joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002997c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001cf74
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001cf74
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140029acc
cmp rax, 0xffffffffffffffff
je 0x140029acc
xor edi, edi
test rbp, rbp
jle 0x140029a77
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f888
mov rbx, rax
test rax, rax
jne 0x140029a04
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140029a6d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a8a8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001dc50
cmp eax, 0xffffffff
je 0x140029a4d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029a14
mov edx, r15d
mov ecx, r14d
call fcn.14001a8a8
jmp 0x140029a6d
cmp byte [rsi + 0x38], dil
je 0x140029a64
cmp dword [rsi + 0x34], 5
jne 0x140029a64
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140029a6d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b63c
jmp 0x140029ae0
jns 0x140029ae0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001cf74
cmp rax, 0xffffffffffffffff
jne 0x140029a98
cmp byte [rsi + 0x30], dil
je 0x140029ae0
mov edi, dword [rsi + 0x2c]
jmp 0x140029ae0
mov ecx, r14d
call fcn.140018d60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029ae0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029ae0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029ad9
mov eax, dword [rsi + 0x2c]
jmp 0x140029ade
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001cf74
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14000b0e0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14000b10e
xor eax, eax
jmp 0x14000b1f4
cmp qword [rcx + 0x68], 0
je 0x14000b11f
call fcn.14000b210
jmp 0x14000b1f4
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b136
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000b138
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000b16a
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14000faf0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14000b1ee
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14000b1a1
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14000b1ca
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140016c30
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14000b1ee
cmp rsi, rbx
ja 0x14000b1a8
test rsi, rsi
je 0x14000b1ee
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140016c30
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000b2d4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000b303
call fcn.14000b394
jmp 0x14000b37a
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14000b31a
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000b31c
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000b374
test ecx, ecx
jle 0x14000b355
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call fcn.14000faf0
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000b374
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000b374
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.140017190
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14000c468
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x140047020]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14000c4ac
movzx eax, r14w
jmp 0x14000c5e1
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14000c4e8
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x14000c4e8
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14000c5e1
cmp qword [rcx + 0x80], r14
je 0x14000c5de
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000c526
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000c54f
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140017bfc
cmp ax, di
je 0x14000c5de
movzx edi, si
jmp 0x14000c5de
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x140032360]
test eax, eax
je 0x14000c5a4
sub eax, 1
je 0x14000c5a4
cmp eax, 2
jne 0x14000c5de
movzx ecx, word [rbp + 7]
jmp 0x14000c532
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x14000c5ce
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.140017190
cmp r14, rax
jne 0x14000c5de
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
cmovne di, si
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14000da70
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x14000e6d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e71a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000e71a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000e71a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000e71a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000e71a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000e71c
xor al, al
add rsp, 0x28
ret

Function at 0x14001be58
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001bc84
Function at 0x1400243e0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140024106
call fcn.140015fc4
mov dword [rax], 0x16
call fcn.140015e74
jmp 0x140024251
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140024251
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140024251
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140024135
lock or dword [rcx + 0x14], 0x10
jmp 0x140024251
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140024149
call fcn.1400258fc
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140024159
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14002415c
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.140020964
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1400251ec
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14002423f
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1400241ed
mov rcx, rbx
call fcn.140020964
cmp eax, 0xffffffff
je 0x1400241d8
mov rcx, rbx
call fcn.140020964
cmp eax, 0xfffffffe
je 0x1400241d8
mov rcx, rbx
call fcn.140020964
movsxd rdi, eax
lea r14, [0x1400495d0]
mov rcx, rbx
sar rdi, 6
call fcn.140020964
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1400241df
lea rdx, [0x1400473c0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400241ed
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140024211
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140024211
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140024211
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14002422f
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14002423a
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140024256
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1400240d0
Function at 0x14000913f
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push r15
mov rax, 7
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140009152
sub rsp, 0x28
call fcn.14002c9d0
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14002ca40
add rsp, 0x10
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.14002ca40
add rsp, 0x10
push qword [rsp + 0x28]
pop rcx
call fcn.140009b9e
push qword [rsp + 0x30]
movabs rcx, 0x1400e0374
pop rdx
call fcn.14002c890
or rax, rax
je 0x140009283
cmp dword [0x1401484f0], 0
je 0x140009261
movabs rax, str.Advapi32.dll
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.140015650
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000925f
movabs rax, str.RegDeleteKeyExA
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
call fcn.1400156d8
mov qword [rsp + 0x40], rax
sub rsp, 8
push 0
movsxd r15, dword [0x1401484f8]
or r15, 0xf003f
mov rax, r15
push rax
mov rax, qword [0x1401483d4]
mov rax, rax
push rax
push qword [0x1401483fc]
push qword [rsp + 0x68]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140016d04
add rsp, 0x30
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.14001553c
jmp 0x14000927e
mov rax, qword [0x1401483d4]
mov rax, rax
push rax
push qword [0x1401483fc]
pop rcx
pop rdx
call sub.ADVAPI32.dll_RegDeleteKeyW
mov qword [rsp + 0x48], rax
jmp 0x140009348
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push qword [0x1401483fc]
push qword [rsp + 0x40]
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_RegConnectRegistryW
movsxd rax, eax
mov qword [rsp + 0x50], rax
cmp dword [0x1401484f0], 0
je 0x14000932d
movabs rax, str.Advapi32.dll
push rax
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.140015650
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000932b
push 0
movsxd r15, dword [0x1401484f8]
or r15, 0xf003f
mov rax, r15
push rax
mov rax, qword [0x1401483d4]
mov rax, rax
push rax
push qword [rsp + 0x70]
movabs rax, str.RegDeleteKeyExA
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140016208
add rsp, 0x30
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.14001553c
jmp 0x140009348
mov rax, qword [0x1401483d4]
mov rax, rax
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
call sub.ADVAPI32.dll_RegDeleteKeyW
mov qword [rsp + 0x48], rax
mov r15, qword [rsp + 0x48]
and r15, r15
jne 0x14000935b
mov rax, 1
jmp 0x14000935e
xor rax, rax
push rax
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.14002cae0
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14002cae0
add rsp, 0x28
pop rax
add rsp, 0x60
pop r15
ret
Function at 0x14000f571
Capabilities:
Acquire debug privileges

Disassembly:
push rbp
push r15
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14000f57b
sub rsp, 0x28
call fcn.14002c9d0
mov byte [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push 0x28
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
add rsp, 0x20
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_OpenProcessToken
and rax, rax
je 0x14000f68e
lea rax, [rsp + 0x38]
lea rax, [rsp + 0x38]
mov rax, rax
push rax
movabs rax, 0x1400e17f2
push rax
push 0
pop rcx
pop rdx
pop r8
call sub.ADVAPI32.dll_LookupPrivilegeValueW
and rax, rax
je 0x14000f684
lea rax, [rsp + 0x40]
lea rbp, [rsp + 0x40]
mov dword [rbp], 1
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 4], eax
lea rbp, [rsp + 0x38]
movsxd rax, dword [rbp + 4]
push rax
lea rbp, [rsp + 0x48]
push rbp
pop rbp
pop rax
mov dword [rbp + 8], eax
push rbp
pop rbp
mov dword [rbp + 0xc], 2
lea rax, [rsp + 0x60]
mov rax, rax
push rax
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push reloc.WS2_32.dll_recv
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_AdjustTokenPrivileges
add rsp, 0x30
mov rax, rax
push rax
pop rax
mov byte [rsp + 0x28], al
push qword [rsp + 0x30]
pop rcx
call sub.KERNEL32.dll_CloseHandle
movsx rax, byte [rsp + 0x28]
movsx rax, al
jmp 0x14000f69d
add rsp, 0x68
pop r15
pop rbp
ret

Function at 0x1400107c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x140142cd0]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret
Function at 0x140011a64
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
test ecx, ecx
je 0x140011adb
movsxd rdx, ecx
lea rcx, [0x1400119c0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [0x140148a28]
test rbx, rbx
je 0x140011b4e
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140011ad1
cmp byte [rbx + 0x20], 0
je 0x140011ad1
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, [r9 - 2]
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rbx, rdi
test rdi, rdi
jne 0x140011a97
jmp 0x140011b4e
mov rbx, qword [0x140148a28]
test rbx, rbx
je 0x140011b4e
mov rdi, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 0x10], eax
jne 0x140011b46
cmp byte [rbx + 0x21], 0
je 0x140011b0a
mov rcx, qword [rbx + 0x18]
mov edx, 1
call qword [sym.imp.USER32.dll_EnableWindow]
cmp byte [rbx + 0x20], 0
je 0x140011b36
mov rcx, qword [rbx + 0x18]
mov dword [rsp + 0x30], 3
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rdx, [rbx + 0x10]
lea rcx, [0x140148a28]
call fcn.14002c500
mov rbx, rdi
test rdi, rdi
jne 0x140011ae7
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400122f8
Capabilities:
Write file on windows

Disassembly:
test byte [rcx + 0x28], 0x80
mov r8d, 2
je 0x14001230c
mov r8d, SafeArrayPutElement
jmp 0x140012325
test dword [rcx + 0x28], 0x100
jne 0x140012325
test dword [rcx + 0x28], 0x200
mov eax, reloc.OLEAUT32.dll_SafeArrayPutElement
cmovne r8d, eax
jmp 0x14001232c
test rdx, rdx
je 0x1400123c2
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov edi, r8d
mov rbx, rdx
mov rcx, rdx
cmp r8d, 0x18
jne 0x14001235d
call fcn.1400a2a90
jmp 0x140012368
cmp r8d, 2
jne 0x140012375
call fcn.1400a2b80
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_strlen
jmp 0x14001237c
call sub.msvcrt.dll_wcslen
add eax, eax
mov rcx, qword [rsi + 0x10]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, 0x18
jne 0x1400123a6
mov rcx, rbx
call fcn.1400a2a80
jmp 0x1400123b3
cmp edi, 2
jne 0x1400123b3
mov rcx, rbx
call fcn.1400a2b70
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14001232c
Capabilities:
Write file on windows

Disassembly:
test byte [rcx + 0x28], 0x80
mov r8d, 2
je 0x14001230c
mov r8d, SafeArrayPutElement
jmp 0x140012325
test dword [rcx + 0x28], 0x100
jne 0x140012325
test dword [rcx + 0x28], 0x200
mov eax, reloc.OLEAUT32.dll_SafeArrayPutElement
cmovne r8d, eax
jmp 0x14001232c
test rdx, rdx
je 0x1400123c2
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov edi, r8d
mov rbx, rdx
mov rcx, rdx
cmp r8d, 0x18
jne 0x14001235d
call fcn.1400a2a90
jmp 0x140012368
cmp r8d, 2
jne 0x140012375
call fcn.1400a2b80
mov rcx, rax
mov rbx, rax
call sub.msvcrt.dll_strlen
jmp 0x14001237c
call sub.msvcrt.dll_wcslen
add eax, eax
mov rcx, qword [rsi + 0x10]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, 0x18
jne 0x1400123a6
mov rcx, rbx
call fcn.1400a2a80
jmp 0x1400123b3
cmp edi, 2
jne 0x1400123b3
mov rcx, rbx
call fcn.1400a2b70
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140012438
Capabilities:
Read file on windows

Disassembly:
mov rcx, qword [rcx + 0x18]
mov r9d, r8d
or r8d, 0xffffffff
jmp 0x140012810
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
xor eax, eax
mov ecx, 0x1000
mov r15d, r9d
mov r13d, r8d
mov edi, ecx
mov esi, eax
mov r14d, eax
mov r12d, eax
cmp edx, 0x18
je 0x14001294f
cmp edx, 2
je 0x14001294f
mov rcx, qword [0x1401482bc]
xor edx, edx
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x90]
lea r8d, [r12 + 2]
lea rdx, [rsp + 0x34]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
test eax, eax
je 0x140012938
mov r15, qword [rsp + 0x90]
mov ebp, edi
cmp dword [rsp + 0x38], 2
jne 0x140012930
cmp r13d, 0xffffffff
je 0x1400128bd
cmp r14d, r13d
jae 0x140012930
add r14d, 2
test edi, edi
jne 0x1400128e8
mov rcx, qword [0x1401482bc]
movsxd r9, ebp
lea edx, [rdi + 8]
add r9, r9
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, 0x1000
xor ecx, ecx
mov rbx, rax
movzx eax, word [rsp + 0x34]
cmp ax, 0xa
je 0x140012930
cmp ax, 0xd
je 0x140012908
mov word [r12 + rbx], ax
inc esi
inc ebp
add r12, 2
dec edi
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x34]
mov r8d, 2
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
test eax, eax
jne 0x1400128ab
mov r15d, dword [rsp + 0xa8]
movsxd rax, esi
mov edx, r15d
mov word [rbx + rax*2], cx
mov rcx, rbx
call fcn.1400a2e30
jmp 0x140012a18
mov r8, rcx
mov rcx, qword [0x1401482bc]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15d, dword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
mov rbx, rax
mov r13d, edi
cmp r15d, 0xffffffff
je 0x140012982
cmp r14d, r15d
jae 0x1400129ec
xor ecx, ecx
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x30]
lea r8d, [rcx + 1]
mov qword [rsp + 0x20], rcx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400129ec
cmp dword [rsp + 0x38], 1
jne 0x1400129ec
inc r14d
test edi, edi
jne 0x1400129d0
mov rcx, qword [0x1401482bc]
lea edx, [rdi + 8]
movsxd r9, r13d
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edi, 0x1000
mov rbx, rax
mov al, byte [rsp + 0x30]
cmp al, 0xa
je 0x1400129ec
cmp al, 0xd
je 0x140012977
mov byte [r12 + rbx], al
inc esi
inc r13d
inc r12
dec edi
jmp 0x140012977
mov r15d, dword [rsp + 0xa8]
xor ecx, ecx
cmp dword [rsp + 0x98], 0x18
movsxd rax, esi
mov edx, r15d
mov byte [rax + rbx], cl
mov rcx, rbx
jne 0x140012a13
call fcn.1400a2910
jmp 0x140012a18
call fcn.1400a2c60
mov rcx, qword [0x1401482bc]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140012514
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x14014a100]
call fcn.14002b890
xor ebp, ebp
or esi, 0xffffffff
mov r14, rax
mov ebx, ebp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx edx, word [rax]
test dx, dx
je 0x140012611
mov rcx, qword [rsp + 0x40]
mov r9w, 0x22
cmp dx, 0x20
jne 0x14001256b
add rax, 2
cmp word [rax], 0x20
je 0x140012561
movzx edx, word [rax]
mov r8d, 1
cmp dx, r9w
jne 0x1400125a9
add rax, 2
mov rbx, rax
movzx ecx, word [rax]
test cx, cx
je 0x1400125e9
cmp cx, r9w
je 0x14001259b
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x140012589
cmp word [rax], bp
je 0x1400125e9
mov rcx, rax
add rax, 2
jmp 0x1400125f1
test dx, dx
je 0x1400125ee
mov rbx, rax
cmp dx, 0x20
je 0x14001259b
add rax, 2
cmp word [rax], r9w
jne 0x1400125df
add rax, 2
movzx ecx, word [rax]
test cx, cx
je 0x1400125e9
cmp cx, r9w
je 0x1400125df
add rax, 2
movzx ecx, word [rax]
test cx, cx
jne 0x1400125cd
movzx edx, word [rax]
test dx, dx
jne 0x1400125b1
jmp 0x14001259b
mov rcx, rax
jmp 0x1400125f1
mov r8d, ebp
cmp dword [r14], esi
jne 0x1400125fb
test rdi, rdi
jne 0x14001261b
test r8d, r8d
je 0x140012602
inc esi
movzx edx, word [rax]
mov rbx, rbp
test dx, dx
jne 0x14001255b
test rdi, rdi
jne 0x140012630
movsxd rax, esi
jmp 0x140012632
test rbx, rbx
je 0x140012630
sub rcx, rbx
mov rax, rbx
sar rcx, 1
mov dword [rdi], ecx
inc dword [r14]
jmp 0x140012632
mov dword [rdi], ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140012648
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x14014a100]
call fcn.14002b890
xor ecx, ecx
add rsp, 0x28
jmp fcn.140012514

Function at 0x1400126dc
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [0x14014a100]
xor ebp, ebp
mov esi, edx
mov dword [rax + 8], ebp
call fcn.14002b890
test ebx, ebx
js 0x14001270b
mov dword [rax], ebx
lea rcx, [rsp + 0x30]
call fcn.140012514
mov edi, dword [rsp + 0x30]
mov edx, esi
mov ecx, edi
mov rbx, rax
call fcn.14002cd60
mov ecx, ebp
jmp 0x140012747
test edi, edi
je 0x14001274c
movzx edx, word [rbx]
cmp dx, 0x22
jne 0x14001273a
inc ecx
jmp 0x140012741
mov word [rax], dx
add rax, 2
add rbx, 2
dec edi
cmp word [rbx], bp
jne 0x140012729
mov word [rax], bp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.14002cea0