joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e7280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov esi, ecx
mov rdi, r9
lea rcx, str.powrprof.dll
mov r14d, r8d
mov ebp, edx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor r15d, r15d
cmp eax, 0xffffffff
je 0x1400e72f5
bt eax, 0xa
jae 0x1400e72f5
lea rcx, str.powrprof.dll
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e72e5
test al, 0x10
je 0x1400e72e5
lea rcx, str.powrprof.dll
call fcn.14012fc74
jmp 0x1400e72f1
lea rcx, str.powrprof.dll
call fcn.140114a3c
test eax, eax
jne 0x1400e7336
mov ecx, 0x18
call fcn.1401120e8
mov rbx, rax
test rax, rax
je 0x1400e7336
xorps xmm0, xmm0
lea rcx, str.powrprof.dll
xor eax, eax
xor edx, edx
movups xmmword [rbx], xmm0
mov r8d, 0x1000
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
jmp 0x1400e7339
mov rbx, r15
mov r9, rdi
lea r8, str.Intel_R__Innovation_Platform_Framework:
lea rdx, str._S_S
lea rcx, [rsp + 0x38]
call fcn.1400e9060
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov rdi, qword [rsp + 0x24]
test rbx, rbx
je 0x1400e74ad
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e7481
lea rdx, str.PowerReportLimitsEvent
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x1400e741c
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov rcx, qword [rbx]
mov dword [rbx + 8], eax
test rcx, rcx
je 0x1400e7481
lea rdx, str.PowerReportThermalEvent
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov r9, rax
test rax, rax
jne 0x1400e73c7
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
jmp 0x1400e7481
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x3c], 0x20
mov qword [rsp + 0x50], rdi
add ecx, 0x1f4
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x44], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x48], edx
jmp 0x1400e7474
imul ecx, ebp, 0x64
mov eax, 0x10624dd3
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x3c], 0x28
mov qword [rsp + 0x44], r15
add ecx, 0x1f4
mov qword [rsp + 0x58], rdi
mul ecx
imul ecx, r14d, 0x64
mov eax, 0x10624dd3
mov r8d, edx
shr r8d, 6
mov dword [rsp + 0x50], r8d
add ecx, 0x1f4
mul ecx
lea rcx, [rsp + 0x38]
shr edx, 6
mov dword [rsp + 0x4c], edx
mov rax, r9
mov dword [rsp + 0x40], esi
call qword [case.0x140059157.0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e748f
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.DLL_LocalFree]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov rcx, rbx
mov qword [rbx + 0x10], rax
call fcn.1401120d4
test rdi, rdi
je 0x1400e74ba
mov rcx, rdi
call fcn.1401120d4
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140102a00
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400e92f0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x30]
call fcn.140104310
lea rbp, [0x14017f5f4]
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [rsp + 0x20], rbp
lea r8, [0x14017f5f8]
mov ecx, 0x104
lea rdx, [rsp + 0x170]
call fcn.1400e9920
mov ecx, 0x110
call fcn.1401120e8
mov rbx, rax
test rax, rax
je 0x1400e937b
xor edx, edx
mov r8d, 0x110
mov rcx, rax
call fcn.140104310
test rbx, rbx
je 0x1400e94d0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x1400e94a7
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x5c]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x14017f5f8]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x20], rbp
mov ecx, 0x104
call fcn.1400e9920
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e9452
bt eax, 0xa
jae 0x1400e9452
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e9440
bt eax, 0xa
jae 0x1400e9440
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e9433
test al, 0x10
je 0x1400e9433
lea rcx, [rsp + 0x170]
call fcn.14012fc74
jmp 0x1400e9440
lea rcx, [rsp + 0x170]
call fcn.140114a3c
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x140
call fcn.140104310
cmp byte [rsp + 0x5c], 0
jne 0x1400e9476
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x1400e93b0
cmp byte [rsp + 0x5c], 0
je 0x1400e94ae
lea rcx, [rbx + 8]
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x104
call fcn.1401121b8
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov rcx, rsi
call fcn.1401121b8
cmp byte [rsp + 0x5c], 0
jne 0x1400e94d0
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x1400e94c4
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov qword [rbx], 0xffffffffffffffff
mov rcx, rbx
call fcn.1401120d4
xor eax, eax
jmp 0x1400e94d3
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140102a00
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e9500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e9558
bt eax, 0xa
jae 0x1400e9558
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e9545
test al, 0x10
je 0x1400e9545
mov rcx, rbx
call fcn.14012fc74
jmp 0x1400e954d
mov rcx, rbx
call fcn.140114a3c
test eax, eax
je 0x1400e9558
mov ecx, 0x1f
jmp 0x1400e9567
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14012f72c
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140102a00
add rsp, 0x60
pop rbx
ret

Function at 0x1400e9590
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rbx, r8
mov qword [rsp + 0x20], rbp
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e9606
bt eax, 0xa
jae 0x1400e9606
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e95e8
test al, 0x10
je 0x1400e95e8
mov rcx, rdi
call fcn.14012fc74
jmp 0x1400e95f0
mov rcx, rdi
call fcn.140114a3c
test eax, eax
je 0x1400e9606
test rbx, rbx
je 0x1400e95ff
mov dword [rbx], 0x1f
xor eax, eax
jmp 0x1400e96ae
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov r9, 0xffffffffffffffff
mov r8, rsi
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [r9 + 0x21]
call fcn.1401121b8
lea rdx, [0x14017fe68]
mov rcx, rsi
call fcn.140131020
test rax, rax
je 0x1400e9687
mov edx, 0x63
mov rcx, rsi
call fcn.1401044b0
test rax, rax
jne 0x1400e9687
lea edx, [rax + 0x20]
lea rcx, [rsp + 0x28]
call fcn.14012c6b8
cmp rax, 0x20
jne 0x1400e966b
mov byte [rsp + 0x47], bpl
jmp 0x1400e9687
mov r9, 0xffffffffffffffff
lea r8, [0x14017fe6c]
lea rcx, [rsp + 0x28]
lea edx, [r9 + 0x21]
call fcn.140143244
lea r8, [rsp + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140143614
mov rcx, qword [rsp + 0x20]
test rbx, rbx
je 0x1400e96ab
test rcx, rcx
cmovne eax, ebp
mov dword [rbx], eax
mov rax, rcx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140102a00
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e96d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x160], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e9743
bt eax, 0xa
jae 0x1400e9743
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e972d
test al, 0x10
je 0x1400e972d
mov rcx, rdi
call fcn.14012fc74
jmp 0x1400e9735
mov rcx, rdi
call fcn.140114a3c
test eax, eax
je 0x1400e9743
mov eax, 0x1f
jmp 0x1400e98b7
mov rcx, rdi
mov qword [rsp + 0x188], rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e9787
bt eax, 0xa
jae 0x1400e9787
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e977b
test al, 0x10
je 0x1400e977b
mov rcx, rdi
call fcn.14012fc74
jmp 0x1400e9783
mov rcx, rdi
call fcn.140114a3c
test eax, eax
jne 0x1400e979e
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14012f72c
mov ebx, eax
test eax, eax
je 0x1400e98ad
test rdi, rdi
jne 0x1400e97a7
xor ebx, ebx
jmp 0x1400e97b7
mov edx, 0x104
mov rcx, rdi
call fcn.14012c6b8
mov rbx, rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.140104310
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
mov r8, rdi
mov edx, 0x104
call fcn.1401121b8
lea rcx, [rbx - 2]
cmp rcx, 0x102
ja 0x1400e980b
cmp byte [rsp + rbx + 0x4f], 0x5c
jne 0x1400e980b
dec rbx
cmp rbx, 0x104
jae 0x1400e98d0
mov byte [rsp + rbx + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e984f
bt eax, 0xa
jae 0x1400e984f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e9841
test al, 0x10
je 0x1400e9841
lea rcx, [rsp + 0x50]
call fcn.14012fc74
jmp 0x1400e984b
lea rcx, [rsp + 0x50]
call fcn.140114a3c
test eax, eax
jne 0x1400e9864
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.14012f72c
mov ebx, eax
test eax, eax
je 0x1400e98ad
lea rcx, [rsp + 0x50]
call fcn.14012f9f0
mov ebx, eax
test eax, eax
je 0x1400e98ad
mov edx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.140104a18
mov rdi, rax
test rax, rax
je 0x1400e98ad
lea rcx, [rsp + 0x50]
mov byte [rax], 0
call fcn.1400e96d0
mov ebx, eax
test eax, eax
jne 0x1400e98ad
lea rcx, [rsp + 0x50]
mov byte [rdi], 0x5c
call fcn.14012f9f0
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140102a00
add rsp, 0x170
pop rdi
ret
call fcn.140102b64
int3
Function at 0x1400e99a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x80
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor dil, dil
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400e9b27
test rdx, rdx
je 0x1400e9b27
xorps xmm0, xmm0
mov edx, 0x100
mov rcx, rbp
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call fcn.140041550
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e9a34
bt eax, 0xa
jae 0x1400e9a34
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400e9a24
test al, 0x10
je 0x1400e9a24
mov rcx, rbx
call fcn.14012fc74
jmp 0x1400e9a2c
mov rcx, rbx
call fcn.140114a3c
test eax, eax
jne 0x1400e9b1f
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14012f72c
test eax, eax
jne 0x1400e9b1f
mov ecx, dword [rsp + 0x44]
test ecx, ecx
jle 0x1400e9b1f
mov eax, 0x1000
mov qword [rsp + 0xb0], rsi
cmp ecx, eax
mov qword [rsp + 0x78], r14
cmovle eax, ecx
movsxd r14, eax
mov rcx, r14
call fcn.1400e98e0
mov rsi, rax
test rax, rax
je 0x1400e9b12
xor r8d, r8d
mov qword [rsp + 0x70], r15
lea rdx, [0x14017f874]
mov rcx, rbx
call fcn.1400e9590
mov r15, rax
test rax, rax
je 0x1400e9b05
movsxd rdi, dword [rsp + 0x44]
test rdi, rdi
je 0x1400e9aee
nop dword [rax]
cmp rdi, r14
mov qword [rsp + 0x20], r15
mov rbx, r14
mov r8d, 1
cmovbe rbx, rdi
mov rdx, r14
mov r9, rbx
mov rcx, rsi
call fcn.140143954
cmp rax, rbx
jne 0x1400e9aee
mov r8, rax
mov rdx, rsi
mov rcx, rbp
sub rdi, rax
call fcn.140041630
test rdi, rdi
jne 0x1400e9ab0
mov rcx, r15
call fcn.140144160
mov rcx, r15
call fcn.140143b14
test rdi, rdi
sete dil
mov rcx, rsi
call fcn.1401120d4
mov r15, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x78]
mov rcx, rbp
call fcn.140041360
movzx eax, dil
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140102a00
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400e9d70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x240
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.140104310
xorps xmm0, xmm0
mov dword [rbx], 9
mov edx, 0x104
lea rcx, [rsp + 0x20]
movups xmmword [rbx + 4], xmm0
call qword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov r14d, eax
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400e9e7d
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x258], rdi
mov qword [rsp + 0x260], r15
lfence
lea ecx, [rax + 1]
lea rsi, [rcx + rcx]
mov r15d, ecx
mov rcx, rsi
call fcn.1401120e8
mov rdi, rax
test rax, rax
je 0x1400e9e16
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.140104310
mov rsi, qword [rsp + 0x250]
test rdi, rdi
mov qword [rbx + 4], rdi
mov rdi, qword [rsp + 0x258]
je 0x1400e9e50
lfence
mov rcx, qword [rbx + 4]
lea r8, [rsp + 0x20]
mov rdx, r15
call fcn.14014a538
lea ecx, [r14 + r14]
lea eax, [rcx + 2]
mov dword [rbx + 0x10], ecx
mov dword [rbx + 0xc], eax
mov r15, qword [rsp + 0x260]
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140102a00
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop r14
ret
mov rax, rbx
jmp 0x1400e9e5b
Function at 0x1400ef1c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rdi
sub rsp, 0x270
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 0xf]
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov rdi, rax
mov qword [rsp + 0x20], 0x238
xor eax, eax
lea rcx, [rsp + 0x4c]
xor edx, edx
mov dword [rsp + 0x28], eax
mov r8d, 0x20c
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
call fcn.140104310
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x1400ef29a
mov qword [rsp + 0x280], rbx
nop word [rax + rax]
lea rdx, str.ipf_helper.exe
lea rcx, [rsp + 0x4c]
call fcn.14014a5e0
test eax, eax
jne 0x1400ef281
mov r8d, dword [rsp + 0x28]
lea ecx, [rax + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400ef281
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x1400ef240
mov rbx, qword [rsp + 0x280]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140102a00
add rsp, 0x270
pop rdi
ret
Function at 0x1400f1a70
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov ebx, 1
mov byte [rsp + 0x2e], 0xd
mov ecx, 0xfffffff6
mov word [rsp + 0x20], bx
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
lea r9, [rsp + 0x38]
mov r8d, ebx
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_WriteConsoleInputW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140102a00
add rsp, 0x50
pop rbx
ret
Function at 0x1400f1ae0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r12
push r14
sub rsp, 0xd0
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor eax, eax
mov r12, r8
mov dword [rsp + 0x54], eax
mov rdi, rdx
mov qword [r11 - 0x64], rax
xor ebx, ebx
mov dword [r11 - 0x5c], eax
call qword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov rcx, qword [rdi]
mov rsi, rax
test rcx, rcx
jne 0x1400f1b2e
mov ecx, ebx
jmp 0x1400f1b3b
mov edx, 0x1fff
call fcn.14012c934
mov rcx, rax
cmp word [rsi], 0x22
lea rax, [rcx + 2]
mov rdx, qword [rdi + 8]
cmovne rax, rcx
lea rcx, [rsi + rax*2]
call fcn.140105f00
mov r14, rax
test rax, rax
jne 0x1400f1b75
lea rdx, str.Unable_to_parse_command_line._n
lea ecx, [rax + 3]
call fcn.140046fa0
mov eax, 0x708
jmp 0x1400f1d2c
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x100], rbp
mov qword [rsp + 0x118], r15
test rcx, rcx
jne 0x1400f1b93
mov rax, rbx
jmp 0x1400f1b9d
mov edx, 0x1fff
call fcn.14012c934
mov edx, 0x1fff
lea r15, [r14 + rax*2]
mov rcx, rsi
call fcn.14012c934
mov rcx, qword [rdi + 8]
lea rsi, [rax + 1]
test rcx, rcx
jne 0x1400f1bc0
mov rax, rbx
jmp 0x1400f1bca
mov edx, 0x1fff
call fcn.14012c934
mov edx, 0x1fff
lea rcx, str.server__i
sub rsi, rax
call fcn.14012c934
lea r14, [rax + 2]
add r14, rsi
lea rbp, [r14 + r14]
mov rcx, rbp
call fcn.1401120e8
mov rsi, rax
test rax, rax
je 0x1400f1d06
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.140104310
mov r8, rbp
xor edx, edx
mov rcx, rsi
call fcn.140104310
mov r8, qword [rdi]
mov eax, 0x22
mov rdx, r14
mov word [rsi], ax
mov rcx, rsi
call fcn.14014a89c
lea r8, [0x140235334]
mov rdx, r14
mov rcx, rsi
call fcn.14014a89c
lea r8, [0x140235338]
mov rdx, r14
mov rcx, rsi
call fcn.14014a89c
mov r8, r15
mov rdx, r14
mov rcx, rsi
call fcn.14014a89c
mov qword [rsp + 0x48], r12
lea rax, [0x14022f1c8]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0x68
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov rdx, rsi
mov dword [rsp + 0x28], 0x8000000
xor ecx, ecx
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x88], ebx
mov qword [rsp + 0x8c], 1
mov qword [rsp + 0x58], rbx
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
mov ecx, 0x3eb
cmove ebx, ecx
mov rcx, rsi
call fcn.1401120d4
mov eax, ebx
jmp 0x1400f1d1c
lea rdx, str.Unable_to_allocate_memory._n
mov ecx, 3
call fcn.140046fa0
mov eax, 0x708
mov rbp, qword [rsp + 0x100]
mov r15, qword [rsp + 0x118]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140102a00
add rsp, 0xd0
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f2e00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400f2e57
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x1400f2e57
call fcn.1400f4920
test eax, eax
je 0x1400f2e57
cmp qword [rbx + 0x270], 0
je 0x1400f2e57
mov rcx, qword [rbx + 0x28]
mov r8d, edi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400f4aa0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f4930
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x1400f4963
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
jmp 0x1400f49ec
test rdx, rdx
jne 0x1400f4975
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
jmp 0x1400f49ec
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + 0x208]
cmp dword [rbx + 0x218], edi
jne 0x1400f4996
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
jmp 0x1400f49ec
mov qword [rsp + 0x40], rsi
lea rsi, [rbx + 0x228]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
mov qword [rbx + 0x230], rdi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov edi, eax
test eax, eax
jne 0x1400f49e7
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x1400f49e5
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
jmp 0x1400f49e7
mov eax, edi
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140102a00
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x1400f4aa0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x14027df48]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x210], edi
jne 0x1400f4ad3
lea ecx, [rdi + 0x15]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
jmp 0x1400f4b5c
test rdx, rdx
jne 0x1400f4ae5
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
jmp 0x1400f4b5c
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + 0x208]
cmp dword [rbx + 0x218], edi
jne 0x1400f4b06
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.DLL_WriteFile]
jmp 0x1400f4b5c
mov qword [rsp + 0x40], rsi
lea rsi, [rbx + 0x250]
mov qword [rsi], rdi
mov qword [rsp + 0x20], rsi
mov qword [rbx + 0x258], rdi
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov edi, eax
test eax, eax
jne 0x1400f4b57
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x3e5
jne 0x1400f4b55
mov rcx, qword [rbx + 0x208]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
jmp 0x1400f4b57
mov eax, edi
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140102a00
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x1400f4d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x1400f4dbf
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400f4dbf
bt eax, 0xa
jae 0x1400f4dbf
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400f4daf
test al, 0x10
je 0x1400f4daf
mov rcx, rdi
call fcn.14012fc74
jmp 0x1400f4db7
mov rcx, rdi
call fcn.140114a3c
test eax, eax
jne 0x1400f4e44
mov ecx, 0x18
call fcn.1401120e8
mov rbx, rax
test rax, rax
je 0x1400f4e44
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
test rdi, rdi
je 0x1400f4e0d
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8, rbx
lea rdx, [fcn.1400f4d70]
mov ecx, 4
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleExA]
test eax, eax
jne 0x1400f4e2d
mov qword [rbx], 0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbx + 8], eax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret