joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002230
Capabilities:
Check mutex on windows
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rax, rdx
xorps xmm0, xmm0
mov qword [rsp + 0x30], rbp
mov rdi, rcx
mov dword [rsp + 0x28], 0x10000080
movups xmmword [rcx], xmm0
lea r8d, [rbp + 3]
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov esi, ebp
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400022cf
mov ebx, ebp
xor dil, dil
test rbx, rbx
je 0x14000229a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x1400022b6
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
movzx eax, dil
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
test rbx, rbx
je 0x140002289
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rcx, rbx
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x140002305
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140002289
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], ebp
mov r8d, 4
mov qword [rsp + 0x20], rbp
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002289
cmp dword [rsp + 0x60], 4
jne 0x140002289
lea rdx, [rdi + 4]
mov dword [rsp + 0x60], ebp
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbp
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002289
cmp dword [rsp + 0x60], 4
jne 0x140002289
lea rdx, [rdi + 8]
mov dword [rsp + 0x60], ebp
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbp
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002289
cmp dword [rsp + 0x60], 4
jne 0x140002289
lea rdx, [rdi + 0xc]
mov dword [rsp + 0x60], ebp
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbp
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140002289
cmp dword [rsp + 0x60], 4
jne 0x140002289
mov dil, 1
jmp 0x14000228c
Function at 0x140002430
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
movzx edi, r8b
mov rcx, qword [rcx + 8]
mov rsi, rdx
test rcx, rcx
je 0x14000245d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
xor ebp, ebp
test rcx, rcx
je 0x140002481
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rbp
mov edx, 0xc0000000
mov qword [rsp + 0x30], rbp
mov eax, 0x80000000
mov dword [rsp + 0x28], 0x10000080
test dil, dil
mov qword [rbx + 8], rbp
mov rcx, rsi
mov dword [rsp + 0x20], 3
cmove edx, eax
xor r9d, r9d
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x1400024ca
mov qword [rbx + 8], rbp
jmp 0x1400024fd
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400024ec
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rbp
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbx + 0x10], rax
cmp qword [rbx + 8], rbp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
setne al
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140002560
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14000259d
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 2]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000259d
cmp dword [rsp + 0x40], 2
jne 0x14000259d
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret

Function at 0x1400025f0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14000262d
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000262d
cmp dword [rsp + 0x40], 4
jne 0x14000262d
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret

Function at 0x140002680
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400026bd
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400026bd
cmp dword [rsp + 0x40], 8
jne 0x1400026bd
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret
Function at 0x1400026d0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
mov ebx, r8d
test rcx, rcx
je 0x14000270a
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000270a
cmp dword [rsp + 0x40], ebx
jne 0x14000270a
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140002780
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov ebx, r8d
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400027be
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400027be
cmp dword [rsp + 0x40], ebx
jne 0x1400027be
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140002810
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14000284d
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000284d
cmp dword [rsp + 0x40], 1
jne 0x14000284d
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret

Function at 0x1400028c0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x30
mov rsi, qword [rcx + 8]
mov rbx, rdx
mov byte [rdx], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000296d
xor ebp, ebp
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x20], rbp
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000296d
cmp dword [rsp + 0x58], 1
jne 0x14000296d
movzx eax, byte [rsp + 0x50]
mov qword [rsp + 0x68], rdi
test al, al
je 0x14000294f
mov rcx, qword [rsi + 8]
mov edi, eax
test rcx, rcx
je 0x14000295e
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], ebp
mov r8d, eax
mov qword [rsp + 0x20], rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000295e
cmp dword [rsp + 0x60], edi
jne 0x14000295e
movzx eax, byte [rsp + 0x50]
mov byte [rax + rbx], bpl
mov rdi, qword [rsp + 0x68]
mov al, 1
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
xor al, al
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret

Function at 0x140002a40
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140002a5e
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140002a5e
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x140002c60
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140002c99
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002c99
cmp dword [rsp + 0x40], 4
jne 0x140002c99
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret
Function at 0x140002ca0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
mov ebx, r8d
test rcx, rcx
je 0x140002cda
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002cda
cmp dword [rsp + 0x40], ebx
jne 0x140002cda
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140002cf0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
sub rsp, 0x38
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x140002d1b
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140002d10
jmp 0x140002d1d
xor al, al
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x50], al
test rcx, rcx
je 0x140002da9
xor ebp, ebp
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x20], rbp
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002da9
cmp dword [rsp + 0x58], 1
jne 0x140002da9
movzx eax, byte [rsp + 0x50]
test al, al
je 0x140002d96
mov rcx, qword [rsi + 8]
mov edi, eax
test rcx, rcx
je 0x140002da9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], ebp
mov r8d, eax
mov qword [rsp + 0x20], rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002da9
cmp dword [rsp + 0x58], edi
jne 0x140002da9
mov al, 1
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
add rsp, 0x38
pop rsi
pop rbx
ret
mov rdi, qword [rsp + 0x30]
xor al, al
mov rbp, qword [rsp + 0x60]
add rsp, 0x38
pop rsi
pop rbx
ret

Function at 0x140002dc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
lea r8, [rsp + 0x48]
xor r9d, r9d
mov rdi, rcx
mov rcx, qword [rbx + 8]
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x140002e07
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002df5
xor esi, esi
lea r9, [rsp + 0x48]
mov rdx, rdi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002df5
cmp dword [rsp + 0x48], 4
jne 0x140002df5
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002df5
lea rdx, [rdi + 4]
mov dword [rsp + 0x48], esi
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002df5
cmp dword [rsp + 0x48], 4
jne 0x140002df5
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002df5
lea rdx, [rdi + 8]
mov dword [rsp + 0x48], esi
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140002df5
cmp dword [rsp + 0x48], 4
jne 0x140002df5
lea rdx, [rdi + 0xc]
mov rcx, rbx
call fcn.140002c60
test al, al
je 0x140002df5
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140006120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x374], 0xffffffff
add rcx, 0x1c
xor edx, edx
mov r8d, 0x100
xor edi, edi
call fcn.140049a70
cmp dword [rbx + 0x374], 0xdbb8c
jge 0x1400063aa
lea r11, section..data
cmp edi, 0x101
je 0x1400063aa
cmp byte [rbx + 0x7a4], 0
je 0x140006186
mov r9d, dword [rbx + 0x7a0]
mov byte [rbx + 0x7a4], 0
jmp 0x1400061a1
movsxd rdx, dword [rbx + 0x18]
cmp edx, dword [rbx + 0x14]
jge 0x140006395
mov rax, qword [rbx]
movzx r9d, byte [rdx + rax]
lea eax, [rdx + 1]
mov dword [rbx + 0x18], eax
cmp r9d, 0xffffffff
je 0x140006395
xor edx, edx
nop dword [rax]
cmp byte [rbx + 0x7a4], 0
je 0x1400061c8
mov ecx, dword [rbx + 0x7a0]
mov byte [rbx + 0x7a4], 0
jmp 0x1400061e1
movsxd r8, dword [rbx + 0x18]
cmp r8d, dword [rbx + 0x14]
jge 0x140006204
mov rax, qword [rbx]
movzx ecx, byte [r8 + rax]
lea eax, [r8 + 1]
mov dword [rbx + 0x18], eax
inc edx
cmp r9d, ecx
jne 0x1400061f0
cmp edx, 0xff
jl 0x1400061b0
cmp ecx, 0xffffffff
je 0x140006206
mov byte [rbx + 0x7a4], 1
mov dword [rbx + 0x7a0], ecx
jmp 0x140006206
inc edx
cmp edx, 1
jne 0x140006234
mov edx, dword [rbx + 0x370]
mov ecx, edx
movzx eax, r9b
shr rcx, 0x18
xor rcx, rax
shl edx, 8
xor edx, dword [r11 + rcx*4]
mov dword [rbx + 0x370], edx
or r9d, 0x10000
jmp 0x140006272
jl 0x14000626c
mov ecx, dword [rbx + 0x370]
movzx r10d, r9b
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
mov eax, ecx
shr rax, 0x18
xor rax, r10
shl ecx, 8
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x140006250
mov dword [rbx + 0x370], ecx
shl edx, 0x10
or r9d, edx
mov edx, r9d
movzx edi, r9w
shr edx, 0x10
cmp edi, 0x101
je 0x14000639a
mov ecx, edx
mov byte [rdi + rbx + 0x1c], 1
sub ecx, 1
je 0x140006377
sub ecx, 1
je 0x14000635b
cmp ecx, 1
je 0x14000633f
mov byte [rdx + rbx + 0x18], 1
sub dl, 4
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dl
jmp 0x14000639a
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
jmp 0x14000639a
mov edi, 0x101
cmp dword [rbx + 0x374], 0xdbb8c
jl 0x140006161
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140009520
Capabilities:
Delete file

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x170
mov rax, qword [0x1400a68b8]
xor rax, rsp
mov qword [rsp + 0x150], rax
cmp dword [rcx + 0x398], 0
movzx r14d, r8b
mov edi, edx
mov rbx, rcx
je 0x14000955a
mov eax, 3
jmp 0x14000970d
mov eax, dword [rcx]
test eax, eax
jne 0x14000970d
lea eax, [rdx - 0xac44]
cmp eax, 0x241bc
ja 0x140009708
cmp r9d, 7
ja 0x140009708
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140009701
mov r8, qword [rbx + 0x28]
test r8, r8
je 0x140009701
mov qword [rsp + 0x1a8], rbp
lea rdx, str._s_c_s__05X.ml_c
mov dword [rbx + 0x58], r9d
test r14b, r14b
mov qword [rsp + 0x168], rsi
mov ebp, 0x6e
mov qword [rsp + 0x160], r15
mov r15d, 0x72
mov eax, r15d
mov dword [rbx + 0x5c], edi
cmovne eax, ebp
mov byte [rbx + 0x60], r14b
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
lea r9d, [r15 - 0x43]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.14000c4f0
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x68]
call fcn.14000dd90
test al, al
jne 0x14000960e
lea rcx, [rsp + 0x40]
call sub.KERNEL32.dll_DeleteFileA
mov rax, qword [rbx + 0x20]
lea rdx, str._s_c_s__05X.ml_c
mov r8, qword [rbx + 0x28]
lea rcx, [rsp + 0x40]
test r14b, r14b
mov r9d, 0x2f
cmovne ebp, r15d
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call fcn.14000c4f0
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x68]
call fcn.14000dd90
mov r15, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x1a8]
test al, al
jne 0x14000966d
lea rcx, [rsp + 0x40]
call sub.KERNEL32.dll_DeleteFileA
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x68]
call fcn.14000dd90
mov rsi, qword [rsp + 0x168]
test al, al
jne 0x1400096fd
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000969d
call fcn.140055b28
mov qword [rbx + 0x30], 0
lea rcx, [rsp + 0x40]
call fcn.140001360
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x1400096b7
mov eax, 4
jmp 0x14000970d
mov rcx, qword [rbx + 0x28]
call fcn.140013700
lea rcx, [rbx + 0x1e0]
mov r8d, 0x55454752
lea rdx, [rsp + 0x40]
call fcn.14000ce60
test al, al
jne 0x1400096e2
mov eax, 8
jmp 0x14000970d
lea rcx, [rbx + 0x358]
mov dword [rbx + 0x398], 2
mov edx, 1
call fcn.140002a70
xor eax, eax
jmp 0x14000970d
mov eax, 1
jmp 0x14000970d
mov eax, 6
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14001e120
add rsp, 0x170
pop r14
pop rdi
pop rbx
ret
Function at 0x14000c0a0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1400a68b8]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea eax, [rdx - 0xac44]
mov edi, edx
mov rbx, rcx
cmp eax, 0x241bc
ja 0x14000c207
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x14000c200
mov rdx, qword [rbx + 0x28]
test rdx, rdx
je 0x14000c200
test r8d, r8d
je 0x14000c1fc
sub r8d, 1
je 0x14000c1b5
sub r8d, 1
je 0x14000c1ab
cmp r8d, 1
jne 0x14000c207
mov dword [rsp + 0x30], 0x72
lea r9d, [r8 + 0x2e]
mov r8, rdx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rcx
lea rdx, str._s_c_s__05X.ml_c
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x180], rsi
call fcn.14000c4f0
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x68]
call fcn.14000dd90
test al, al
jne 0x14000c163
lea rcx, [rsp + 0x40]
call sub.KERNEL32.dll_DeleteFileA
mov rax, qword [rbx + 0x20]
lea rdx, str._s_c_s__05X.ml_c
mov r8, qword [rbx + 0x28]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], 0x6e
mov r9d, 0x2f
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call fcn.14000c4f0
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x68]
call fcn.14000dd90
mov rsi, qword [rsp + 0x180]
jmp 0x14000c1ee
mov dword [rsp + 0x30], 0x72
jmp 0x14000c1bd
mov dword [rsp + 0x30], 0x6e
mov r8, rdx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rcx
lea rdx, str._s_c_s__05X.ml_c
lea rcx, [rsp + 0x40]
mov r9d, 0x2f
call fcn.14000c4f0
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x68]
call fcn.14000dd90
test al, al
jne 0x14000c1fc
lea rcx, [rsp + 0x40]
call sub.KERNEL32.dll_DeleteFileA
xor eax, eax
jmp 0x14000c20c
mov eax, 1
jmp 0x14000c20c
mov eax, 6
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14001e120
mov rbx, qword [rsp + 0x188]
add rsp, 0x160
pop rdi
ret

Function at 0x14000e0e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x440
mov rax, qword [0x1400a68b8]
xor rax, rsp
mov qword [rsp + 0x430], rax
call fcn.140059e04
lea rbx, [rsp + 0x468]
mov edi, dword [rax]
call fcn.14000c4e0
mov r9, qword [rsp + 0x460]
lea rdx, [rsp + 0x30]
mov rsi, 0xffffffffffffffff
mov qword [rsp + 0x28], rbx
mov r8, rsi
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
or rcx, 1
call fcn.140058c38
mov ecx, edi
mov ebx, eax
call fcn.140059e90
mov r9, rax
lea rcx, [rsp + 0x30]
test ebx, ebx
lea rdx, str._error__d:__s_n
mov r8d, edi
cmovs ebx, esi
movsxd rax, ebx
add rcx, rax
call fcn.14000c4f0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14001e120
add rsp, 0x440
pop rdi
pop rsi
pop rbx
ret
Function at 0x140011cb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
lea rdx, [rcx + 0x20]
mov rcx, rbx
call fcn.140002cf0
test al, al
je 0x140011d1b
lea rdx, [rdi + 0x230]
mov r8d, 4
mov rcx, rbx
call fcn.140002ca0
test al, al
je 0x140011d1b
lea rdx, [rdi + 0x234]
mov r8d, 4
mov rcx, rbx
call fcn.140002ca0
test al, al
je 0x140011d1b
lea rdx, [rdi + 0x120]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140012870
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x140011d30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
lea rdx, [rcx + 0x20]
mov rcx, rbx
call fcn.140002cf0
test al, al
je 0x140011de4
lea rdx, [rdi + 0x120]
mov rcx, rbx
call fcn.140002cf0
test al, al
je 0x140011de4
lea rdx, [rdi + 0x330]
mov r8d, 4
mov rcx, rbx
call fcn.140002ca0
test al, al
je 0x140011de4
lea rdx, [rdi + 0x334]
mov r8d, 4
mov rcx, rbx
call fcn.140002ca0
test al, al
je 0x140011de4
lea rdx, [rdi + 0x338]
mov r8d, 4
mov rcx, rbx
call fcn.140002ca0
test al, al
je 0x140011de4
lea rdx, [rdi + 0x33c]
mov r8d, 4
mov rcx, rbx
call fcn.140002ca0
test al, al
je 0x140011de4
lea rdx, [rdi + 0x220]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140012870
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x140011e00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
lea rdx, [rcx + 0x130]
mov r8d, 4
mov rcx, rbx
call fcn.140002ca0
test al, al
je 0x140011e9b
lea rdx, [rdi + 0x134]
mov r8d, 4
mov rcx, rbx
call fcn.140002ca0
test al, al
je 0x140011e9b
lea rdx, [rdi + 0x138]
mov r8d, 4
mov rcx, rbx
call fcn.140002ca0
test al, al
je 0x140011e9b
lea rdx, [rdi + 0x13c]
mov r8d, 4
mov rcx, rbx
call fcn.140002ca0
test al, al
je 0x140011e9b
mov rdx, qword [rdi + 0x140]
mov r8d, 4
mov rcx, rbx
test rdx, rdx
jne 0x140011ea8
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0x30]
call fcn.140002ca0
test al, al
jne 0x140011ec7
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.140002ca0
test al, al
je 0x140011e9b
mov rdx, qword [rdi + 0x140]
mov rcx, rbx
mov r8d, dword [rdx]
call fcn.140002ca0
test al, al
je 0x140011e9b
lea rdx, [rdi + 0x148]
mov r8d, 4
mov rcx, rbx
call fcn.140002ca0
test al, al
je 0x140011e9b
lea rdx, [rdi + 0x20]
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140012870

Function at 0x140011f00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
lea rdx, [rcx + 0x20]
mov rcx, rbx
call fcn.140002cf0
test al, al
je 0x140011f52
lea rdx, [rdi + 0x230]
mov r8d, 4
mov rcx, rbx
call fcn.140002ca0
test al, al
je 0x140011f52
lea rdx, [rdi + 0x120]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140012870
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret