joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005d150
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2b0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14040a3a0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, rdx
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov ecx, dword [rax]
inc ecx
cmp ecx, 1
jbe 0x14005d19a
lock inc dword [rax]
mov rax, qword [rsp + 0x20]
mov r8d, dword [rax + 4]
cmp r8d, 2
jne 0x14005d210
mov rcx, qword [rax + 0x10]
cmp word [rcx + rax + 2], 0x3a
jne 0x14005d210
cmp dword [rax], 1
ja 0x14005d1c4
mov edx, dword [rax + 8]
btr edx, 0x1f
lea ecx, [r8 + 2]
cmp ecx, edx
jbe 0x14005d1da
lea edx, [r8 + 2]
mov r8b, 1
lea rcx, [rsp + 0x20]
call fcn.14001e380
mov rax, qword [rsp + 0x20]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea r8, [rcx + rdx*2]
mov ecx, 0x5c
mov word [r8 + rax], cx
mov rax, qword [rsp + 0x20]
inc dword [rax + 4]
mov rax, qword [rsp + 0x20]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea r8, [rcx + rdx*2]
xor ecx, ecx
mov word [r8 + rax], cx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140078dc0
nop
mov rcx, rax
call fcn.140021a50
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx]
or edi, 0xffffffff
test eax, eax
je 0x14005d255
cmp eax, edi
je 0x14005d263
mov edx, edi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x14005d263
mov rcx, qword [rsp + 0x28]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
cmp ebx, 0xffffffff
jne 0x14005d29b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14005d278
cmp eax, 0x20
jne 0x14005d29b
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140078dc0
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14005c5a0
test al, al
cmovne ebx, dword [rsp + 0x50]
test rsi, rsi
je 0x14005d2a8
cmp ebx, 0xffffffff
setne al
mov byte [rsi], al
cmp ebx, 0xffffffff
jne 0x14005d2b1
xor bl, bl
jmp 0x14005d2b7
shr ebx, 4
and bl, 1
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14005d2d5
cmp eax, 0xffffffff
je 0x14005d2e3
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x14005d2e3
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
movzx eax, bl
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400fbe80
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14005d850
Capabilities:
Create shortcut via ishelllink

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x4e0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x510], rbx
mov rax, qword [0x14040a3a0]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x38], 0
lea rax, [0x14017f600]
mov qword [rcx], rax
mov dword [rsp + 0x38], 1
xor sil, sil
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x1402be8a0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1402be900]
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, 0x800401f0
jne 0x14005d900
mov sil, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x1402be8a0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1402be900]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14005da1c
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
lea rdx, [0x1402be8f0]
call qword [rax]
test eax, eax
js 0x14005da11
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140057a80
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov rbx, qword [rax]
call fcn.140021a50
mov rdx, rax
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [rbx + 0x28]
mov ebp, eax
mov rcx, qword [rsp + 0x48]
mov edx, dword [rcx]
or ebx, 0xffffffff
test edx, edx
je 0x14005d975
cmp edx, ebx
je 0x14005d983
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14005d983
mov rcx, qword [rsp + 0x48]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
test ebp, ebp
js 0x14005da06
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov dword [rsp + 0x20], 2
lea r9, [rsp + 0x70]
mov r8d, 0x104
lea rdx, [rsp + 0x2c0]
call qword [rax + 0x18]
test eax, eax
jne 0x14005da06
mov r8d, ebx
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x50]
call fcn.1400090f0
mov rdx, rax
mov rcx, qword [rdi]
mov qword [rsp + 0x68], rcx
mov rax, qword [rax]
mov qword [rdi], rax
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx]
test eax, eax
je 0x14005d9f8
cmp eax, 0xffffffff
je 0x14005da06
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x14005da06
mov rcx, qword [rsp + 0x50]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test sil, sil
je 0x14005da27
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rax, rdi
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.1400fbe80
mov rbx, qword [rsp + 0x510]
add rsp, 0x4e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005e3a0
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rdi, rdx
lea rdx, [rsp + 0x50]
call fcn.140057a80
nop
mov rcx, rax
call fcn.140021a50
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx]
test eax, eax
je 0x14005e3f9
cmp eax, 0xffffffff
je 0x14005e407
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jne 0x14005e407
mov rcx, qword [rsp + 0x50]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
test bl, bl
jne 0x14005e425
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 2
mov rcx, qword [rsp + 0x50]
mov qword [rdi], rcx
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14005e440
Capabilities:
Move file

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov r14, r8
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140057a80
mov rsi, rax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140057a80
mov rdi, rax
mov rcx, rsi
call fcn.140021a50
mov rbx, rax
mov rcx, rdi
call fcn.140021a50
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx]
or ebx, 0xffffffff
test eax, eax
je 0x14005e4ce
cmp eax, ebx
je 0x14005e4dd
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14005e4dd
mov rcx, qword [rsp + 0x58]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14005e4fb
cmp eax, 0xffffffff
je 0x14005e509
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x14005e509
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
test dil, dil
jne 0x14005e528
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 2
mov rcx, qword [rsp + 0x58]
mov qword [r14], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x14005e550
Capabilities:
Move file

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov r14, r8
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140057a80
mov rsi, rax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140057a80
mov rdi, rax
mov rcx, rsi
call fcn.140021a50
mov rbx, rax
mov rcx, rdi
call fcn.140021a50
mov rcx, rax
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx]
or ebx, 0xffffffff
test eax, eax
je 0x14005e5e4
cmp eax, ebx
je 0x14005e5f3
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14005e5f3
mov rcx, qword [rsp + 0x58]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14005e611
cmp eax, 0xffffffff
je 0x14005e61f
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x14005e61f
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
test dil, dil
jne 0x14005e63e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 2
mov rcx, qword [rsp + 0x58]
mov qword [r14], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x14005e660
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140078dc0
nop
mov rcx, rax
call fcn.140021a50
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx]
test eax, eax
je 0x14005e6b4
cmp eax, 0xffffffff
je 0x14005e6c2
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jne 0x14005e6c2
mov rcx, qword [rsp + 0x48]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x14005edd0
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rdi, rdx
mov r14, rcx
xor bpl, bpl
xor esi, esi
call fcn.1400577f0
test al, al
je 0x14005ee94
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.1400573f0
mov rdx, qword [rax]
mov rcx, qword [rdx + 0x10]
movzx ecx, word [rdx + rcx]
call fcn.140020f80
mov word [rsp + 0x80], ax
movzx ecx, ax
sub ecx, 0x41
mov ebx, 1
shl ebx, cl
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14005ee74
cmp eax, 0xffffffff
je 0x14005ee82
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jne 0x14005ee82
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
and ebx, esi
setne bpl
neg ebx
sbb esi, esi
and esi, 0x14
jmp 0x14005ef93
lea rdx, [rsp + 0x88]
mov rcx, r14
call fcn.140057a80
nop
mov dword [rsp + 0x20], 7
lea rax, str._UNC
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x40], xmm0
mov ebx, 1
mov r8d, ebx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x88]
call fcn.140020600
test al, al
je 0x14005ef5e
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x10]
mov r9d, ebx
lea r8d, [rbx + 6]
movzx edx, word [rax + rcx]
lea rcx, [rsp + 0x88]
call fcn.14001ba40
mov r8d, eax
test eax, eax
jle 0x14005ef45
mov rax, qword [rsp + 0x88]
mov rcx, qword [rax + 0x10]
inc r8d
mov r9d, ebx
movzx edx, word [rax + rcx]
lea rcx, [rsp + 0x88]
call fcn.14001ba40
test eax, eax
jle 0x14005ef45
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 4]
dec edx
cmp eax, edx
jne 0x14005ef66
lea rcx, [rsp + 0x88]
call fcn.14005f250
test al, al
je 0x14005ef5e
mov esi, 0x10
movzx ebp, bl
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx]
test eax, eax
je 0x14005ef85
cmp eax, 0xffffffff
je 0x14005ef93
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jne 0x14005ef93
mov rcx, qword [rsp + 0x88]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
test bpl, bpl
je 0x14005efbc
mov dword [rdi + 0x10], esi
test sil, 0x10
mov ecx, 0x20000
mov eax, 0x40000
cmovne ecx, eax
or dword [rdi + 4], ecx
or dword [rdi + 4], 0x400000
or dword [rdi], 0x560000
movzx eax, bpl
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14005f120
Capabilities:
Enumerate network shares

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, rdx
mov r15, rcx
xor r14d, r14d
mov dword [rax + 0x18], r14d
mov dword [rax - 0x48], r14d
mov dword [rax + 0x20], r14d
nop
mov rcx, r15
call fcn.140021a50
mov rcx, rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
lea r8, [rsp + 0x50]
mov edx, 1
call sub.NETAPI32.dll_NetShareEnum
mov ebp, eax
test eax, eax
je 0x14005f19f
cmp eax, 0xea
jne 0x14005f219
mov rbx, qword [rsp + 0x50]
mov edi, 1
cmp dword [rsp + 0xa0], edi
jb 0x14005f219
test rsi, rsi
je 0x14005f20a
cmp dword [rbx + 8], 0
jne 0x14005f20a
or r8d, 0xffffffff
mov rdx, qword [rbx]
lea rcx, [rsp + 0x48]
call fcn.1400090f0
nop
mov rdx, rax
mov rcx, rsi
call fcn.14000cfb0
nop
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx]
test eax, eax
je 0x14005f1fc
cmp eax, 0xffffffff
je 0x14005f20a
or eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14005f20a
mov rcx, qword [rsp + 0x48]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
add rbx, 0x18
inc edi
cmp edi, dword [rsp + 0xa0]
jbe 0x14005f1b2
mov rcx, qword [rsp + 0x50]
call sub.NETAPI32.dll_NetApiBufferFree
cmp ebp, 0xea
je 0x14005f150
test ebp, ebp
sete al
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400620e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rbp
mov rbx, rdx
mov rdi, rcx
mov r8, qword [rcx]
mov esi, dword [r8 + 8]
btr esi, 0x1f
mov ebp, dword [r8 + 4]
inc ebp
cmp dword [r8], 1
ja 0x140062144
cmp ebp, esi
ja 0x140062144
movsxd rax, dword [r8 + 4]
lea rcx, [rax + rax*2]
mov rax, qword [r8 + 0x10]
lea rcx, [rax + rcx*8]
add rcx, r8
mov qword [r11 + 8], rcx
mov qword [r11 + 0x18], rcx
je 0x14006213f
call fcn.14005fa20
nop
jmp 0x14006223b
lea rcx, [rsp + 0x28]
call fcn.14005f680
nop
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x30]
call fcn.14005f680
mov r14d, dword [rbx + 0x10]
mov dword [rsp + 0x38], r14d
movzx ebx, byte [rbx + 0x14]
mov byte [rsp + 0x3c], bl
cmp esi, ebp
sbb r9d, r9d
and r9d, 8
mov rax, qword [rdi]
cmp ebp, esi
jbe 0x140062187
mov r8d, dword [rax + 4]
inc r8d
jmp 0x140062190
mov r8d, dword [rax + 8]
btr r8d, 0x1f
mov edx, dword [rax + 4]
mov rcx, rdi
call fcn.140069720
mov rdx, qword [rdi]
movsxd rax, dword [rdx + 4]
lea rcx, [rax + rax*2]
mov rax, qword [rdx + 0x10]
lea r8, [rax + rcx*8]
add r8, rdx
je 0x1400621df
mov rax, qword [rsp + 0x28]
mov qword [r8], rax
lea rcx, [0x14017f600]
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0x30]
mov qword [r8 + 8], rax
mov qword [rsp + 0x30], rcx
mov dword [r8 + 0x10], r14d
mov byte [r8 + 0x14], bl
jmp 0x1400621e4
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
or ebx, 0xffffffff
test eax, eax
je 0x140062201
cmp eax, ebx
je 0x14006220f
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14006220f
mov rcx, qword [rsp + 0x30]
mov edx, 4
lea r8d, [rdx + 4]
call fcn.14002c3b0
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax]
test ecx, ecx
je 0x140062228
cmp ecx, 0xffffffff
je 0x14006223b
lock xadd dword [rax], ebx
cmp ebx, 1
jne 0x14006223b
mov edx, 4
lea r8d, [rdx + 4]
mov rcx, qword [rsp + 0x28]
call fcn.14002c3b0
mov rax, qword [rdi]
inc dword [rax + 4]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140079820
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0xa4], 1
je 0x140058b92
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0xa4], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140079820
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
mov rax, qword [rcx + 0x78]
test rax, rax
jne 0x140079954
cmp dword [rcx + 0xa0], 0xffffffff
jne 0x14007994f
cmp qword [rcx + 0x80], 0xffffffffffffffff
je 0x1400799b8
mov rdi, r8
mov qword [r11 + 0x20], r8
xor r12d, r12d
mov ebx, r12d
lea r13, [0x1401e3da8]
nop word [rax + rax]
lea rax, [rsp + 0xa8]
cmp rdi, 0x2000000
cmovge rax, r13
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x90]
mov r8d, dword [rax]
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400798e8
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x14007994a
add rbx, rax
sub rdi, rax
mov qword [rsp + 0xa8], rdi
cmp rbx, rbp
jge 0x14007994a
jmp 0x140079890
test rbx, rbx
jne 0x14007994a
or edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140040790
nop
mov r8, rax
lea edx, [rbx + 1]
mov rcx, r15
call fcn.1400570e0
nop
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x140079933
cmp eax, 0xffffffff
je 0x1400799b8
or eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400799b8
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
or rax, 0xffffffffffffffff
jmp 0x1400799cc
mov rax, rbx
jmp 0x1400799cc
test rax, rax
je 0x1400799be
call fcn.140079580
test al, al
je 0x1400799be
mov rcx, qword [rsi + 0x78]
call fcn.140127be0
test eax, eax
je 0x1400799be
or edx, 0xffffffff
lea rcx, [rsp + 0x38]
call fcn.140040930
nop
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.1400570e0
nop
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
test eax, eax
je 0x1400799aa
cmp eax, 0xffffffff
je 0x1400799b8
or eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1400799b8
mov rcx, qword [rsp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
or rax, 0xffffffffffffffff
jmp 0x1400799cc
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.140058bb0
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140079be0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
and dword [rbx + 0x40], 0xfdffffff
cmp dword [rbx + 0xa4], 2
je 0x140059309
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0xa4], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140079be0
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
cmp qword [rcx + 0x78], 0
jne 0x140079d09
cmp dword [rcx + 0xa0], 0xffffffff
jne 0x140079d09
cmp qword [rcx + 0x80], 0xffffffffffffffff
je 0x140079cfe
mov rdi, r8
mov qword [rax + 0x20], r8
xor r12d, r12d
mov ebx, r12d
mov qword [rax - 0x40], 0x2000000
nop word [rax + rax]
lea rax, [rsp + 0x98]
lea rcx, [rsp + 0x38]
cmp rdi, 0x2000000
cmovge rax, rcx
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x80]
mov r8d, dword [rax]
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140079cad
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x140079d04
add rbx, rax
sub rdi, rax
mov qword [rsp + 0x98], rdi
cmp rbx, rbp
jge 0x140079d04
jmp 0x140079c50
test rbx, rbx
jne 0x140079d04
or edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.140040790
nop
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r15
call fcn.1400570e0
nop
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x140079cf0
cmp eax, 0xffffffff
je 0x140079cfe
or eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140079cfe
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
or rax, 0xffffffffffffffff
jmp 0x140079d0e
mov rax, rbx
jmp 0x140079d0e
call fcn.140059330
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14007a360
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rdx
mov rdi, rcx
mov rax, qword [rcx + 8]
mov rsi, qword [rax + 0x80]
cmp rsi, 0xffffffffffffffff
jne 0x14007a4ea
cmp dword [rax + 0xa0], esi
jne 0x14007a4be
cmp qword [rax + 0x78], 0
jne 0x14007a4be
lea rcx, [rax + 0x20]
mov rax, qword [rcx]
cmp dword [rax + 4], 0
jne 0x14007a3c3
mov rax, qword [rcx + 8]
cmp dword [rax + 4], 0
je 0x14007a537
lea rdx, [rsp + 0x80]
call fcn.1400573f0
nop
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400134d0
nop
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx]
or esi, 0xffffffff
test eax, eax
je 0x14007a40c
cmp eax, esi
je 0x14007a41a
mov eax, esi
lock xadd dword [rcx], eax
mov rbx, qword [rsp + 0x78]
cmp eax, 1
jne 0x14007a41a
mov rcx, qword [rsp + 0x80]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
mov dword [rsp + 0x70], 3
mov edx, 3
lea rcx, [rsp + 0x28]
call fcn.140013fe0
test al, al
je 0x14007a4b2
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140014d70
movzx ebx, al
test al, al
jne 0x14007a4a0
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x28]
call fcn.140033260
nop
mov r8, rax
mov edx, 0xc
mov rcx, rdi
call fcn.1400570e0
nop
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx]
test eax, eax
je 0x14007a491
cmp eax, 0xffffffff
je 0x14007a4a0
lock xadd dword [rcx], esi
cmp esi, 1
jne 0x14007a4a0
mov rcx, qword [rsp + 0x88]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14002c3b0
nop
lea rcx, [rsp + 0x28]
call fcn.1400135a0
movzx eax, bl
jmp 0x14007a539
lea rcx, [rsp + 0x28]
call fcn.1400135a0
jmp 0x14007a537
cmp rsi, 0xffffffffffffffff
jne 0x14007a4ea
mov rcx, qword [rax + 0x78]
test rcx, rcx
je 0x14007a4d6
call fcn.14012a39c
mov ecx, eax
jmp 0x14007a4dc
mov ecx, dword [rax + 0xa0]
call fcn.140129c1c
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14007a537
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
mov rbp, rax
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
test al, al
je 0x14007a52b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14007a52b
mov rax, qword [rdi]
cmp rbp, rbx
cmovl rbx, rbp
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x38]
mov al, 1
jmp 0x14007a539
mov rax, qword [rdi]
mov rdx, rbp
mov rcx, rdi
call qword [rax + 0x38]
xor al, al
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400819e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x1f8], 0
mov rdi, rdx
mov rbx, rcx
je 0x140081a1a
mov rcx, qword [rcx + 0x1f8]
mov qword [rsp + 0x60], rdx
test rcx, rcx
je 0x140081ad1
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x10]
mov rax, qword [rdi + 0x40]
movzx ecx, byte [rdi + 0x20]
mov r9, qword [rdi + 0x18]
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x30], rax
mov eax, dword [rdi + 0x24]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbx + 0x120]
test eax, eax
setne dil
cmp rcx, 0xffffffffffffffff
je 0x140081a86
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x120], 0xffffffffffffffff
mov rcx, qword [rbx + 0x160]
cmp rcx, 0xffffffffffffffff
je 0x140081aa4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x160], 0xffffffffffffffff
mov rcx, qword [rbx + 0x198]
cmp rcx, 0xffffffffffffffff
je 0x140081ac2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x198], 0xffffffffffffffff
movzx eax, dil
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.1400f8ecc
int3