joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f030
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov ebx, r9d
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9d, ebx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x14000f030
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov esi, r9d
call fcn.140249b10
mov dword [rsp + 0x30], 0x1019
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a120]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
mov rbx, qword [rsp + 0x1a140]
mov r8d, 0xa098
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x40], edi
xor edi, edi
mov dword [rsp + 0x44], esi
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x1a120], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a128]
mov r8d, 0x10018
mov dword [rsp + 0x1a128], edi
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x1a130]
test rcx, rcx
je 0x14000f114
mov eax, dword [rsp + 0xa0dc]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x1a138]
test rcx, rcx
je 0x14000f12a
mov eax, dword [rsp + 0xa0e0]
mov dword [rcx], eax
mov rax, qword [rsp + 0xa0e8]
mov ecx, dword [rsp + 0xa0d0]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f240
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14000f280
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0xa084
lea rcx, [rsp + 0x44]
mov rdi, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x1042
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x40], esi
test rdi, rdi
je case.default.0x14000f2ec
lea eax, [rsi - 1]
cmp eax, 6
ja case.default.0x14000f2ec
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xf3b0]
add rcx, rdx
jmp rcx
mov rax, qword [rdi]
mov qword [rsp + 0x48], rax
jmp case.default.0x14000f2ec
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x48], xmm0
movsd xmm0, qword [rdi + 0x20]
movsd qword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x58], xmm1
jmp case.default.0x14000f2ec
mov eax, dword [rdi]
mov dword [rsp + 0x48], eax
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a120]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rsp + 0x1a120], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a118]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f280
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14000f280
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0xa084
lea rcx, [rsp + 0x44]
mov rdi, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x1042
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x40], esi
test rdi, rdi
je case.default.0x14000f2ec
lea eax, [rsi - 1]
cmp eax, 6
ja case.default.0x14000f2ec
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xf3b0]
add rcx, rdx
jmp rcx
mov rax, qword [rdi]
mov qword [rsp + 0x48], rax
jmp case.default.0x14000f2ec
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x48], xmm0
movsd xmm0, qword [rdi + 0x20]
movsd qword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x58], xmm1
jmp case.default.0x14000f2ec
mov eax, dword [rdi]
mov dword [rsp + 0x48], eax
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a120]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rsp + 0x1a120], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a118]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000f6c0
Capabilities:
Modify service

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [rsp + 0xc8]
mov r10d, r9d
mov r9d, dword [rsp + 0x90]
mov r11d, r8d
mov qword [rsp + 0x50], rax
mov rcx, rdx
mov rax, qword [rsp + 0xc0]
mov r8d, r10d
mov qword [rsp + 0x48], rax
mov edx, r11d
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
add rsp, 0x60
pop rbx
ret

Function at 0x14000f750
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov ebx, r9d
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r10, rax
mov r9d, ebx
mov r8d, edi
mov rdx, rsi
mov rcx, r10
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
jmp fcn.14000f790
Function at 0x14000f790
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x19ff0]
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov ebx, r8d
mov rsi, rcx
xor eax, eax
lea rcx, [rsp + 0x4c]
mov r8d, 0xa07c
mov qword [rsp + 0x38], rax
xor edx, edx
mov edi, r9d
call fcn.140249b10
mov dword [rsp + 0x30], 0x103e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, qword [rbp + 0x1a038]
mov dword [rsp + 0x34], eax
mov eax, dword [rbp + 0x1a030]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], edi
test rdx, rdx
je 0x14000f80a
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, qword [rbp + 0x1a040]
test rdx, rdx
je 0x14000f823
lea rcx, [rbp + 0xf8c]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, qword [rbp + 0x1a050]
test rdx, rdx
je 0x14000f83c
lea rcx, [rbp + 0x1fcc]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, qword [rbp + 0x1a058]
test rdx, rdx
je 0x14000f855
lea rcx, [rbp + 0x300c]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, qword [rbp + 0x1a060]
test rdx, rdx
je 0x14000f86e
lea rcx, [rbp + 0x404c]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, qword [rbp + 0x1a068]
test rdx, rdx
je 0x14000f887
lea rcx, [rbp + 0x508c]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, qword [rsi + 0x10]
lea r9, [rbp + 0x1a020]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rbp + 0x1a020], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rbp + 0x9fd0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rbp + 0x1a028]
mov r8d, 0x10018
mov dword [rbp + 0x1a028], ebx
lea rdx, [rbp + 0x9fd0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbp + 0x1a048]
test rcx, rcx
je 0x14000f901
mov eax, dword [rbp + 0x9fdc]
mov dword [rcx], eax
mov ecx, dword [rbp + 0x9fd0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rbp + 0x9fd8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000f9b0
Capabilities:
Modify service

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [rsp + 0xc8]
mov r10d, r9d
mov r9d, dword [rsp + 0x90]
mov r11d, r8d
mov qword [rsp + 0x50], rax
mov rcx, rdx
mov rax, qword [rsp + 0xc0]
mov r8d, r10d
mov qword [rsp + 0x48], rax
mov edx, r11d
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
add rsp, 0x60
pop rbx
ret
Function at 0x14000faf0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.1400143a0
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x14000fb20
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x1038
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
ret

Function at 0x14000fb20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.1400143a0
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x14000fb20
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x1038
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
ret
Function at 0x14000fc20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.1400143a0
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x14000fc40
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x103c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
ret

Function at 0x14000fc40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.1400143a0
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x14000fc40
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x103c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
ret
Function at 0x14000fe20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14000fe60
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov rbp, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x1041
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a120]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a120], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test rbp, rbp
je 0x14000ff43
movups xmm0, xmmword [rsp + 0xa0dc]
mov eax, dword [rsp + 0xa0f4]
movsd xmm1, qword [rsp + 0xa0ec]
movups xmmword [rbp], xmm0
movsd qword [rbp + 0x10], xmm1
mov dword [rbp + 0x18], eax
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a118]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000fe60
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14000fe60
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov rbp, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x1041
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a120]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a120], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test rbp, rbp
je 0x14000ff43
movups xmm0, xmmword [rsp + 0xa0dc]
mov eax, dword [rsp + 0xa0f4]
movsd xmm1, qword [rsp + 0xa0ec]
movups xmmword [rbp], xmm0
movsd qword [rbp + 0x10], xmm1
mov dword [rbp + 0x18], eax
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a118]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140010010
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140010040
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x105d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0xa0d8], ebx
je 0x140010152
lea rcx, [rsp + 0xa0dc]
mov rax, 0xffffffffffffffff
nop
cmp byte [rcx + rax + 1], bl
lea rax, [rax + 1]
jne 0x140010110
lea ecx, [rax + 1]
call fcn.140250fe4
lea rdx, [rsp + 0xa0dc]
mov r8, rax
sub r8, rdx
lea rcx, [rsp + 0xa0dc]
nop dword [rax + rax]
movzx edx, byte [rcx]
mov byte [r8 + rcx], dl
lea rcx, [rcx + 1]
test dl, dl
jne 0x140010140
mov qword [rsi], rax
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140010040
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140010040
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x105d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0xa0d8], ebx
je 0x140010152
lea rcx, [rsp + 0xa0dc]
mov rax, 0xffffffffffffffff
nop
cmp byte [rcx + rax + 1], bl
lea rax, [rax + 1]
jne 0x140010110
lea ecx, [rax + 1]
call fcn.140250fe4
lea rdx, [rsp + 0xa0dc]
mov r8, rax
sub r8, rdx
lea rcx, [rsp + 0xa0dc]
nop dword [rax + rax]
movzx edx, byte [rcx]
mov byte [r8 + rcx], dl
lea rcx, [rcx + 1]
test dl, dl
jne 0x140010140
mov qword [rsi], rax
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140010190
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400101c0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x105c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0xa0d8], ebx
je 0x1400102d4
lea rcx, [rsp + 0xa0dc]
mov rax, 0xffffffffffffffff
nop
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x140010290
lea ecx, [rax + rax]
add rcx, 2
call fcn.140250fe4
lea rdx, [rsp + 0xa0dc]
mov r8, rax
sub r8, rdx
lea rcx, [rsp + 0xa0dc]
nop dword [rax]
movzx edx, word [rcx]
mov word [r8 + rcx], dx
lea rcx, [rcx + 2]
test dx, dx
jne 0x1400102c0
mov qword [rsi], rax
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret