joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140087820
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x140122110], 0
jne 0x140087a17
lea rcx, str.advapi32.dll
mov byte [0x140122110], 1
call fcn.140082e60
mov qword [0x140122118], rax
test rax, rax
je 0x140087a0a
lea rdx, str.GetSecurityInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140123418], rax
test rax, rax
je 0x140087a0a
mov rcx, qword [0x140122118]
test rcx, rcx
je 0x1400879ff
lea rdx, str.SetSecurityInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140123410], rax
test rax, rax
je 0x140087a0a
mov rcx, qword [0x140122118]
test rcx, rcx
je 0x1400879e7
lea rdx, str.OpenProcessToken
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140123438], rax
test rax, rax
je 0x140087a0a
mov rcx, qword [0x140122118]
test rcx, rcx
je 0x1400879cf
lea rdx, str.GetTokenInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140123430], rax
test rax, rax
je 0x140087a0a
mov rcx, qword [0x140122118]
test rcx, rcx
je 0x1400879b7
lea rdx, [0x1400ccee0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140123428], rax
test rax, rax
je 0x140087a0a
mov rcx, qword [0x140122118]
test rcx, rcx
je 0x14008799f
lea rdx, [0x1400ccf00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140123420], rax
test rax, rax
je 0x140087a0a
mov rcx, qword [0x140122118]
test rcx, rcx
je 0x140087987
lea rdx, str.SetEntriesInAclA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140123408], rax
test rax, rax
je 0x140087a0a
mov al, 1
mov byte [0x140122111], al
add rsp, 0x28
ret
xor al, al
mov qword [0x140123408], 0
mov byte [0x140122111], al
add rsp, 0x28
ret
xor al, al
mov qword [0x140123420], 0
mov byte [0x140122111], al
add rsp, 0x28
ret
xor al, al
mov qword [0x140123428], 0
mov byte [0x140122111], al
add rsp, 0x28
ret
xor al, al
mov qword [0x140123430], 0
mov byte [0x140122111], al
add rsp, 0x28
ret
xor al, al
mov qword [0x140123438], 0
mov byte [0x140122111], al
add rsp, 0x28
ret
mov qword [0x140123410], 0
xor al, al
mov byte [0x140122111], al
add rsp, 0x28
ret
movzx eax, byte [0x140122111]
add rsp, 0x28
ret
Function at 0x140088b60
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
xor r8d, r8d
mov rdx, rcx
jmp fcn.140089620

Function at 0x140088b70
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ecx, ecx
call fcn.1400888d0
call fcn.140081fc0
lea r8, [rsp + 0x20]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareSimonTathamPuTTY
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140088bc7
mov rcx, qword [rsp + 0x20]
call fcn.1400894a0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x20]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareSimonTatham
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140088c6d
mov rcx, qword [rsp + 0x20]
lea rdx, [0x1400b0ce8]
mov qword [rsp + 0x150], rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rcx, qword [rsp + 0x20]
lea r8, [rsp + 0x30]
mov r9d, 0x105
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x150]
je 0x140088c6d
lea r8, [rsp + 0x20]
mov rcx, 0xffffffff80000001
lea rdx, str.Software
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140088c6d
mov rcx, qword [rsp + 0x20]
lea rdx, str.SimonTatham
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14008ce70
add rsp, 0x158
ret

Function at 0x140088ce0
Capabilities:
Delete registry key

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareSimonTathamPuTTYSessions
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140088d4c
mov qword [rsp + 0x30], rbx
call fcn.14006d0e0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.1400828b0
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rcx, rbx
call fcn.14006d0a0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.1400822b0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140088d60
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor r8d, r8d
mov qword [rsp + 0x40], 0x105
mov rbp, rdx
mov rdi, rcx
mov ecx, 0x105
lea edx, [r8 + 1]
call fcn.140012100
mov r9d, dword [rsp + 0x40]
mov r8, rax
mov edx, dword [rdi + 8]
mov rbx, rax
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0xea
jne 0x140088e04
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rsp + 0x40]
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x28], 0
mov r8d, 1
mov rcx, rbx
mov qword [rsp + 0x20], 1
call fcn.140012000
mov r9d, dword [rsp + 0x40]
mov r8, rax
mov edx, dword [rdi + 8]
mov rbx, rax
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0xea
je 0x140088dc0
test eax, eax
sete sil
test eax, eax
jne 0x140088e19
mov rdx, rbp
mov rcx, rbx
call fcn.1400830a0
inc dword [rdi + 8]
mov rcx, rbx
call fcn.140011ff0
mov rbx, qword [rsp + 0x48]
movzx eax, sil
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140089120
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
mov ecx, 1
call fcn.1400888d0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400891c3
mov qword [rsp + 0x468], rsi
lea r9, [rsp + 0x30]
xor esi, esi
lea rdx, [rsp + 0x40]
mov r8d, 0x400
mov qword [rsp + 0x20], rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400891b2
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x1400891b2
lea rcx, [rsp + 0x40]
call rdi
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
mov r8d, 0x400
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140089181
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14008ce70
mov rbx, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
ret

Function at 0x140089360
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov dword [rsp + 0x50], 4
mov ebx, r8d
test rcx, rcx
je 0x1400893b1
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400893b1
cmp dword [rsp + 0x50], 4
jne 0x1400893b1
cmp dword [rsp + 0x68], 4
mov eax, dword [rsp + 0x30]
je 0x1400893b3
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x1400893c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x140089488
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140089488
cmp dword [rsp + 0x40], 1
jne 0x140089488
mov ecx, dword [rsp + 0x50]
lea edx, [rax + 1]
inc ecx
mov qword [rsp + 0x48], rbx
xor r8d, r8d
call fcn.140012100
mov rcx, qword [rdi]
lea r9, [rsp + 0x40]
mov rbx, rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14008946e
cmp dword [rsp + 0x40], 1
jne 0x14008946e
mov eax, dword [rsp + 0x50]
mov byte [rax + rbx], 0
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rbx
call fcn.140011ff0
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1400894a0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r9d, 0x105
lea r8, [rsp + 0x30]
xor edx, edx
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x140089534
nop word [rax + rax]
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x14008950c
mov rcx, qword [rsp + 0x20]
call fcn.1400894a0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov r9d, 0x105
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1400894e0
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14008ce70
add rsp, 0x150
pop rbx
ret

Function at 0x140089550
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
jmp fcn.140089620
Function at 0x140089560
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rbp, r9
mov rbx, r8
mov edi, edx
mov rsi, rcx
call fcn.14006d0e0
mov r9, rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov r14, rax
call fcn.140088ef0
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareSimonTathamPuTTYSshHostKeys
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1400895f8
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rax + rbp], 0
jne 0x1400895c2
mov rdx, qword [r14]
inc eax
mov rcx, qword [rsp + 0x30]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r14
call fcn.14006d0a0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140089980
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
mov rbx, rcx
test edx, edx
jne 0x1400899dc
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400899c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400899c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140083130
mov r8, rax
lea rcx, str.Unable_to_delete__s:__s
mov rdx, rbx
call fcn.14007e790
mov qword [rdi], 0xffffffffffffffff
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
xor r11d, r11d
mov eax, 0x80
cmp edx, 2
mov qword [rsp + 0x30], r11
mov ecx, r11d
mov r8d, 3
cmove ecx, eax
mov r10d, 0x40000000
mov eax, r11d
mov dword [rsp + 0x28], ecx
setne al
mov rcx, rbx
add eax, 2
cmp edx, 2
mov dword [rsp + 0x20], eax
mov edx, 0x80000000
cmove r8d, r11d
cmove edx, r10d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, qword [rsp + 0x50]
cmp rax, 0xffffffffffffffff
mov qword [rdi], rax
setne al
add rsp, 0x40
pop rdi
ret
Function at 0x140089da0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov edi, edx
mov ecx, 2
call fcn.1400888d0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140089ded
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140089ed0
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x140089f06
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x38
ret

Function at 0x140089f10
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x140089f47
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x140089f20
mov rcx, qword [rcx]
inc eax
mov dword [rsp + 0x28], eax
mov r9d, 1
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x38
ret

Function at 0x14008b0b0
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x140
mov rax, qword [0x14011e258]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor ebp, ebp
movzx esi, r8b
movzx r14d, r9b
mov rdi, rdx
mov rbx, rcx
test r8b, r8b
je 0x14008b106
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
dec eax
cmp eax, 0x102
cmova esi, ebp
mov dword [rdi], 0x88
test rbx, rbx
je 0x14008b119
cmp byte [rbx], bpl
je 0x14008b119
mov rbp, rbx
mov qword [rdi + 0x50], rbp
mov rcx, rdi
test r14b, r14b
je 0x14008b12d
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
jmp 0x14008b133
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
test eax, eax
setne dil
test rbx, rbx
je 0x14008b158
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
dec eax
cmp eax, 0x102
jbe 0x14008b158
mov byte [rbx], 0
test sil, sil
je 0x14008b168
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
movzx eax, dil
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14008ce70
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14009d378
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14009d1d7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009d1d7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009d1d7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009d1d7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009d1d7
cmp dword [rcx + 0x84], 0xe
jbe 0x14009d1d7
cmp dword [rcx + 0xf8], 0
je 0x14009d1d7
mov ecx, ebx
call fcn.14009d294
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14009d064
nop
cmp dword [rbp + 0x20], 0
je 0x14009d225
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14009d230
int3
xor r8d, r8d
xor edx, edx
jmp 0x14009d168
Function at 0x1400a00e0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x140122a90]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1400a013e
cmp word [rdx], r12w
jne 0x1400a013e
or byte [rax + r8*8 + 0x38], cl
jmp 0x1400a0144
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x1400a029f
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x1400a027a
lea r9, [rcx + 2]
cmp ax, r13w
je 0x1400a017d
mov rcx, r9
jmp 0x1400a01a0
cmp r9, rdx
jae 0x1400a01b7
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x1400a0161
jmp 0x1400a029f
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a0274
cmp dword [rsp + 0x80], edi
je 0x1400a0274
mov rdx, r14
lea r11, [0x140122a90]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x1400a024d
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x1400a0220
mov word [rbx], r12w
jmp 0x1400a029b
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x1400a0229
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x1400a029b
cmp word [rsp + 0x70], r12w
jne 0x1400a025a
cmp rbx, rsi
je 0x1400a021a
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.1400a5c38
cmp word [rsp + 0x70], r12w
je 0x1400a029f
mov word [rbx], r13w
jmp 0x1400a029b
lea r11, [0x140122a90]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x1400a0297
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1400a029f
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a0af4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x1400a0b26
call fcn.14009c870
mov dword [rax], 0x16
call fcn.14009f02c
jmp 0x1400a0c45
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400a0c45
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400a0c45
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400a0b55
lock or dword [rcx + 0x14], 0x10
jmp 0x1400a0c45
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400a0b69
call fcn.1400ab084
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14009f094
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.1400a058c
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1400a0c33
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x1400a0bfe
mov rcx, rsi
call fcn.14009f094
cmp eax, edi
je 0x1400a0be9
mov rcx, rsi
call fcn.14009f094
cmp eax, 0xfffffffe
je 0x1400a0be9
mov rcx, rsi
call fcn.14009f094
movsxd rbx, eax
lea r14, [0x140122a90]
mov rcx, rsi
sar rbx, 6
call fcn.14009f094
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1400a0bf0
lea rdx, [0x14011e640]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400a0bfe
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x1400a0c22
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x1400a0c22
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x1400a0c22
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x1400a0c48
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x1400a9a18
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400a9a48
xor eax, eax
jmp 0x1400a9b0b
mov rbp, rbx
cmp word [rax], si
je 0x1400a9a6d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400a9a54
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400a9a50
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400a3cd8
movsxd r14, eax
test eax, eax
jne 0x1400a9aab
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400a9a41
mov rcx, r14
call fcn.1400a0e84
mov rdi, rax
test rax, rax
jne 0x1400a9ac4
xor ecx, ecx
call fcn.14009ec68
jmp 0x1400a9aa0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400a3cd8
test eax, eax
jne 0x1400a9af5
mov rcx, rdi
call fcn.14009ec68
jmp 0x1400a9aff
xor ecx, ecx
call fcn.14009ec68
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400a9b28
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400a9baf
mov rsi, rbx
cmp word [rax], bp
je 0x1400a9b6e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400a9b58
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400a9b54
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400a0e84
mov rdi, rax
test rax, rax
je 0x1400a9b9c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14008dc80
mov rbp, rdi
xor ecx, ecx
call fcn.14009ec68
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400aca38
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400a5c38
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400a5c38
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400acb88
cmp rax, 0xffffffffffffffff
je 0x1400acb88
xor edi, edi
test rbp, rbp
jle 0x1400acb33
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400a5950
mov rbx, rax
test rax, rax
jne 0x1400acac0
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400acb29
mov edx, 0x8000
mov ecx, r14d
call fcn.14009e41c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400a337c
cmp eax, 0xffffffff
je 0x1400acb09
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400acad0
mov edx, r15d
mov ecx, r14d
call fcn.14009e41c
jmp 0x1400acb29
cmp byte [rsi + 0x38], dil
je 0x1400acb20
cmp dword [rsi + 0x34], 5
jne 0x1400acb20
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400acb29
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14009ec68
jmp 0x1400acb9c
jns 0x1400acb9c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400a5c38
cmp rax, 0xffffffffffffffff
jne 0x1400acb54
cmp byte [rsi + 0x30], dil
je 0x1400acb9c
mov edi, dword [rsi + 0x2c]
jmp 0x1400acb9c
mov ecx, r14d
call fcn.1400a71f8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400acb9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400acb9c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400acb95
mov eax, dword [rsi + 0x2c]
jmp 0x1400acb9a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400a5c38
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret