400243c0
xor eax, eax
jmp 0x140024409
xor eax, eax
ret
mov r8d, edx
and r8d, 0xfffffffc
xor eax, eax
lea r9, [0x140098620]
xor al, byte [rcx]
movzx eax, al
movzx r10d, byte [rcx + 1]
xor r10b, byte [rax + r9]
movzx eax, byte [rcx + 2]
movzx r10d, r10b
xor al, byte [r10 + r9]
movzx eax, al
movzx r10d, byte [rcx + 3]
xor r10b, byte [rax + r9]
add rcx, 4
movzx eax, r10b
movzx eax, byte [rax + r9]
add r8d, 0xfffffffc
jne 0x1400243d0
test dl, 3
je 0x140024434
and edx, 3
xor r8d, r8d
lea r9, [0x140098620]
nop dword [rax + rax]
xor al, byte [rcx + r8]
movzx eax, al
movzx eax, byte [rax + r9]
inc r8
cmp edx, r8d
jne 0x140024420
ret

Function at 0x140024440
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov eax, r8d
test edx, edx
je 0x1400244f1
mov edx, edx
xor r8d, r8d
lea r9, [0x140098720]
nop dword [rax]
mov rbx, qword [rcx + r8*8]
mov r10, rbx
mov r11, rbx
mov esi, ebx
mov edi, ebx
movzx ebp, bh
movzx r14d, bl
shr rbx, 0x30
xor eax, ebx
movzx ebx, ah
movzx eax, al
movzx eax, word [r9 + rax*2 + 0xc00]
xor ax, word [r9 + rbx*2 + 0xe00]
shr r10, 0x27
and r10d, 0x1fe
xor ax, word [r10 + r9 + 0xa00]
shr r11, 0x1f
and r11d, 0x1fe
xor ax, word [r11 + r9 + 0x800]
shr esi, 0x18
xor ax, word [r9 + rsi*2 + 0x600]
shr edi, 0x10
movzx r10d, dil
xor ax, word [r9 + r10*2 + 0x400]
xor ax, word [r9 + rbp*2 + 0x200]
xor ax, word [r9 + r14*2]
inc r8
cmp edx, r8d
jne 0x140024460
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140024ac0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
test r8d, r8d
je 0x140024adf
mov eax, r8d
cmp r8d, 8
jae 0x140024ae6
xor r8d, r8d
xor ecx, ecx
jmp 0x140024b70
xor ecx, ecx
jmp 0x140024b89
mov r8d, eax
and r8d, 0xfffffff8
mov ecx, eax
shr ecx, 3
shl rcx, 5
pxor xmm0, xmm0
xor r9d, r9d
pxor xmm1, xmm1
nop word cs:[rax + rax]
movdqu xmm2, xmmword [rdx + r9]
movdqu xmm3, xmmword [rdx + r9 + 0x10]
movdqa xmm4, xmm2
psrad xmm4, 0x1f
pxor xmm2, xmm4
psubd xmm2, xmm4
paddd xmm0, xmm2
movdqa xmm2, xmm3
psrad xmm2, 0x1f
pxor xmm3, xmm2
psubd xmm3, xmm2
paddd xmm1, xmm3
add r9, 0x20
cmp rcx, r9
jne 0x140024b10
paddd xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddd xmm0, xmm1
pshufd xmm1, xmm0, 0x55
paddd xmm1, xmm0
movd ecx, xmm1
cmp r8, rax
je 0x140024b89
nop
mov r9d, dword [rdx + r8*4]
mov r10d, r9d
neg r10d
cmovs r10d, r9d
add ecx, r10d
inc r8
cmp rax, r8
jne 0x140024b70
cmp ecx, 1
adc ecx, 0
call fcn.140027950
add eax, esi
add rsp, 0x20
pop rsi
ret
Function at 0x140024ba0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, r9d
mov esi, ecx
test r8d, r8d
je 0x140024bc3
mov eax, r8d
cmp r8d, 8
jae 0x140024bca
xor r8d, r8d
xor ecx, ecx
jmp 0x140024c50
xor ecx, ecx
jmp 0x140024c69
mov r8d, eax
and r8d, 0xfffffff8
mov ecx, eax
shr ecx, 3
shl rcx, 5
pxor xmm0, xmm0
xor r9d, r9d
pxor xmm1, xmm1
nop word cs:[rax + rax]
movdqu xmm2, xmmword [rdx + r9]
movdqu xmm3, xmmword [rdx + r9 + 0x10]
movdqa xmm4, xmm2
psrad xmm4, 0x1f
pxor xmm2, xmm4
psubd xmm2, xmm4
paddd xmm0, xmm2
movdqa xmm2, xmm3
psrad xmm2, 0x1f
pxor xmm3, xmm2
psubd xmm3, xmm2
paddd xmm1, xmm3
add r9, 0x20
cmp rcx, r9
jne 0x140024bf0
paddd xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddd xmm0, xmm1
pshufd xmm1, xmm0, 0x55
paddd xmm1, xmm0
movd ecx, xmm1
cmp r8, rax
je 0x140024c69
nop
mov r9d, dword [rdx + r8*4]
mov r10d, r9d
neg r10d
cmovs r10d, r9d
add ecx, r10d
inc r8
cmp rax, r8
jne 0x140024c50
cmp ecx, 1
adc ecx, 0
call fcn.140027950
mov ecx, esi
sub ecx, edi
add eax, ecx
cmp eax, esi
cmovle eax, esi
inc eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140026dc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
cmp r8d, 8
jl 0x140026e74
lea rax, [0x1400998c0]
nop word cs:[rax + rax]
mov ebx, dword [rdx]
bswap ebx
xor ebx, ecx
mov ecx, ebx
movzx esi, bh
movzx r9d, bl
mov r10d, ebx
shr r10d, 0x18
shr ecx, 0xe
and ecx, 0x3fc
mov ecx, dword [rcx + rax + 0x1800]
xor ecx, dword [rax + r10*4 + 0x1c00]
xor ecx, dword [rax + rsi*4 + 0x1400]
xor ecx, dword [rax + r9*4 + 0x1000]
movzx r9d, byte [rdx + 4]
xor ecx, dword [rax + r9*4 + 0xc00]
movzx r9d, byte [rdx + 5]
xor ecx, dword [rax + r9*4 + 0x800]
movzx r9d, byte [rdx + 6]
xor ecx, dword [rax + r9*4 + 0x400]
movzx r9d, byte [rdx + 7]
xor ecx, dword [rax + r9*4]
add rdx, 8
lea r9d, [r8 - 8]
cmp r8d, 0xf
mov r8d, r9d
ja 0x140026de0
test r9d, r9d
je 0x140026e7c
test r9b, 1
jne 0x140026e80
mov r8d, r9d
cmp r9d, 1
jne 0x140026ea9
jmp 0x140026ef2
mov r9d, r8d
test r9d, r9d
jne 0x140026e63
mov eax, ecx
jmp 0x140026ef2
lea r8d, [r9 - 1]
mov eax, ecx
shl eax, 8
shr ecx, 0x18
movzx r10d, byte [rdx]
inc rdx
xor r10d, ecx
lea rcx, [0x1400998c0]
xor eax, dword [rcx + r10*4]
mov ecx, eax
cmp r9d, 1
je 0x140026ef2
mov r8d, r8d
xor r9d, r9d
lea r10, [0x1400998c0]
mov eax, ecx
nop dword [rax + rax]
mov ecx, eax
shl ecx, 8
shr eax, 0x18
movzx r11d, byte [rdx + r9]
xor r11d, eax
xor ecx, dword [r10 + r11*4]
mov eax, ecx
shl eax, 8
shr ecx, 0x18
movzx r11d, byte [rdx + r9 + 1]
xor r11d, ecx
xor eax, dword [r10 + r11*4]
add r9, 2
cmp r8d, r9d
jne 0x140026ec0
pop rbx
pop rsi
ret
Function at 0x14002f1f0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x14002f286
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x14002f28d
mov r15, rsi
jmp 0x14002f24b
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call fcn.140094760
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x14002f27e
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14002f263
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x14002f220
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14002f27e
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x14002f24b
sub rsi, r15
jmp 0x14002f37a
xor esi, esi
jmp 0x14002f37a
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14002f2e0
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x14002f2e0
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.140094760
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x14002f2f1
jmp 0x14002f377
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x14002f377
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x14002f320
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
nop dword [rax]
cmp r14, 0x1000
jb 0x14002f353
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.140071198
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x14002f320
jmp 0x14002f377
test r14, r14
je 0x14002f374
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.140071198
sub r14, rax
jmp 0x14002f377
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140039da0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x270
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1e8], 0xfffffffffffffffe
mov rax, qword [rcx + 0x28]
inc rax
cmp rax, 1
jbe 0x140039f36
mov rdi, r8
test r8, r8
je 0x140039e39
mov rbx, rdx
mov rsi, rcx
xor r15d, r15d
lea r14, [rbp + 0x1dc]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
nop word cs:[rax + rax]
mov dword [rbp + 0x1dc], 0
mov r8d, edi
sub r8d, r15d
lea rdx, [rbx + r15]
mov rcx, qword [rsi + 0x28]
mov qword [rsp + 0x20], 0
mov r9, r14
call r12
test eax, eax
je 0x140039e4b
mov eax, dword [rbp + 0x1dc]
add r15, rax
cmp r15, rdi
jb 0x140039e00
add rsp, 0x270
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rdx, str.Error_writing_to_file__
lea rdi, [rbp - 0x58]
mov rcx, rdi
call fcn.140035140
add rsi, 0x20
mov rcx, rdi
mov rdx, rsi
call fcn.140033500
lea rdx, [0x1400ab827]
lea rcx, [rbp - 0x58]
call fcn.140032f90
lea rcx, [rbp + 0x1e0]
call fcn.14004be30
lea rcx, [rbp - 0x58]
lea rdx, [rbp + 0x1e0]
call fcn.140033500
mov rcx, qword [rbp + 0x1e0]
test rcx, rcx
je 0x140039ec0
mov qword [rbp + 0x1e0], 0
lock dec dword [rcx + 8]
jne 0x140039ec0
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rcx, [rbp + 0x1e0]
lea rdx, [rbp - 0x58]
call fcn.1400335f0
mov dword [rbp + 0x1c0], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1c8], 0
mov rax, qword [rbp + 0x1e0]
test rax, rax
je 0x140039f0a
mov qword [rbp + 0x1c8], rax
lock inc dword [rax + 8]
mov qword [rbp + 0x1d0], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp + 0x1b8], rax
lea rdx, [0x1400b8140]
lea rcx, [rbp + 0x1b8]
call fcn.14005c53c
lea rdx, str.File_output_is_no_longer_open
lea rcx, [rbp + 0x1e0]
call fcn.140032a10
mov dword [rbp - 0x50], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0
mov rax, qword [rbp + 0x1e0]
test rax, rax
je 0x140039f77
mov qword [rbp - 0x48], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x40], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1400b8140]
lea rcx, [rbp - 0x58]
call fcn.14005c53c
int3
Function at 0x140043a70
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
test r8, r8
je 0x140043ac0
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x140043ac4
mov dword [rbp - 0x14], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x14]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140043b24
mov eax, dword [rbp - 0x14]
add rsp, 0x80
pop rbp
ret
xor eax, eax
jmp 0x140043ab7
lea rdx, str.File_is_not_open
lea rcx, [rbp - 0x10]
call fcn.140032a10
mov dword [rbp - 0x50], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140043aff
mov qword [rbp - 0x48], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x40], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1400b8140]
lea rcx, [rbp - 0x58]
call fcn.14005c53c
jmp 0x140043b82
lea rdx, str.ReadFile___failed
lea rcx, [rbp - 0x10]
call fcn.140032a10
mov dword [rbp - 0x30], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140043b5f
mov qword [rbp - 0x28], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x20], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x38], rax
lea rdx, [0x1400b8140]
lea rcx, [rbp - 0x38]
call fcn.14005c53c
int3

Function at 0x1400444d0
Capabilities:
Get file size

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x14004450c
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14004456c
mov rax, qword [rbp - 0x10]
add rsp, 0x80
pop rbp
ret
lea rdx, str.File_is_not_open
lea rcx, [rbp - 0x10]
call fcn.140032a10
mov dword [rbp - 0x50], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140044547
mov qword [rbp - 0x48], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x40], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1400b8140]
lea rcx, [rbp - 0x58]
call fcn.14005c53c
jmp 0x1400445ca
lea rdx, str.Could_not_get_length_of_file
lea rcx, [rbp - 0x18]
call fcn.140032a10
mov dword [rbp - 0x30], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x1400445a7
mov qword [rbp - 0x28], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x20], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x38], rax
lea rdx, [0x1400b8140]
lea rcx, [rbp - 0x38]
call fcn.14005c53c
int3
Function at 0x14004f7d0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x288
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x200], 0xfffffffffffffffe
cmp qword [rdx], 0
je 0x14004f8f1
mov rsi, rdx
lea rdx, str.Drives
mov rcx, rsi
call fcn.140033cc0
test eax, eax
je 0x14004f8f1
lea rdx, str.Network
mov rcx, rsi
call fcn.140033cc0
test eax, eax
je 0x14004f8f1
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov rdx, rsi
call fcn.14004d170
lea r8, [0x1400c78d0]
lea rdi, [rbp + 0x1b0]
mov rcx, rbx
mov rdx, rdi
call fcn.140033ed0
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14004f872
mov qword [rbp - 0x60], 0
lock dec dword [rcx + 8]
jne 0x14004f872
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
cmp qword [rbp + 0x1c8], 8
jb 0x14004f883
mov rdi, qword [rbp + 0x1b0]
mov rcx, rdi
call fcn.14006c60c
test eax, eax
je 0x14004f8a5
call fcn.140069284
cmp dword [rax], 0x11
jne 0x14004f8fe
mov rdx, rsi
call fcn.14004f620
test al, al
je 0x14004f8fe
mov rax, qword [rbp + 0x1c8]
cmp rax, 8
jb 0x14004f8f1
mov rcx, qword [rbp + 0x1b0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14004f8ec
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14004f9f4
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14005753c
nop
add rsp, 0x288
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.Could_not_create_directory
lea rcx, [rbp - 0x60]
call fcn.140035140
lea rcx, [rbp - 0x60]
mov rdx, rdi
call fcn.140035710
lea rdx, [0x1400ab82c]
lea rcx, [rbp - 0x60]
call fcn.140033910
lea rcx, [rbp + 0x1f8]
call fcn.14004be30
lea rcx, [rbp - 0x60]
lea rdx, [rbp + 0x1f8]
call fcn.140033950
lea rcx, [rbp + 0x1f0]
lea rdx, [rbp - 0x60]
call fcn.1400335f0
mov rcx, qword [rbp + 0x1f8]
test rcx, rcx
je 0x14004f97d
mov qword [rbp + 0x1f8], 0
lock dec dword [rcx + 8]
jne 0x14004f97d
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rbp + 0x1a0]
test rcx, rcx
je 0x14004f98e
call fcn.140071418
mov dword [rbp + 0x1d8], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1e0], 0
mov rax, qword [rbp + 0x1f0]
test rax, rax
je 0x14004f9c8
mov qword [rbp + 0x1e0], rax
lock inc dword [rax + 8]
mov qword [rbp + 0x1e8], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp + 0x1d0], rax
lea rdx, [0x1400b8140]
lea rcx, [rbp + 0x1d0]
call fcn.14005c53c
call fcn.14006afb4
int3

Function at 0x14005b318
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005b362
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005b362
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005b362
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005b362
cmp dword [rcx + 0x84], 0xe
jbe 0x14005b362
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005b364
xor al, al
add rsp, 0x28
ret
Function at 0x140066cc4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140066e0c
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140066e7b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140066e7b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140066e7b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140066e7b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140066e7b
cmp dword [rcx + 0x84], 0xe
jbe 0x140066e7b
cmp dword [rcx + 0xf8], 0
je 0x140066e7b
mov ecx, ebx
call fcn.140066d44
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140066fa0
nop
cmp dword [rbp + 0x20], 0
je 0x140066ec9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140066dd8
int3

Function at 0x140066e0c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140066e0c
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140066e7b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140066e7b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140066e7b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140066e7b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140066e7b
cmp dword [rcx + 0x84], 0xe
jbe 0x140066e7b
cmp dword [rcx + 0xf8], 0
je 0x140066e7b
mov ecx, ebx
call fcn.140066d44
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140066fa0
nop
cmp dword [rbp + 0x20], 0
je 0x140066ec9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140066dd8
int3