joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bf820
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400bf91c
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
lea r8, [rsi + rdi]
test rsi, rsi
cmovge rbx, r8
cmp rcx, rbx
jb 0x1400bf910
cmp rdi, rbx
ja 0x1400bf905
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
sub rcx, rdi
mov rsi, rbx
sub rbx, rdi
mov r8, rcx
neg rcx
sar rcx, 0x3f
and rcx, rdi
add rax, rcx
mov qword [rsp + 0x30], rax
sub rsi, rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], r8
mov byte [rsp + 0x18], 0
call fcn.140003de0
xorps xmm15, xmm15
mov r14, qword [0x140264d98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
cmp rcx, 0xffffffffffffffff
mov rax, qword [rsp + 0x28]
cmove rcx, rax
mov rax, qword [rsp + 0x60]
lea rdx, [rcx + rax]
mov rbx, qword [rsp + 0x58]
cmp rbx, rdx
jb 0x1400bf8f7
cmp rax, rdx
ja 0x1400bf8ef
xor eax, eax
mov rbx, qword [rsp + 0x30]
nop
call fcn.140050b60
xor ecx, ecx
xor edi, edi
add rsp, 0x38
pop rbp
ret
mov rcx, rdx
call fcn.1400680e0
mov rcx, rdx
mov rdx, rbx
nop dword [rax]
call fcn.1400680a0
mov rax, rdi
mov rcx, rbx
call fcn.1400680e0
mov rdx, rcx
mov rcx, rbx
call fcn.1400680a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.140065d20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.1400bf820
Function at 0x1400cc520
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1402688e8], rax
test rax, rax
je 0x1400cc555
lea rcx, [0x140268900]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x3d
mov edx, 1
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x1400ccc10
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call fcn.1400cdc00
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
nop dword [rax]

Function at 0x1400ccc80
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1402689c4]
mov rbx, rcx
test esi, esi
jle 0x1400ccdb0
mov rax, qword [0x1402689c8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400ccccb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400ccd55
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400cccb0
mov rcx, rbx
call fcn.1400cd700
mov rdi, rax
test rax, rax
je 0x1400ccdd2
mov rax, qword [0x1402689c8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400cd840
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1402689c8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400ccdb7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400ccd4e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400ccd60
add dword [0x1402689c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1402689c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400ccd4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400ccc10
nop dword [rax]
xor esi, esi
jmp 0x1400cccd8
mov rax, qword [0x1402689c8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400ccc10
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400ccc10
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400cd370
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140268a20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140268a00]
test rbx, rbx
je 0x1400cd3cc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x1400cd3c3
test eax, eax
jne 0x1400cd3c3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400cd3a8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400cd700
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1401d69e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400cd720
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400cd728
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400cd720
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400cd77d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400cd774
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400cd720
add rax, 0x28
cmp rax, r9
jne 0x1400cd760
xor eax, eax
ret

Function at 0x1400cd780
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401d69e0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400cd79f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400cd7a8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400cd79f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400cd840
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401d69e0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400cd85f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400cd868
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1800024a0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x1800024d2
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x1800024d2
nop word cs:[rax + rax]
jmp 0x1800024d0
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x1800025a8
mov rsi, r10
test r8b, r8b
je 0x1800025c0
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002540
test r9b, r9b
je 0x1800025d0
sub rsi, rcx
je 0x1800025a4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x1800025a0
test ebp, ebp
jne 0x1800025a0
add rbx, 1
cmp rsi, rbx
jne 0x180002560
jmp 0x1800025a4
test ebp, ebp
jne 0x18000252c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x1800025c0
jmp 0x1800025d0
Function at 0x180002570
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x1800025a2
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x1800025a2
nop word cs:[rax + rax]
nop
jmp 0x1800025a0
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
mov r8, qword [r11 + 0x10]
add r11, 0x10
cmp r8, r11
je 0x180002602
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
cmp dword [0x180020a7c], 0xa
jl 0x180002609
mov edx, dword [0x180020a80]
lea ebx, [rdx - 1]
imul ebx, edx
and ebx, 1
je 0x180002609
nop word cs:[rax + rax]
nop dword [rax]
jmp 0x180002600
xor eax, eax
jmp 0x180002696
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov rdx, r10
nop word cs:[rax + rax]
nop
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x180002620
test r9b, r9b
je 0x180002690
sub rdx, rcx
je 0x180002692
mov r14, qword [r8 + 0x60]
xor edi, edi
nop word [rax + rax]
movzx ebx, word [r14 + rdi*2]
movsx r12d, byte [rcx + rdi]
lea r15d, [rbx - 0x41]
lea ebp, [rbx + 0x20]
cmp r15w, 0x1a
cmovae ebp, ebx
lea r15d, [r12 - 0x41]
lea esi, [r12 + 0x20]
cmp r15b, 0x1a
cmovae esi, r12d
cmp ebp, esi
jne 0x18000267f
test bx, bx
je 0x180002692
add rdi, 1
cmp rdx, rdi
jne 0x180002640
jmp 0x180002692
mov r8, qword [r8]
cmp r8, r11
jne 0x180002612
jmp 0x180002696
jmp 0x180002690
mov rax, qword [r8 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180002af0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002b22
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002b22
nop word cs:[rax + rax]
jmp 0x180002b20
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002bf8
mov rsi, r10
test r8b, r8b
je 0x180002c10
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002b90
test r9b, r9b
je 0x180002c20
sub rsi, rcx
je 0x180002bf4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002bf0
test ebp, ebp
jne 0x180002bf0
add rbx, 1
cmp rsi, rbx
jne 0x180002bb0
jmp 0x180002bf4
test ebp, ebp
jne 0x180002b7c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002c10
jmp 0x180002c20
Function at 0x1800028b0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x1800028e2
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x1800028e2
nop word cs:[rax + rax]
jmp 0x1800028e0
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x1800029b8
mov rsi, r10
test r8b, r8b
je 0x1800029d0
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002950
test r9b, r9b
je 0x1800029e0
sub rsi, rcx
je 0x1800029b4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x1800029b0
test ebp, ebp
jne 0x1800029b0
add rbx, 1
cmp rsi, rbx
jne 0x180002970
jmp 0x1800029b4
test ebp, ebp
jne 0x18000293c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x1800029d0
jmp 0x1800029e0
Function at 0x140009870
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140009910
jmp 0x1400098ff
jae 0x1400099cf
cmp r8, 0x201
jae 0x140009910
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140009967
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14000993f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14002ab60
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140009990
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140009a3b
mov r8d, r13d
cmp r12, r8
jne 0x1400098f0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140009a6f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400098ff
jmp 0x140009910
cmp r14, r8
jb 0x140009a89
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.14000c150
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140009a24
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140002a20
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x140009a0f
jmp 0x140009a24
lea rcx, str.internal_error:_entered_unreachable_code__n
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14002b9a0
jmp 0x140009a9e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14002bcf0
ud2
Function at 0x14000a060
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
cmp byte [rcx], 0
je 0x14000a075
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14000a090
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.140012f50

Function at 0x14000f6a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.140029f10
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r15, rcx
lea r12, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm6, xmm6
lea r13, [rbp + 0xffc]
lea rbx, [0x140014e60]
lea r14, [rbp + 0xfb0]
mov rsi, qword [sym.imp.kernel32.dll_WriteFileEx]
mov rdi, qword [sym.imp.kernel32.dll_SleepEx]
mov qword [rbp + 0x1010], r15
mov r8d, 0x1000
mov rcx, r15
mov rdx, r12
call fcn.140014c30
mov r15, rdx
mov qword [rbp + 0xfd8], rax
mov qword [rbp + 0xfe0], rdx
test rax, rax
jne 0x14000f890
test r15, r15
je 0x14000f85c
cmp r15, 0x1000
ja 0x14000f8b2
xor r12d, r12d
nop word cs:[rax + rax]
mov r8d, r15d
sub r8d, r12d
lea rdx, [r12 + rbp]
add rdx, 0xffffffffffffffb0
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r13
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbp + 0x1008]
mov r9, r14
call rsi
test eax, eax
je 0x14000f830
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x14000f7c0
mov ecx, dword [rbp + 0x1000]
mov eax, dword [rbp + 0x1004]
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
xor r8d, r8d
test ecx, ecx
setne r8b
cmove rdx, rax
mov qword [rbp + 0xfe8], r8
mov qword [rbp + 0xff0], rdx
jne 0x14000f850
add r12, rax
cmp r12, r15
je 0x14000f820
jbe 0x14000f770
jmp 0x14000f89e
mov r15, qword [rbp + 0x1010]
lea r12, [rbp - 0x50]
jmp 0x14000f71e
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe8], 1
mov qword [rbp + 0xff0], rax
lea rcx, [rbp + 0xff0]
call fcn.140003d90
mov rsi, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xfe0]
call fcn.140003d90
jmp 0x14000f85c
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.14002bd00
jmp 0x14000f8c6
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.14002bcf0
ud2
Function at 0x140012f50
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.14001b250
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x140012fb0
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.14001c840
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x140012fbc
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x140012fe8
test rdi, rdi
je 0x140013014
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140002a20
xor eax, eax
jmp 0x140012fb3
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x140012fb3
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.140002a20
jmp 0x140012fb0
xor eax, eax
jmp 0x140012fb3
Function at 0x140013420
Capabilities:
Copy file

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, r9
mov rdi, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x38]
call fcn.14001b250
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x140013496
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov r8b, 1
call fcn.14001c840
mov rax, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
cmp rax, rbx
jne 0x1400134a9
mov eax, 1
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp], rax
mov qword [rbp - 8], rdx
lea rcx, [rbp - 0x38]
mov rdx, rdi
mov r8, rsi
call fcn.14001b250
mov rax, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
cmp rax, rbx
je 0x1400134fa
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov r8b, 1
call fcn.14001c840
mov rsi, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
cmp rsi, rbx
jne 0x14001352d
mov rcx, qword [rbp - 8]
mov r14, qword [rbp]
mov eax, 1
test r14, r14
je 0x14001349b
add r14, r14
mov r8d, 2
mov rsi, rdx
mov rdx, r14
call fcn.140002a20
mov eax, 1
mov rdx, rsi
jmp 0x14001349b
mov qword [rbp - 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x140013640]
lea r9, [rbp - 0x20]
mov rcx, qword [rbp - 8]
mov rbx, rcx
mov rdi, rdx
call qword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
mov r14, qword [rbp]
je 0x1400135b2
mov rdx, qword [rbp - 0x20]
test rsi, rsi
je 0x14001358c
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdi, rdx
mov rdx, rsi
call fcn.140002a20
mov rdx, rdi
test r14, r14
je 0x1400135ab
add r14, r14
mov r8d, 2
mov rcx, rbx
mov rsi, rdx
mov rdx, r14
call fcn.140002a20
mov rdx, rsi
xor eax, eax
jmp 0x14001349b
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
test rsi, rsi
je 0x1400135e1
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdi, rdx
mov rdx, rsi
call fcn.140002a20
mov rdx, rdi
mov rcx, rbx
mov eax, 1
test r14, r14
jne 0x14001350c
jmp 0x14001349b
Function at 0x140013660
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x140062c00]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140013698
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400136f6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140013723
test eax, eax
js 0x140013702
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140013719
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.14000bf20
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.140004360
mov ecx, 7
int 0x29
ud2