joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018c54
Capabilities:
Create directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x250
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, qword [rsp + 0x2b0]
mov rbp, r9
mov r12d, r8d
mov rdi, rdx
mov r13, rcx
xor ebx, ebx
mov rcx, qword [str.P5_n_]
lea r15, str.P5_n_
cmp rcx, r15
je 0x140018cc2
test byte [rcx + 0x1c], 4
je 0x140018cc2
cmp byte [rcx + 0x19], 5
jb 0x140018cc2
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009868]
mov edx, 0xed
call fcn.14000ffa8
lea rcx, [0x140009e88]
lea rax, [0x140009ea0]
test r12d, r12d
cmovne rax, rcx
lea r8, [0x140009d80]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.1400118ac
mov edi, eax
test eax, eax
jns 0x140018d46
mov rcx, qword [str.P5_n_]
cmp rcx, r15
je 0x140018d2b
test byte [rcx + 0x1c], 4
je 0x140018d2b
cmp byte [rcx + 0x19], 2
jb 0x140018d2b
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009868]
mov edx, 0xee
mov r9d, eax
call fcn.1400100e0
mov ecx, edi
movzx eax, di
mov ebx, edi
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove ebx, eax
jmp 0x140018e34
lea rcx, [rsp + 0x30]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140018e28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
jne 0x140018df0
xor ebx, ebx
mov rcx, qword [str.P5_n_]
cmp rcx, r15
je 0x140018da1
test byte [rcx + 0x1c], 4
je 0x140018da1
cmp byte [rcx + 0x19], 5
jb 0x140018da1
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x38]
lea r9, [rsp + 0x30]
lea r8, [0x140009868]
call fcn.14001011c
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.140018a24
test eax, eax
jne 0x140018dec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r15
je 0x140018e34
test byte [rcx + 0x1c], 4
je 0x140018e34
cmp byte [rcx + 0x19], 2
jb 0x140018e34
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009868]
mov edx, 0xf0
mov r9d, eax
call fcn.1400100e0
jmp 0x140018e34
xor eax, eax
jmp 0x140018e2d
mov rcx, qword [str.P5_n_]
cmp rcx, r15
je 0x140018e34
test byte [rcx + 0x1c], 4
je 0x140018e34
cmp byte [rcx + 0x19], 2
jb 0x140018e34
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x30]
lea r8, [0x140009868]
mov edx, 0xf1
mov dword [rsp + 0x20], eax
call fcn.140011a18
jmp 0x140018e34
mov eax, 1
cmp dword [rsi], 0
je 0x140018e34
mov dword [rsi], eax
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14008c5b0
add rsp, 0x250
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140019198
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x290
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r12, r8
mov rsi, rdx
xor ebp, ebp
mov rcx, qword [str.P5_n_]
lea r14, str.P5_n_
cmp rcx, r14
je 0x1400191f9
test byte [rcx + 0x1c], 4
je 0x1400191f9
cmp byte [rcx + 0x19], 5
jb 0x1400191f9
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009868]
mov edx, 0xfa
call fcn.14000ffa8
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140019276
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14001924d
test byte [rcx + 0x1c], 4
je 0x14001924d
cmp byte [rcx + 0x19], 3
jb 0x14001924d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009868]
mov edx, 0xfb
mov r9d, eax
mov qword [rsp + 0x20], rsi
call fcn.140058098
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14008c5b0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x50]
lea rdx, [rsp + 0x30]
shl rcx, 0x20
or rcx, rax
add rbp, rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140019276
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x12
je 0x1400192dc
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x1400192dc
test byte [rcx + 0x1c], 4
je 0x1400192dc
cmp byte [rcx + 0x19], 2
jb 0x1400192dc
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009868]
mov edx, 0xfc
mov r9d, eax
mov qword [rsp + 0x20], rsi
call fcn.140058098
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x14001931e
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14001931e
test byte [rcx + 0x1c], 4
je 0x14001931e
cmp byte [rcx + 0x19], 2
jb 0x14001931e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009868]
mov edx, 0xfd
mov r9d, ebx
mov qword [rsp + 0x20], rsi
call fcn.140058098
cmp ebx, 0x12
jne 0x14001924d
mov qword [r12], rbp
xor eax, eax
jmp 0x14001924f
Function at 0x140019d8c
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x30
mov rsi, rdx
mov rcx, qword [str.P5_n_]
lea r12, str.P5_n_
cmp rcx, r12
je 0x140019dd8
test byte [rcx + 0x1c], 4
je 0x140019dd8
cmp byte [rcx + 0x19], 5
jb 0x140019dd8
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009858]
mov edx, 0x20
call fcn.14000ffa8
mov r9d, 2
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call fcn.14007ac98
xor ebx, ebx
mov rdi, rax
cmp rax, rbx
jne 0x140019e43
mov rax, qword [str.P5_n_]
cmp rax, r12
je 0x140019e98
test byte [rax + 0x1c], 4
je 0x140019e98
cmp byte [rax + 0x19], 3
jb 0x140019e98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea edx, [rbx + 0x21]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009858]
mov r9, rsi
mov dword [rsp + 0x20], eax
call fcn.140011a18
jmp 0x140019e98
lea rdx, [0x140009ec8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, ebx
je 0x140019e8f
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x140019e8f
test byte [rcx + 0x1c], 4
je 0x140019e8f
cmp byte [rcx + 0x19], 3
jb 0x140019e8f
mov rcx, qword [rcx + 0x10]
lea r9, [0x140009ec8]
lea r8, [0x140009858]
mov edx, 0x22
mov dword [rsp + 0x20], eax
call fcn.140011a18
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, 0xffffffff80000002
call fcn.14007b4cc
cmp eax, ebx
jne 0x140019ee7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x140019ee7
test byte [rcx + 0x1c], 4
je 0x140019ee7
cmp byte [rcx + 0x19], 2
jb 0x140019ee7
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009858]
mov edx, 0x23
mov r9, rsi
mov dword [rsp + 0x20], eax
call fcn.140011a18
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r12
ret

Function at 0x14001a90c
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rdi, r8
mov r12, rdx
mov rsi, rcx
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x14001a962
test byte [rcx + 0x1c], 4
je 0x14001a962
cmp byte [rcx + 0x19], 5
jb 0x14001a962
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009858]
mov edx, 0x44
call fcn.14000ffa8
mov rax, qword [rsi + 8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14001a98c
mov rbp, qword [rbx + 0x10]
mov rcx, r12
mov rdx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14001a9a9
mov rbx, qword [rbx]
cmp rbx, qword [rsi + 8]
jne 0x14001a96e
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
test rdi, rdi
je 0x14001a9b1
mov qword [rdi], rbx
mov rax, rbp
jmp 0x14001a98e
Function at 0x14001e570
Capabilities:
Compare security identifiers

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x24]
test edx, eax
jne 0x14001e581
xor eax, eax
jmp 0x14001e5bc
cmp eax, 4
je 0x14001e5b7
cmp eax, 8
je 0x14001e5b7
xor ebx, ebx
cmp r8d, ebx
jne 0x14001e5b7
cmp eax, 2
jne 0x14001e59e
mov rcx, qword [rcx + 0x248]
mov rdx, qword [rcx + 0x198]
mov rcx, r9
call qword [sym.imp.ADVAPI32.dll_EqualSid]
cmp eax, ebx
setne bl
mov eax, ebx
jmp 0x14001e5bc
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140030f14
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x60
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 1]
xor ecx, ecx
mov esi, ebp
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov rcx, qword [str.P5_n_]
lea r12, str.P5_n_
cmp rcx, r12
je 0x140030f74
test byte [rcx + 0x1c], 4
je 0x140030f74
cmp byte [rcx + 0x19], 5
jb 0x140030f74
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x17]
lea r8, [0x140009838]
call fcn.14000ffa8
lea rcx, [0x14000a1d0]
or edx, 0xffffffff
call fcn.14007e5ac
lea rax, [0x140001d18]
lea rbx, [0x1400a3d00]
mov qword [0x1400a3d10], rbp
mov qword [0x1400a3d00], rbp
mov qword [0x1400a3d20], rax
mov byte [0x1400a3d18], 1
mov byte [0x1400a3d19], bpl
mov qword [str.P5_n_], rbx
mov word [0x1400a3d1a], bp
mov dword [0x1400a3d1c], ebp
lea rdi, [0x1400a3d20]
mov r8, qword [rdi]
lea rax, [rbx + 8]
lea rcx, [0x140030118]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rbp
mov r9d, 1
mov rdx, rbx
mov qword [rsp + 0x28], rbp
add rdi, 8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rbx, qword [rbx]
cmp rbx, rbp
jne 0x140030fcf
mov rax, qword [str.P5_n_]
cmp rax, r12
je 0x140031058
test byte [rax + 0x1c], 4
je 0x140031058
cmp byte [rax + 0x19], 5
jb 0x140031058
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov rcx, qword [str.P5_n_]
lea r8, [0x140009838]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x18
call fcn.1400100e0
mov ecx, 1
call sub.GDI32.dll_EnableEUDC
cmp eax, ebp
je 0x1400310b5
lea rcx, [0x1400a3510]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
cmp eax, ebp
jne 0x1400310e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rbx, qword [str.P5_n_]
cmp rbx, r12
je 0x140031112
test byte [rbx + 0x1c], 4
je 0x1400310e9
cmp byte [rbx + 0x19], 2
jb 0x1400310e9
mov rcx, qword [rbx + 0x10]
lea r8, [0x140009838]
mov edx, 0x19
mov r9d, eax
call fcn.1400100e0
jmp 0x1400310e2
mov rbx, qword [str.P5_n_]
cmp rbx, r12
je 0x140031112
test byte [rbx + 0x1c], 4
je 0x1400310e9
cmp byte [rbx + 0x19], 2
jb 0x1400310e9
mov rcx, qword [rbx + 0x10]
lea r8, [0x140009838]
mov edx, 0x1a
call fcn.14000ffa8
mov rbx, qword [str.P5_n_]
cmp rbx, r12
je 0x140031112
jmp 0x140031106
mov rcx, qword [rbx + 8]
cmp rcx, rbp
je 0x140031103
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rbx + 8], rbp
mov rbx, qword [rbx]
cmp rbx, rbp
jne 0x1400310f0
mov qword [str.P5_n_], r12
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [0x1400a417c], eax
add eax, ebx
jne 0x14003113d
mov rcx, qword [0x14009e3f0]
cmp rcx, rbx
je 0x14003113d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14009e3f0], rbx
lea r11, [rsp + 0x60]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x140031b14
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
mov rcx, qword [str.P5_n_]
lea rbp, str.P5_n_
cmp rcx, rbp
je 0x140031b57
test byte [rcx + 0x1c], 4
je 0x140031b57
cmp byte [rcx + 0x19], 5
jb 0x140031b57
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009838]
mov edx, 0x2b
call fcn.14000ffa8
lea rdx, [0x14000a050]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call fcn.14007ac98
mov rdi, rax
test rax, rax
jne 0x140031bc7
mov rax, qword [str.P5_n_]
cmp rax, rbp
je 0x140031cd9
test byte [rax + 0x1c], 4
je 0x140031cd9
cmp byte [rax + 0x19], 2
jb 0x140031cd9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea edx, [rdi + 0x2c]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009838]
mov r9d, eax
call fcn.1400100e0
jmp 0x140031cd9
lea rax, [rsp + 0x40]
lea rdx, [0x14000a090]
mov r9d, 1
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400865c4
mov rbx, rax
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x140031ca9
test eax, eax
je 0x140031c65
lea r8, [0x140009d60]
test rbx, rbx
lea rdx, [0x14000a090]
mov r9d, 1
mov rcx, rdi
cmovne r8, rbx
call fcn.14008625c
test eax, eax
jne 0x140031ca9
mov rax, qword [str.P5_n_]
cmp rax, rbp
je 0x140031c65
test byte [rax + 0x1c], 4
je 0x140031c65
cmp byte [rax + 0x19], 2
jb 0x140031c65
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea r8, [0x140009838]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x2d
call fcn.1400100e0
lea rdx, [0x14000a090]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x140031ca9
mov rcx, qword [str.P5_n_]
cmp rcx, rbp
je 0x140031ca9
test byte [rcx + 0x1c], 4
je 0x140031ca9
cmp byte [rcx + 0x19], 2
jb 0x140031ca9
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009838]
mov edx, 0x2e
mov r9d, eax
call fcn.1400100e0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140031cd9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rdi, rbx
not rcx
dec rcx
add rcx, rcx
rep stosb byte [rdi], al
mov rcx, rbx
call fcn.140076afc
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140032e7c
Capabilities:
Listen for remote procedure calls

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
sub rsp, 0x20
mov rcx, qword [str.P5_n_]
lea rsi, str.P5_n_
lea rbp, [0x140009838]
cmp rcx, rsi
je 0x140032ec2
test byte [rcx + 0x1c], 4
je 0x140032ec2
cmp byte [rcx + 0x19], 5
jb 0x140032ec2
mov rcx, qword [rcx + 0x10]
mov edx, 0x61
mov r8, rbp
call fcn.14000ffa8
lea rdx, [0x140008bf0]
lea rcx, [0x14000ac18]
call fcn.140032c4c
mov ebx, eax
test eax, eax
je 0x140032f0e
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x140032f07
test byte [rcx + 0x1c], 4
je 0x140032f07
cmp byte [rcx + 0x19], 2
jb 0x140032f07
mov edx, 0x62
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, rbp
call fcn.1400100e0
mov eax, ebx
jmp 0x14003304b
call fcn.14007cc40
cmp eax, 1
je 0x140032fbb
cmp eax, 2
je 0x140032fbb
cmp eax, 0x20
je 0x140032fbb
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0xa]
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
mov ebx, eax
test eax, eax
je 0x140032fbb
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x140032f72
test byte [rcx + 0x1c], 4
je 0x140032f72
cmp byte [rcx + 0x19], 2
jb 0x140032f72
mov rcx, qword [rcx + 0x10]
mov edx, 0x63
mov r9d, eax
mov r8, rbp
call fcn.1400100e0
xor edx, edx
lea rcx, [0x140008bf0]
lea r8d, [rdx + 1]
call qword [sym.imp.RPCRT4.dll_RpcServerUnregisterIf]
test eax, eax
je 0x140032f07
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x140032f07
test byte [rcx + 0x1c], 4
je 0x140032f07
cmp byte [rcx + 0x19], 2
jb 0x140032f07
mov edx, 0x64
jmp 0x140032ef8
mov ecx, 1
mov edx, 0x4d2
mov r8d, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
mov ebx, eax
test eax, eax
je 0x140033049
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x140033000
test byte [rcx + 0x1c], 4
je 0x140033000
cmp byte [rcx + 0x19], 2
jb 0x140033000
mov rcx, qword [rcx + 0x10]
mov edx, 0x65
mov r9d, eax
mov r8, rbp
call fcn.1400100e0
xor edx, edx
lea rcx, [0x140008bf0]
lea r8d, [rdx + 1]
call qword [sym.imp.RPCRT4.dll_RpcServerUnregisterIf]
test eax, eax
je 0x140032f07
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x140032f07
test byte [rcx + 0x1c], 4
je 0x140032f07
cmp byte [rcx + 0x19], 2
jb 0x140032f07
mov edx, 0x66
jmp 0x140032ef8
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x140035858
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x80
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r13, rdx
mov r12, rcx
xor ebx, ebx
mov edi, ebx
lea rsi, str.P5_n_
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x1400358c3
test byte [rcx + 0x1c], 4
je 0x1400358c3
cmp byte [rcx + 0x19], 5
jb 0x1400358c3
lea edx, [rbx + 0xa]
lea r8, [0x140009828]
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp dword [0x1400a3fdc], ebx
jne 0x1400358e8
mov eax, 1
jmp 0x140035a77
lea r8, [rsp + 0x48]
mov rdx, r13
mov rcx, r12
call fcn.1400367d0
cmp eax, ebx
jne 0x140035933
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x140035929
test byte [rcx + 0x1c], 4
je 0x140035929
cmp byte [rcx + 0x19], 2
jb 0x140035929
mov edx, 0xb
lea r8, [0x140009828]
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
mov edi, 0xe
jmp 0x140035a41
xor ecx, ecx
call fcn.140039a30
cmp eax, ebx
je 0x1400359c9
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14003596f
test byte [rcx + 0x1c], 4
je 0x14003596f
cmp byte [rcx + 0x19], 5
jb 0x14003596f
mov edx, 0xd
lea r8, [0x140009828]
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
xor ecx, ecx
call fcn.140039c28
mov edi, eax
cmp eax, ebx
je 0x1400359c9
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x1400359ac
test byte [rcx + 0x1c], 4
je 0x1400359ac
cmp byte [rcx + 0x19], 2
jb 0x1400359ac
mov edx, 0xe
mov r9d, eax
lea r8, [0x140009828]
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
cmp dword [0x1400a3fdc], ebx
je 0x140035a3d
mov rcx, qword [0x1400a3d80]
cmp rcx, 0xffffffffffffffff
je 0x140035a3d
mov edi, ebx
jmp 0x1400359d0
mov rcx, qword [0x1400a3d80]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x60]
add r8d, r8d
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
jne 0x140035a3d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x140035a3d
test byte [rcx + 0x1c], 4
je 0x140035a3d
cmp byte [rcx + 0x19], 2
jb 0x140035a3d
mov edx, 0xf
mov r9d, eax
lea r8, [0x140009828]
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
jmp 0x140035a3d
cmp edi, ebx
je 0x140035a60
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
cmp qword [rsp + 0x68], 8
jb 0x140035a5c
mov rcx, qword [rsp + 0x50]
call fcn.14008c058
xor eax, eax
jmp 0x140035a77
cmp qword [rsp + 0x68], 8
jb 0x140035a72
mov rcx, qword [rsp + 0x50]
call fcn.14008c058
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14008c5b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140035aa4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push r12
sub rsp, 0x80
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r12, rcx
xor edi, edi
mov ebx, edi
lea rsi, str.P5_n_
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x140035b0d
test byte [rcx + 0x1c], 4
je 0x140035b0d
cmp byte [rcx + 0x19], 5
jb 0x140035b0d
lea edx, [rdi + 0x10]
lea r8, [0x140009828]
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
cmp dword [0x1400a3fe0], edi
jne 0x140035b32
mov eax, 1
jmp 0x140035cc4
lea rdx, [rsp + 0x48]
mov rcx, r12
call fcn.140037328
cmp eax, edi
jne 0x140035b7a
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x140035b70
test byte [rcx + 0x1c], 4
je 0x140035b70
cmp byte [rcx + 0x19], 2
jb 0x140035b70
mov edx, 0x11
lea r8, [0x140009828]
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
mov ebx, 0xe
jmp 0x140035c8e
mov ecx, 1
call fcn.140039a30
cmp eax, edi
je 0x140035c16
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x140035bb9
test byte [rcx + 0x1c], 4
je 0x140035bb9
cmp byte [rcx + 0x19], 5
jb 0x140035bb9
mov edx, 0x13
lea r8, [0x140009828]
mov rcx, qword [rcx + 0x10]
call fcn.14000ffa8
mov ecx, 1
call fcn.140039c28
mov ebx, eax
cmp eax, edi
je 0x140035c16
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x140035bf9
test byte [rcx + 0x1c], 4
je 0x140035bf9
cmp byte [rcx + 0x19], 2
jb 0x140035bf9
mov edx, 0x14
mov r9d, eax
lea r8, [0x140009828]
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
cmp dword [0x1400a3fe0], edi
je 0x140035c8a
mov rcx, qword [0x1400a3d78]
cmp rcx, 0xffffffffffffffff
je 0x140035c8a
mov ebx, edi
jmp 0x140035c1d
mov rcx, qword [0x1400a3d78]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x60]
add r8d, r8d
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, edi
jne 0x140035c8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x140035c8a
test byte [rcx + 0x1c], 4
je 0x140035c8a
cmp byte [rcx + 0x19], 2
jb 0x140035c8a
mov edx, 0x15
mov r9d, eax
lea r8, [0x140009828]
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
jmp 0x140035c8a
cmp ebx, edi
je 0x140035cad
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
cmp qword [rsp + 0x68], 8
jb 0x140035ca9
mov rcx, qword [rsp + 0x50]
call fcn.14008c058
xor eax, eax
jmp 0x140035cc4
cmp qword [rsp + 0x68], 8
jb 0x140035cbf
mov rcx, qword [rsp + 0x50]
call fcn.14008c058
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14008c5b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x140039a30
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x40
mov ebx, ecx
mov rcx, qword [str.P5_n_]
lea rbp, str.P5_n_
cmp rcx, rbp
je 0x140039a75
test byte [rcx + 0x1c], 4
je 0x140039a75
cmp byte [rcx + 0x19], 5
jb 0x140039a75
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009828]
mov edx, 0x5c
call fcn.14000ffa8
mov eax, dword [0x1400a3ff0]
xor esi, esi
cmp eax, esi
je 0x140039c0e
mov rcx, qword [0x1400a3d78]
cmp ebx, esi
lea ebx, [rsi + 1]
cmove rcx, qword [0x1400a3d80]
cmp eax, ebx
jne 0x140039b04
xor eax, eax
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
jne 0x140039ae8
mov rax, qword [str.P5_n_]
cmp rax, rbp
je 0x140039c0e
test byte [rax + 0x1c], 4
je 0x140039c0e
cmp byte [rax + 0x19], 2
jb 0x140039c0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [rsi + 0x5d]
jmp 0x140039ba3
mov ecx, dword [0x1400a3ff4]
shl rcx, 0x14
cmp qword [rsp + 0x58], rcx
jl 0x140039c0e
mov eax, ebx
jmp 0x140039c10
cmp eax, 2
jne 0x140039c0e
lea rdx, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetFileTime]
cmp eax, esi
jne 0x140039b53
mov rax, qword [str.P5_n_]
cmp rax, rbp
je 0x140039c0e
test byte [rax + 0x1c], 4
je 0x140039c0e
cmp byte [rax + 0x19], 2
jb 0x140039c0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x5e
jmp 0x140039ba3
xor eax, eax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x58]
mov word [rsp + 0x20], si
mov qword [rsp + 0x22], rax
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp eax, esi
jne 0x140039bbf
mov rax, qword [str.P5_n_]
cmp rax, rbp
je 0x140039c0e
test byte [rax + 0x1c], 4
je 0x140039c0e
cmp byte [rax + 0x19], 2
jb 0x140039c0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x5f
mov rcx, qword [str.P5_n_]
lea r8, [0x140009828]
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
jmp 0x140039c0e
xor eax, eax
lea rcx, [rsp + 0x30]
mov word [rsp + 0x30], si
mov qword [rsp + 0x32], rax
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rsp + 0x20]
movzx r11d, word [rsp + 0x30]
sub r11d, eax
movzx eax, word [rsp + 0x22]
lea ecx, [r11 + r11*2]
shl ecx, 2
sub ecx, eax
movzx eax, word [rsp + 0x32]
add ecx, eax
cmp ecx, dword [0x1400a3ff8]
jae 0x140039afd
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret