joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024680
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x100f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbx
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x34], eax
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
xor ebx, ebx
mov dword [rsp + 0x1078], edi
mov r8d, 0xa098
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a100]
mov r8d, 0x10018
mov dword [rsp + 0x1a100], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140024790
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8d, edi
mov rcx, rax
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x1400247d0
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0xa080
lea rcx, [rsp + 0x48]
mov rsi, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x1004
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x1a130]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], edi
test rsi, rsi
je 0x140024834
mov eax, dword [rsi]
mov dword [rsp + 0x48], eax
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a120]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rsp + 0x1a120], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a118]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400247d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8d, edi
mov rcx, rax
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x1400247d0
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0xa080
lea rcx, [rsp + 0x48]
mov rsi, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x1004
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x1a130]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], edi
test rsi, rsi
je 0x140024834
mov eax, dword [rsi]
mov dword [rsp + 0x48], eax
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a120]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rsp + 0x1a120], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a118]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140024a20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov ebx, r9d
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9d, ebx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.140024a60

Function at 0x140024a60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov esi, r9d
call fcn.140249b10
mov dword [rsp + 0x30], 0x1061
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbx
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x34], eax
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a120]
xor ebx, ebx
mov dword [rsp + 0x1078], edi
mov r8d, 0xa098
mov dword [rsp + 0x1a120], ebx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x107c], esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a128]
mov r8d, 0x10018
mov dword [rsp + 0x1a128], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140024bc0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
call fcn.1400143a0
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140024bf0
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x1058
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
ret

Function at 0x140024bf0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
call fcn.1400143a0
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140024bf0
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x1058
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
ret
Function at 0x140024cf0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov edi, edx
call fcn.1400143a0
mov r8, rbx
mov edx, edi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140024d20
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, r8
mov rdi, rcx
mov r8d, 0xa08c
lea rcx, [rsp + 0x3c]
xor edx, edx
call fcn.140249b10
mov dword [rsp + 0x30], 0x1062
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x38], eax
test rbx, rbx
je 0x140024d80
mov r8d, 0xff
lea rcx, [rsp + 0x3c]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a108]
add rsp, 0x1a0f0
pop rdi
ret

Function at 0x140024d20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov edi, edx
call fcn.1400143a0
mov r8, rbx
mov edx, edi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140024d20
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, r8
mov rdi, rcx
mov r8d, 0xa08c
lea rcx, [rsp + 0x3c]
xor edx, edx
call fcn.140249b10
mov dword [rsp + 0x30], 0x1062
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x38], eax
test rbx, rbx
je 0x140024d80
mov r8d, 0xff
lea rcx, [rsp + 0x3c]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a108]
add rsp, 0x1a0f0
pop rdi
ret
Function at 0x140025130
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.1400143a0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1400251d0
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x1040
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
ret

Function at 0x140025190
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400251d0

Function at 0x1400251d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.1400143a0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x1400251d0
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x1040
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
ret
Function at 0x140025340
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
call fcn.1400143a0
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140025370
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x1046
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a110], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a100]
mov r8d, 0x10018
mov dword [rsp + 0x1a100], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140025370
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
call fcn.1400143a0
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140025370
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x1046
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a110], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a100]
mov r8d, 0x10018
mov dword [rsp + 0x1a100], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140025480
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov esi, edx
call fcn.1400143a0
mov r9, rbx
mov r8, rdi
mov edx, esi
mov rcx, rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x1400254c0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rdi, r8
mov ebx, edx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov rbp, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x1048
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov dword [rsp + 0x34], eax
lea rdx, [rsp + 0x30]
mov rax, qword [rsp + 0x1a130]
mov r8d, 0xa098
mov dword [rsp + 0x38], ebx
xor ebx, ebx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x1a118], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r9d, dword [rsp + 0xa0dc]
test r9d, r9d
je 0x1400255af
mov rdx, qword [rsi + 0x10]
lea rax, [rsp + 0x1a130]
mov r8, rbp
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.14001e4f0
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x1a138]
test rcx, rcx
je 0x1400255d3
mov eax, dword [rsp + 0xa0dc]
mov qword [rcx], rax
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400254c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov esi, edx
call fcn.1400143a0
mov r9, rbx
mov r8, rdi
mov edx, esi
mov rcx, rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x1400254c0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rdi, r8
mov ebx, edx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov rbp, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x1048
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov dword [rsp + 0x34], eax
lea rdx, [rsp + 0x30]
mov rax, qword [rsp + 0x1a130]
mov r8d, 0xa098
mov dword [rsp + 0x38], ebx
xor ebx, ebx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x1a118], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r9d, dword [rsp + 0xa0dc]
test r9d, r9d
je 0x1400255af
mov rdx, qword [rsi + 0x10]
lea rax, [rsp + 0x1a130]
mov r8, rbp
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.14001e4f0
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x1a138]
test rcx, rcx
je 0x1400255d3
mov eax, dword [rsp + 0xa0dc]
mov qword [rcx], rax
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400256b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
mov ebx, eax
call fcn.140249b10
lea rcx, [rsp + 0x3c]
mov dword [rsp + 0x30], 0x103a
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov dword [rsp + 0x38], ebx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
ret
Function at 0x140025780
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.1400143a0
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x1400258a0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1a100
call fcn.140247340
sub rsp, rax
mov ebx, r9d
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
test r9d, r9d
jne 0x1400258d5
xor eax, eax
jmp 0x1400259aa
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0xa098
call fcn.140249b10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a128]
mov qword [rsp + 0x48], rbp
lea rdx, [rsp + 0x40]
xor ebp, ebp
mov dword [rsp + 0x44], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a128], ebp
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x1005
mov dword [rsp + 0x50], ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a128]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0e0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x30]
mov r8d, 0x10018
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0xa0e0]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x1a130]
mov eax, dword [rsp + 0xa0ec]
mov dword [rcx], eax
mov ecx, dword [rsp + 0xa0e0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0e8]
lea r11, [rsp + 0x1a100]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret