joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006f8e4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov r14, rcx
xor ebx, ebx
call qword [sym.imp.USER32.dll_GetFocus]
lea rdx, [0x1402e7970]
mov rcx, r14
mov rdi, rax
xor ebp, ebp
call qword [sym.imp.USER32.dll_GetPropW]
lea r12d, [rbx + 9]
mov rsi, rax
test rax, rax
je 0x14006f995
lea rdx, [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x14006f995
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x68], eax
jne 0x14006f995
mov rcx, qword [0x14036efe0]
lea rdx, [rsi - 1]
call fcn.140080a8c
mov rbx, rax
lea ebp, [r12 - 8]
cmp dword [rax + 0x20], 0
jle 0x14006f995
mov rcx, qword [rax + 8]
xor edx, edx
movsxd rax, dword [rax + 0x20]
add rcx, 4
cmp word [rcx - 2], r12w
jne 0x14006f985
mov r8d, 0xfa01
cmp word [rcx], r8w
je 0x14006f993
inc rdx
add rcx, 6
cmp rdx, rax
jge 0x14006f995
jmp 0x14006f972
xor ebp, ebp
mov sil, pe_nt_image_headers64
test rdi, rdi
je 0x14006fa65
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x14006fa65
mov ecx, setsockopt
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14006fa65
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14006fa65
mov ecx, setsockopt
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14006fa65
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
test ebp, ebp
jne 0x14006fa65
lea r8d, [rbp + 5]
lea rdx, str.RichE
lea rcx, [rsp + 0x20]
call fcn.14001ce40
test eax, eax
je 0x14006fa35
lea r8d, [rbp + 4]
lea rdx, str.RICHE
lea rcx, [rsp + 0x20]
call fcn.14001ce40
test eax, eax
jne 0x14006fa50
xor r9d, r9d
xor r8d, r8d
mov edx, 0x44e
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xb
jae 0x14006facc
lea rdx, str.Scintilla
lea rcx, [rsp + 0x20]
call fcn.140022774
test eax, eax
je 0x14006facc
test r14, r14
je 0x14006faa7
mov ecx, setsockopt
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14006fa9a
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
jne 0x14006fa9a
mov ecx, setsockopt
call qword [sym.imp.USER32.dll_GetKeyState]
test sil, al
je 0x14006faa7
mov edx, 1
mov rcx, r14
call fcn.14006fae8
test rdi, rdi
je 0x14006fac1
lea rdx, str.PB_Hotkey
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetPropW]
test rax, rax
jne 0x14006facc
test rbx, rbx
je 0x14006facc
mov rax, qword [rbx + 0x10]
jmp 0x14006face
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
Function at 0x140077f70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.140083360
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.14023e7ac
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x140077fa3
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140083440

Function at 0x140079184
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14036f4e0], eax
add rsp, 0x28
ret

Function at 0x14007a7e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x48], 0
mov rdx, rcx
mov rcx, qword [0x14036f500]
call fcn.140080a8c
mov rsi, rax
test rax, rax
je 0x14007a968
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.14007b340
cmp qword [rsi + 8], 0
lea rdx, [rsp + 0x50]
mov rdi, rax
je 0x14007a843
mov r8d, 4
mov rcx, rsi
call fcn.14007b3d0
mov rcx, rax
mov dword [rsp + 0x48], eax
jmp 0x14007a864
mov rcx, qword [rsi]
lea r9, [rsp + 0x48]
mov r8d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x50]
cmp ecx, 2
jl 0x14007a894
cmp ax, 0xfeff
jne 0x14007a894
lea rdx, [rdi + 2]
mov rcx, rbx
call fcn.14007b520
mov rdi, qword [rsp + 0x40]
mov eax, 0x19
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
cmp ecx, 3
jl 0x14007a8c7
cmp ax, 0xbbef
jne 0x14007a8c7
cmp byte [rsp + 0x52], 0xbf
jne 0x14007a8c7
lea rdx, [rdi + 3]
mov rcx, rbx
call fcn.14007b520
mov rdi, qword [rsp + 0x40]
mov eax, 2
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
cmp ecx, 2
jl 0x14007a8f3
cmp ax, 0xfffe
jne 0x14007a8f3
lea rdx, [rdi + 2]
mov rcx, rbx
call fcn.14007b520
mov rdi, qword [rsp + 0x40]
mov eax, 4
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
cmp ecx, 4
jl 0x14007a948
cmp eax, 0xfeff
jne 0x14007a920
lea rdx, [rdi + 4]
mov rcx, rbx
call fcn.14007b520
mov rdi, qword [rsp + 0x40]
mov eax, 5
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
cmp eax, 0xfffe0000
jne 0x14007a948
lea rdx, [rdi + 4]
mov rcx, rbx
call fcn.14007b520
mov rdi, qword [rsp + 0x40]
mov eax, 6
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rdx, rdi
mov rcx, rbx
call fcn.14007b520
mov rdi, qword [rsp + 0x40]
mov eax, 0x18
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rbx, qword [rsp + 0x58]
mov eax, 0x18
add rsp, 0x30
pop rsi
ret

Function at 0x14007a980
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, rcx
mov rcx, qword [0x14036f500]
call fcn.140080a8c
mov rbx, rax
test rax, rax
je 0x14007a9d3
cmp qword [rax + 8], 0
je 0x14007a9b2
cmp dword [rax + 0x1c], 0
jne 0x14007a9b2
mov rcx, rax
call fcn.14007adf0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [rsp + 0x38]
shl rcx, 0x20
mov eax, eax
or rax, rcx
add rsp, 0x20
pop rbx
ret
mov rax, 0xffffffffffffffff
add rsp, 0x20
pop rbx
ret
Function at 0x14007acd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov dword [rsp + 0x58], 0
mov rdx, rcx
mov rbx, r8
mov rcx, qword [0x14036f500]
call fcn.140080a8c
test rax, rax
je 0x14007ad38
cmp qword [rax + 8], 0
mov rdx, rdi
je 0x14007ad1e
mov r8, rbx
mov rcx, rax
call fcn.14007b3d0
cdqe
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x58]
mov r8d, ebx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14007ad50
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
mov rcx, qword [0x14036f500]
jne 0x14007ad70
add rsp, 0x30
pop rdi
jmp fcn.140080d88
mov rdx, rdi
mov qword [rsp + 0x48], rbx
call fcn.140080a8c
mov rbx, rax
test rax, rax
je 0x14007ade5
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14007adcd
xor eax, eax
mov dword [rsp + 0x40], eax
cmp dword [rbx + 0x1c], eax
jne 0x14007adba
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rbx + 0x14]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
mov r8, qword [rbx + 8]
xor edx, edx
mov rcx, qword [0x140366088]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14036f500]
mov rdx, rdi
call fcn.140080a20
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14007adf0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x40], eax
cmp dword [rcx + 0x1c], eax
jne 0x14007ae34
mov r8d, dword [rcx + 0x10]
lea r9, [rsp + 0x40]
sub r8d, dword [rcx + 0x14]
mov rdx, qword [rcx + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
movsxd rax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
cdqe
add rsp, 0x30
pop rbx
ret

Function at 0x14007ae80
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rdx, rcx
mov qword [rsp + 0x50], 0
mov rcx, qword [0x14036f500]
call fcn.140080a8c
test rax, rax
je 0x14007aee2
cmp qword [rax + 8], 0
lea rdx, [rsp + 0x50]
je 0x14007aec5
mov r8d, 8
mov rcx, rax
call fcn.14007b3d0
mov rax, qword [rsp + 0x50]
add rsp, 0x38
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x48]
mov r8d, 8
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rax, qword [rsp + 0x50]
add rsp, 0x38
ret
Function at 0x14007aef0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, rcx
xor ebx, ebx
mov rcx, qword [0x14036f500]
mov word [rsp + 0x48], bx
call fcn.140080a8c
test rax, rax
je 0x14007af4c
lea rdx, [rsp + 0x48]
cmp qword [rax + 8], rbx
je 0x14007af33
lea r8d, [rbx + 2]
mov rcx, rax
call fcn.14007b3d0
movzx eax, word [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x50]
mov r8d, 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, word [rsp + 0x48]
add rsp, 0x30
pop rbx
ret

Function at 0x14007af60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdx, rcx
xor edi, edi
mov rcx, qword [0x14036f500]
mov dword [rsp + 0x50], edi
call fcn.140080a8c
mov rbx, rax
test rax, rax
je 0x14007b005
cmp qword [rax + 8], rdi
je 0x14007afc7
lea r8d, [rdi + 1]
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.14007b3d0
test rax, rax
je 0x14007afb4
inc dword [rbx + 0x14]
movsxd rax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov edi, 1
movsxd rax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x58]
mov r8d, 1
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007b015
cmp dword [rsp + 0x58], edi
je 0x14007b015
mov rcx, qword [rbx]
mov r9d, 1
xor r8d, r8d
lea edx, [r9 - 2]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movsxd rax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffffff
cdqe
add rsp, 0x30
pop rdi
ret

Function at 0x14007b030
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov dword [rsp + 0x48], ebx
mov rsi, rdx
test rdx, rdx
je 0x14007b0a8
test r8d, r8d
je 0x14007b0a8
mov rdx, rcx
mov rcx, qword [0x14036f500]
call fcn.140080a8c
test rax, rax
je 0x14007b0a4
mov r8d, edi
mov rdx, rsi
cmp qword [rax + 8], rbx
je 0x14007b091
mov rcx, rax
call fcn.14007bc00
mov ebx, eax
cdqe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14007b0c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
sub rsp, 0x38
mov rdx, rcx
mov dword [rsp + 0x50], 0
mov rcx, qword [0x14036f500]
call fcn.140080a8c
test rax, rax
je 0x14007b11d
cmp qword [rax + 8], 0
lea rdx, [rsp + 0x48]
mov r8d, 8
je 0x14007b106
mov rcx, rax
call fcn.14007bc00
cdqe
add rsp, 0x38
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x50]
add rsp, 0x38
ret
Function at 0x14007b130
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov word [rsp + 0x48], dx
mov rdx, rcx
mov rcx, qword [0x14036f500]
mov dword [rsp + 0x50], 0
call fcn.140080a8c
test rax, rax
je 0x14007b18d
cmp qword [rax + 8], 0
lea rdx, [rsp + 0x48]
mov r8d, 2
je 0x14007b176
mov rcx, rax
call fcn.14007bc00
cdqe
add rsp, 0x38
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x50]
add rsp, 0x38
ret

Function at 0x14007b2f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
xor esi, esi
mov rbx, rcx
mov dword [rsp + 0x48], esi
test rdx, rdx
je 0x14007b297
cmp word [rdx], si
je 0x14007b297
test r8d, r8d
jne 0x14007b1ce
mov r8d, dword [rcx + 0x20]
cmp r8d, 0x19
jne 0x14007b22e
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rdx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14007b1e0
lea r8d, [rax + rax]
cmp qword [rcx + 8], rsi
je 0x14007b20b
call fcn.14007bc00
mov dword [rsp + 0x48], eax
cdqe
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
mov rcx, qword [rcx]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp r8d, 2
mov qword [rsp + 0x40], rdi
mov ecx, 0xfde9
lea r8, [rsp + 0x58]
cmovne ecx, esi
call fcn.14007bd10
mov rdi, rax
test rax, rax
je 0x14007b292
mov rdx, rax
mov r8d, dword [rsp + 0x58]
cmp qword [rbx + 8], rsi
je 0x14007b26d
mov rcx, rbx
call fcn.14007bc00
mov dword [rsp + 0x48], eax
jmp 0x14007b280
mov rcx, qword [rbx]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x140366088]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x40]
movsxd rax, dword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebx, r8d
mov rdx, rcx
mov rcx, qword [0x14036f500]
call fcn.140080a8c
test rax, rax
je 0x14007b32c
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14007b1a0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14007b3d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
mov rdi, r8
mov r15, rdx
mov r14, rcx
cmp dword [rcx + 0x1c], ebp
jne 0x14007b407
call fcn.14007adf0
mov dword [r14 + 0x1c], 1
mov dword [r14 + 0x14], ebp
movsxd r12, dword [r14 + 0x14]
mov eax, dword [r14 + 0x18]
mov rbx, r12
sub eax, r12d
movsxd rdx, eax
add rdx, qword [r14 + 8]
cmp r12, rdi
jl 0x14007b480
mov rax, rdi
sub rax, 1
je 0x14007b471
sub rax, 1
je 0x14007b45e
cmp rax, 2
je 0x14007b44d
mov r8, rdi
mov rcx, r15
call fcn.14002b6c0
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x14007b4fa
mov eax, dword [rdx]
mov dword [r15], eax
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x14007b4fa
movzx eax, word [rdx]
mov word [r15], ax
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x14007b4fa
movzx eax, byte [rdx]
mov byte [r15], al
sub dword [r14 + 0x14], edi
movsxd rax, edi
jmp 0x14007b4fa
mov r8, rbx
mov rcx, r15
call fcn.14002b6c0
movsxd r8, dword [r14 + 0x10]
lea r9, [rsp + 0x60]
mov rcx, qword [r14]
add r15, rbx
sub rdi, rbx
mov qword [rsp + 0x20], rbp
cmp rdi, r8
jl 0x14007b4c0
mov r8d, edi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x60]
add eax, r12d
mov dword [r14 + 0x14], ebp
jmp 0x14007b4f8
mov rdx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x60]
mov rcx, r15
mov rdx, qword [r14 + 8]
cmp rdi, rax
mov rbx, rax
mov dword [r14 + 0x14], eax
cmovle rbx, rdi
mov dword [r14 + 0x18], eax
mov r8, rbx
call fcn.14002b6c0
sub dword [r14 + 0x14], ebx
lea eax, [rbx + r12]
cdqe
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14007b620
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r12d, edx
mov r14, rcx
mov r15d, 0x1000
mov rcx, qword [0x140366088]
mov r8d, r15d
xor edx, edx
mov r13, r9
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14007b7fb
movzx r8d, byte [rsp + 0x30]
mov qword [rsp + 0x70], rbx
mov rbx, rax
mov qword [rsp + 0x78], rdi
cmp rsi, 0xffffffffffffffff
je 0x14007b687
test rsi, rsi
je 0x14007b750
dec rsi
cmp qword [r14 + 8], 0
lea rdi, [r14 + 8]
lea rdx, [rsp + 0x30]
je 0x14007b6ab
mov r8d, 1
mov rcx, r14
call fcn.14007b3d0
mov dword [rsp + 0x34], eax
jmp 0x14007b6cc
mov rcx, qword [r14]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x34]
movzx r8d, byte [rsp + 0x30]
cmp eax, 1
jne 0x14007b754
test r8b, r8b
je 0x14007b6e8
mov byte [rbx], r8b
inc rbx
movzx r8d, byte [rsp + 0x30]
mov rdx, rbx
lea eax, [r15 - 1]
sub rdx, rbp
movsxd rcx, eax
cmp rdx, rcx
jle 0x14007b72a
mov rcx, qword [0x140366088]
add r15d, 0x1000
movsxd r9, r15d
mov r8, rbp
mov edx, 8
sub ebx, ebp
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx r8d, byte [rsp + 0x30]
mov rbp, rax
movsxd rbx, ebx
add rbx, rax
test r8b, r8b
je 0x14007b754
test r12d, r12d
jne 0x14007b675
cmp r8b, 0xd
je 0x14007b75d
cmp r8b, 0xa
jne 0x14007b675
dec rbx
jmp 0x14007b7e1
lea rdi, [r14 + 8]
test r12d, r12d
jne 0x14007b7e1
cmp r8b, 0xa
jne 0x14007b768
dec rbx
jmp 0x14007b7e1
cmp r8b, 0xd
jne 0x14007b7e1
dec rbx
lea rdx, [rsp + 0x30]
cmp qword [rdi], 0
je 0x14007b790
mov r8d, 1
mov rcx, r14
call fcn.14007b3d0
mov dword [rsp + 0x34], eax
jmp 0x14007b7ad
mov rcx, qword [r14]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rsp + 0x30], 0xa
je 0x14007b7e1
cmp qword [rdi], 0
je 0x14007b7c0
inc dword [r14 + 0x14]
jmp 0x14007b7e1
mov rcx, qword [r14]
lea r8, [rsp + 0x3c]
mov r9d, 1
mov qword [rsp + 0x38], 0xffffffffffffffff
lea edx, [r9 - 2]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rdi, qword [rsp + 0x78]
mov rax, rbx
sub rax, rbp
mov qword [r13], rax
mov rax, rbp
mov byte [rbx], 0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x14007b820
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbp, r8
mov r12d, edx
mov r14, rcx
xor edx, edx
mov rcx, qword [0x140366088]
mov r8d, 0x1000
xor edi, edi
mov r13d, 0x800
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x14007ba18
movzx edx, word [rsp + 0x30]
mov qword [rsp + 0x70], rbx
mov rbx, rax
mov qword [rsp + 0x78], rsi
nop dword [rax + rax]
cmp rbp, 0xffffffffffffffff
je 0x14007b892
test rbp, rbp
je 0x14007b958
dec rbp
cmp qword [r14 + 8], 0
lea rsi, [r14 + 8]
lea rdx, [rsp + 0x30]
je 0x14007b8b6
mov r8d, 2
mov rcx, r14
call fcn.14007b3d0
mov dword [rsp + 0x34], eax
jmp 0x14007b8d3
mov rcx, qword [r14]
lea r9, [rsp + 0x34]
mov r8d, 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x34]
movzx edx, word [rsp + 0x30]
cmp eax, 2
jne 0x14007b95c
test dx, dx
je 0x14007b8ee
mov word [rbx], dx
add rbx, 2
movzx edx, word [rsp + 0x30]
mov rdi, rbx
lea eax, [r13 - 1]
sub rdi, r15
movsxd rcx, eax
sar rdi, 1
cmp rdi, rcx
jle 0x14007b934
mov rcx, qword [0x140366088]
add r13d, 0x800
movsxd r9, r13d
mov r8, r15
add r9, r9
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx edx, word [rsp + 0x30]
mov r15, rax
movsxd rax, edi
lea rbx, [r15 + rax*2]
test dx, dx
je 0x14007b95c
mov edi, 0
test r12d, r12d
jne 0x14007b880
cmp dx, 0xd
je 0x14007b961
cmp dx, 0xa
je 0x14007b967
jmp 0x14007b880
lea rsi, [r14 + 8]
test r12d, r12d
jne 0x14007b96b
cmp dx, 0xa
jne 0x14007b996
sub rbx, 2
xor edi, edi
mov rcx, qword [rsp + 0x88]
mov rax, rbx
mov rsi, qword [rsp + 0x78]
sub rax, r15
sar rax, 1
mov qword [rcx], rax
mov rax, r15
mov word [rbx], di
mov rbx, qword [rsp + 0x70]
jmp 0x14007ba1b
cmp dx, 0xd
jne 0x14007b96b
sub rbx, 2
lea rdx, [rsp + 0x30]
cmp qword [rsi], 0
je 0x14007b9c1
mov r8d, 2
mov rcx, r14
call fcn.14007b3d0
mov dword [rsp + 0x34], eax
xor edi, edi
jmp 0x14007b9da
mov rcx, qword [r14]
lea r9, [rsp + 0x34]
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r8d, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [rsp + 0x30], 0xa
je 0x14007b96d
cmp qword [rsi], 0
je 0x14007b9f2
add dword [r14 + 0x14], 2
jmp 0x14007b96d
mov rcx, qword [r14]
lea r8, [rsp + 0x3c]
mov r9d, 1
mov qword [rsp + 0x38], 0xfffffffffffffffe
lea edx, [r9 - 3]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x14007b96d
mov rax, rdi
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14007ba40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, r8
mov r15d, edx
mov rsi, rcx
mov r14d, 0x1000
mov rcx, qword [0x140366088]
mov r8d, r14d
xor edx, edx
mov r12, r9
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14007bbda
movzx r8d, byte [rsp + 0x30]
mov qword [rsp + 0x60], rbx
mov rbx, rax
cmp rdi, 0xffffffffffffffff
je 0x14007baa9
test rdi, rdi
je 0x14007bb37
dec rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14007bdd0
mov dword [rsp + 0x34], eax
test eax, eax
jne 0x14007bac1
xor r8b, r8b
jmp 0x14007bac5
movzx r8d, byte [rbx]
cdqe
add rbx, rax
mov byte [rsp + 0x30], r8b
mov rdx, rbx
lea eax, [r14 - 5]
sub rdx, rbp
movsxd rcx, eax
cmp rdx, rcx
jle 0x14007bb11
mov rcx, qword [0x140366088]
add r14d, 0x1000
movsxd r9, r14d
mov r8, rbp
mov edx, 8
sub ebx, ebp
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx r8d, byte [rsp + 0x30]
mov rbp, rax
movsxd rbx, ebx
add rbx, rax
test r8b, r8b
je 0x14007bb37
test r15d, r15d
jne 0x14007ba97
cmp r8b, 0xd
je 0x14007bb40
cmp r8b, 0xa
jne 0x14007ba97
dec rbx
jmp 0x14007bbc5
test r15d, r15d
jne 0x14007bbc5
cmp r8b, 0xa
jne 0x14007bb4b
dec rbx
jmp 0x14007bbc5
cmp r8b, 0xd
jne 0x14007bbc5
dec rbx
lea rdx, [rsp + 0x30]
cmp qword [rsi + 8], 0
je 0x14007bb74
mov r8d, 1
mov rcx, rsi
call fcn.14007b3d0
mov dword [rsp + 0x34], eax
jmp 0x14007bb91
mov rcx, qword [rsi]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rsp + 0x30], 0xa
je 0x14007bbc5
cmp qword [rsi + 8], 0
je 0x14007bba4
inc dword [rsi + 0x14]
jmp 0x14007bbc5
mov rcx, qword [rsi]
lea r8, [rsp + 0x3c]
mov r9d, 1
mov qword [rsp + 0x38], 0xffffffffffffffff
lea edx, [r9 - 2]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rax, rbx
sub rax, rbp
mov qword [r12], rax
mov rax, rbp
mov byte [rbx], 0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x14007bc00
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x38
xor ebp, ebp
movsxd rbx, r8d
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x60], ebp
cmp dword [rcx + 0x24], ebp
jne 0x14007bcfa
cmp dword [rcx + 0x1c], 1
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r15
jne 0x14007bc5b
mov eax, dword [rcx + 0x14]
lea r9d, [rbp + 1]
mov rcx, qword [rcx]
lea r8, [rsp + 0x7c]
neg eax
cdqe
mov edx, eax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [rsi + 0x10]
mov dword [rsi + 0x14], eax
mov dword [rsi + 0x1c], ebp
mov ecx, dword [rsi + 0x14]
cmp ecx, ebx
jle 0x14007bcbc
mov eax, dword [rsi + 0x10]
mov edx, ebx
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rsi + 8]
sub edx, 1
je 0x14007bcb4
sub edx, 1
je 0x14007bcab
cmp edx, 2
je 0x14007bca4
mov r8, rbx
mov rdx, r14
call fcn.14002b6c0
sub dword [rsi + 0x14], ebx
mov rax, rbx
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [r14]
mov dword [rcx], eax
jmp 0x14007bc8a
movzx eax, word [r14]
mov word [rcx], ax
jmp 0x14007bc8a
movzx eax, byte [r14]
mov byte [rcx], al
jmp 0x14007bc8a
mov rcx, rsi
call fcn.14007adf0
mov eax, dword [rsi + 0x10]
mov rdx, r14
cmp ebx, eax
jl 0x14007bceb
mov rcx, qword [rsi]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x60]
jmp 0x14007bc90
sub eax, dword [rsi + 0x14]
mov r8, rbx
movsxd rcx, eax
add rcx, qword [rsi + 8]
jmp 0x14007bc85
movsxd rax, ebp
add rsp, 0x38
pop r14
pop rsi
pop rbp
pop rbx
ret