joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028be0
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rdi, [rcx + 8]
mov rbx, rdx
mov rsi, rcx
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.1400260ac
mov r8, qword [rax]
cmp qword [r8 + 0x28], 0
je 0x140028c3c
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.1400260ac
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.1400260ac
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x140028c8b
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.1400260ac
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.1400260ac
mov rcx, qword [rax]
and qword [rcx + 0x30], 0
cmp qword [rbx + 0x18], 8
jb 0x140028c95
mov rbx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], 0x20000
or rcx, 0xffffffffffffffff
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
mov rbx, rax
call fcn.1400260ac
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x10]
mov rcx, qword [rax]
mov qword [rcx + 0x28], rbx
mov rcx, rdi
call fcn.1400260ac
mov rcx, qword [rax]
cmp qword [rcx + 0x28], 0
je 0x140028d33
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.1400260ac
xor r9d, r9d
mov qword [rsp + 0x20], 0x20000
xor r8d, r8d
mov rcx, qword [rax]
lea edx, [r9 + 6]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
mov rbx, rax
call fcn.1400260ac
mov rdx, qword [rax]
mov qword [rdx + 0x30], rbx
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.1400260ac
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
setne al
mov byte [rsi + 0x20], al
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x14002eb04
Capabilities:
Load windows common language runtime

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp qword [0x1400dbe78], rbx
jne 0x14002ebaf
and qword [rsp + 0x38], rbx
lea r8, [rsp + 0x38]
lea rdx, [0x1400a42c8]
lea rcx, [0x1400a42d8]
call sub.mscoree.dll_CLRCreateInstance
mov ebx, eax
test eax, eax
js 0x14002ebaf
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
and qword [rsp + 0x30], 0
lea r8, [0x1400a42e8]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x14002eba4
mov rcx, qword [rsp + 0x30]
lea r9, [0x1400dbe78]
lea r8, [0x1400a42b8]
lea rdx, [0x1400a42a8]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14002eb99
mov rcx, qword [0x1400dbe78]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14002ebb8
Capabilities:
Load windows common language runtime

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp qword [0x1400dbe78], rbx
jne 0x14002ec04
lea rax, [0x1400dbe78]
xor edx, edx
lea r9, [0x1400a42b8]
mov qword [rsp + 0x20], rax
lea r8, [0x1400a42a8]
lea rcx, str.v2.0.50727
call sub.mscoree.dll_CorBindToRuntime
mov ebx, eax
test eax, eax
js 0x14002ec04
mov rcx, qword [0x1400dbe78]
mov rdx, qword [rcx]
call qword [rdx + 0x50]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140032964
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1400d9448]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov edi, r9d
mov esi, r8d
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x48], rdx
mov rcx, qword [rcx + 8]
xor r15d, r15d
test rcx, rcx
je 0x1400329ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp - 0x70]
call fcn.140074190
mov r8d, esi
lea rdx, [0x1400a0e90]
lea rcx, [rbp - 0x70]
call fcn.1400261f8
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 9
jb 0x140032b74
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400329f9
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str..pipe_
mov r8, rbx
mov dl, byte [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140007b1c
nop
lea rax, [rbp - 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x140032a2d
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.140021a48
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rcx, [rsp + 0x70]
call fcn.140021660
mov esi, 0xa
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, esi
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x140032aab
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140032aab
test edi, edi
jg 0x140032a75
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 8], rax
cmp rax, 0xffffffffffffffff
setne dil
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140032b2c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032b27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032b6e
call fcn.1400716ac
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov rcx, rbx
call fcn.140021660
mov al, dil
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140071cb0
mov rbx, qword [rsp + 0x168]
add rsp, 0x120
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400780a4
nop
call fcn.140021918
int3
Function at 0x1400349a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdi, [0x1400dbf10]
mov qword [rsp + 0x48], rdi
mov rcx, rdi
call fcn.14006f25c
test eax, eax
jne 0x140034a14
lea edx, [rax + 5]
mov rcx, rbx
call fcn.14003c854
lea rax, [0x140034470]
mov qword [rsp + 0x50], rax
and dword [rsp + 0x48], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, 8
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14006f264
mov ecx, eax
call fcn.14006f370
int3

Function at 0x140034a1c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
lea rbx, [rcx + 0x658]
mov r8, rbx
lea rdx, str.Cover
mov ecx, 0x75
call fcn.14003c814
mov rax, qword [rbx + 8]
cmp rax, qword [rbx]
je 0x140034ae3
lea rsi, [0x1400dbf10]
mov qword [rsp + 0x40], rsi
mov rcx, rsi
call fcn.14006f25c
test eax, eax
jne 0x140034af3
lea edx, [rax + 3]
mov rcx, rdi
call fcn.14003c854
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
mov dword [rsp + 0x48], eax
and dword [rsp + 0x40], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
and dword [rsp + 0x40], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 8
lea rdx, [rsp + 0x48]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rsi
call fcn.14006f264
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call fcn.14006f370
int3

Function at 0x140034afc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rdi, rdx
mov rbx, rcx
lea r14, [0x1400dbf10]
mov qword [rbp - 0x30], r14
mov rcx, r14
call fcn.14006f25c
test eax, eax
jne 0x140034bdb
lea edx, [rax + 0xa]
mov rcx, rbx
call fcn.14003c854
and qword [rbp - 0x28], 0
and qword [rbp - 0x18], 0
mov qword [rbp - 0x10], reloc.OLEAUT32.dll_SafeArrayDestroy
lea r9, str.SET_GAMEPASS_EXE_PATH
mov r8b, byte [rbp + 0x30]
mov edx, SafeArrayUnaccessData
lea rcx, [rbp - 0x28]
call fcn.140004a10
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.140039084
and dword [rbp + 0x30], 0
and dword [rbp + 0x38], 0
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x38]
mov r8d, 4
lea rdx, [rbp + 0x30]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x30], 1
jne 0x140034bc3
and qword [rbp - 0x28], 0
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.14001e28c
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.140039144
nop
mov rcx, r14
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop r14
pop rdi
pop rbp
jmp fcn.14006f264
mov ecx, eax
call fcn.14006f370
int3
Function at 0x140034be4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdi, [0x1400dbf10]
mov qword [rsp + 0x48], rdi
mov rcx, rdi
call fcn.14006f25c
test eax, eax
jne 0x140034c56
lea edx, [rax + 2]
mov rcx, rbx
call fcn.14003c854
mov eax, dword [rbx + 0xe0]
mov dword [rsp + 0x50], eax
and dword [rsp + 0x48], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14006f264
mov ecx, eax
call fcn.14006f370
int3

Function at 0x140034f30
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x60
mov rbx, r8
mov esi, edx
mov rdi, rcx
lea r14, [0x1400dbf10]
mov qword [rax - 0x30], r14
mov rcx, r14
call fcn.14006f25c
test eax, eax
jne 0x140034ff9
xor edx, edx
mov rcx, rdi
call fcn.14003c854
mov dword [rsp + 0x30], esi
and dword [rsp + 0x88], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
mov r8d, 4
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 8
jb 0x140034fab
mov rbx, qword [rbx]
and qword [rsp + 0x40], 0
and qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 7
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140021bc0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140039144
nop
mov rcx, r14
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
jmp fcn.14006f264
mov ecx, eax
call fcn.14006f370
int3

Function at 0x1400350cc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movzx edi, dl
mov rbx, rcx
lea rsi, [0x1400dbf10]
mov qword [rsp + 0x50], rsi
mov rcx, rsi
call fcn.14006f25c
test eax, eax
jne 0x140035145
lea edx, [rax + 7]
mov rcx, rbx
call fcn.14003c854
mov dword [rsp + 0x58], edi
and dword [rsp + 0x50], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 4
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14006f264
mov ecx, eax
call fcn.14006f370
int3
Function at 0x1400351e8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x40
mov edi, r8d
mov esi, edx
mov rbx, rcx
lea r14, [0x1400dbf10]
mov qword [rax + 0x20], r14
mov rcx, r14
call fcn.14006f25c
test eax, eax
jne 0x140035296
lea edx, [rax + 9]
mov rcx, rbx
call fcn.14003c854
mov dword [rsp + 0x30], esi
and dword [rsp + 0x68], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov esi, 4
mov r8d, esi
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x30], edi
and dword [rsp + 0x68], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov r8d, esi
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, r14
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
jmp fcn.14006f264
mov ecx, eax
call fcn.14006f370
int3
Function at 0x140035b84
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1400d9448]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
mov qword [rbp - 0x40], rcx
mov rsi, qword [rbp + 0x68]
xor ebx, ebx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rbx
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.14001e28c
nop
mov rcx, r15
call fcn.140040b7c
test al, al
jne 0x140035bf5
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [rdi + 0x10], xmm1
jmp 0x140035d9c
mov r14d, 0x200
mov edx, r14d
lea rcx, [rbp - 0x48]
call fcn.1400305ac
nop
mov rbx, qword [rbp - 0x48]
mov rax, r15
cmp qword [r15 + 0x18], 8
jb 0x140035c19
mov rax, qword [r15]
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x140035c26
mov r8, qword [rsi]
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x140035c35
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x140035c43
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r14 - 1]
cmp eax, ecx
jb 0x140035d27
mov rdx, rbx
lea rcx, [rbp - 0x38]
call fcn.140021bc0
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x140035c7b
mov rax, qword [rsi]
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
cmp rcx, qword [rsi + 0x10]
jne 0x140035ccf
test rcx, rcx
je 0x140035d27
movzx r8d, word [rdx]
movzx r9d, word [rax]
cmp r8w, r9w
jb 0x140035ccf
sub rdx, rax
cmp r8w, r9w
ja 0x140035ccf
cmp rcx, 1
je 0x140035d27
dec rcx
add rax, 2
movzx r8d, word [rdx + rax]
movzx r9d, word [rax]
cmp r8w, r9w
jae 0x140035cb1
lea eax, [r14 + r14]
mov r14d, eax
cmp eax, 0x6400000
ja 0x140035d27
mov edx, r14d
lea rcx, [rbp - 0x40]
call fcn.1400305ac
lea rcx, [rbp - 0x48]
cmp rcx, rax
je 0x140035d10
mov rcx, qword [rax]
and qword [rax], 0
mov rax, rbx
mov rbx, rcx
mov qword [rbp - 0x48], rcx
test rax, rax
je 0x140035d10
mov rcx, rax
call fcn.1400716ac
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140035c0c
call fcn.1400716ac
jmp 0x140035c0c
mov rdx, rbx
lea rcx, [rbp - 0x38]
call fcn.140021bc0
xor eax, eax
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbp - 0x28], rax
lea edx, [rax + 7]
mov qword [rbp - 0x20], rdx
mov word [rbp - 0x38], ax
test rbx, rbx
je 0x140035d64
mov rcx, rbx
call fcn.1400716ac
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x140035d9c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035d97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035dbc
call fcn.1400716ac
mov rax, rdi
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140071cb0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400780a4
int3
Function at 0x140036258
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
push rdi
sub rsp, 0x48
mov rbx, rdx
mov rdi, rcx
and dword [rax - 0x28], 0
and dword [rax + 0x20], 0
and dword [rax + 8], 0
and dword [rax + 0x18], 0
and qword [rax - 0x38], 0
lea r9, [rax + 0x18]
mov r8d, 4
lea rdx, [rax + 8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
and qword [rbx], 0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], 0
mov dword [rsp + 0x30], 1
movsxd rdx, dword [rsp + 0x60]
mov rax, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400362d9
mov r8b, byte [rsp + 0x68]
mov rcx, rbx
call fcn.1400054b8
and qword [rbx + 0x10], 0
mov rax, qword [rbx + 0x18]
mov rdx, rbx
cmp rax, 0x10
jb 0x1400362e5
mov rdx, qword [rbx]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, dword [rsp + 0x60]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rax, rbx
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x1400363ac
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x8f8
mov rax, qword [0x1400d9448]
xor rax, rsp
mov qword [rsp + 0x8e0], rax
call fcn.140034334
mov rcx, rax
call fcn.1400486f4
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x800
call fcn.140074190
mov r8d, 0x400
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
lea rcx, [rsp + 0x74]
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
xor edx, edx
movups xmmword [rsp + 0x50], xmm0
lea r8d, [rax + 0x64]
call fcn.140074190
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
and qword [rsp + 0x38], 0
xor edx, edx
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14003647e
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.140084384
int3
Function at 0x140036520
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
movzx edi, dl
mov rbx, rcx
lea r14, [0x1400dbf10]
mov qword [rbp + 0x30], r14
mov rcx, r14
call fcn.14006f25c
test eax, eax
jne 0x1400365fa
lea edx, [rax + 0xa]
mov rcx, rbx
call fcn.14003c854
and qword [rbp - 0x20], 0
and qword [rbp - 0x10], 0
mov qword [rbp - 8], reloc.OLEAUT32.dll_SafeArrayDestroy
lea r9, str.TRAINER_INITIALIZE
mov r8b, byte [rbp + 0x30]
mov edx, 0x12
lea rcx, [rbp - 0x20]
call fcn.140004a10
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.140039084
and dword [rbp + 0x30], 0
and dword [rbp + 0x38], 0
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x38]
mov r8d, 4
lea rdx, [rbp + 0x30]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x30], 1
jne 0x1400365e5
mov dword [rbp + 0x38], edi
and dword [rbp + 0x30], 0
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x30]
mov r8d, 4
lea rdx, [rbp + 0x38]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, r14
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rbp
jmp fcn.14006f264
mov ecx, eax
call fcn.14006f370
int3
Function at 0x1400383dc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400d9448]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
lea rdx, [0x1400dbdf0]
lea rcx, [0x1400dba10]
call fcn.140032d4c
lea rcx, [rbp - 0x28]
call fcn.14004071c
mov rbx, rax
lea rcx, [0x1400dbd30]
xor esi, esi
cmp rcx, rax
je 0x140038458
call fcn.140021660
movups xmm0, xmmword [rbx]
movups xmmword [0x1400dbd30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1400dbd40], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
lea rcx, [rbp - 0x28]
call fcn.140021660
lea r14, [0x1400dbf10]
mov qword [rbp - 0x30], r14
mov rcx, r14
call fcn.14006f25c
test eax, eax
jne 0x140038537
lea ebx, [rax + 0xa]
mov edx, ebx
mov rcx, rdi
call fcn.14003c854
nop
mov qword [rbp - 0x10], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp - 0x18], rbx
movsd xmm0, qword [str.TRAINER_ID]
movsd qword [rbp - 0x28], xmm0
movzx eax, word [0x1400a4d20]
mov word [rbp - 0x20], ax
mov byte [rbp - 0x1e], sil
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.140039084
mov dword [rbp - 0x40], esi
mov dword [rbp - 0x38], esi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x38]
lea r8d, [rbx - 6]
lea rdx, [rbp - 0x40]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp - 0x40], 1
jne 0x14003850e
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rsi
lea rdx, [0x1400dbe10]
lea rcx, [rbp - 0x28]
call fcn.14001e1ec
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.140039084
nop
mov rcx, r14
call fcn.14006f264
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140071cb0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, eax
call fcn.14006f370
int3
Function at 0x140038540
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400d9448]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor edi, edi
mov dword [rbp - 0x19], edi
call fcn.1400409e4
test al, al
je 0x140038674
lea rcx, [rbp + 0x2f]
call fcn.140040674
nop
lea r8d, [rdi + 0xe]
lea rdx, str.debug_log.txt
mov rcx, rax
call fcn.140021a48
mov qword [rbp - 0x11], rdi
mov qword [rbp - 1], rdi
mov qword [rbp + 7], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x11], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 1], xmm1
mov qword [rax + 0x10], rdi
lea ebx, [rdi + 7]
mov qword [rax + 0x18], rbx
mov word [rax], di
lea rcx, [rbp + 0x2f]
call fcn.140021660
lea rdx, [rbp + 0xf]
lea rcx, [0x1400db318]
call fcn.14003c3a4
nop
mov dword [rbp - 0x19], ebx
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x11]
call fcn.140038fa0
test al, al
je 0x1400385fa
lea rcx, [rbp - 0x11]
call fcn.140040b7c
test al, al
mov bl, 1
jne 0x1400385fd
mov bl, dil
lea rcx, [rbp + 0xf]
call fcn.140021660
test bl, bl
je 0x140038638
lea r8, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae r8, qword [rbp - 0x11]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x140038674
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003866f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038695
call fcn.1400716ac
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140071cb0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1400780a4
int3

Function at 0x140039084
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x40
and qword [r11 - 0x28], 0
lea r9, [r11 - 0x18]
mov qword [rsp + 0x38], rdx
mov rbx, rdx
mov eax, dword [rdx + 0x10]
mov rdi, rcx
mov rcx, qword [rcx + 8]
lea rdx, [r11 - 0x10]
and dword [rsp + 0x30], 0
mov r8d, 4
mov dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1400390d1
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140039120
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14003911b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003913b
mov rcx, r8
call fcn.1400716ac
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], 0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.1400780a4
int3