joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404dc5ee
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx ax, dil
cdqe
cmovp eax, r8d
mov qword [rsp + 0x18], rbp
push rsi
nop
movzx rax, r9w
lahf
push rdi
setae al
nop
push r14
movzx ax, r15b
cmovnp rax, r11
cwde
mov eax, 0x1450
jmp 0x1404dc626
call fcn.1404490cf
sub rsp, rax
clc
mov rax, qword [0x1400b7288]
and dil, r11b
shr bpl, 0xc5
mov bpl, bpl
xor rax, rsp
shrd bp, r15w, 0x52
mov qword [rsp + 0x1440], rax
jmp 0x1404dc65b
movsxd r10, edx
mov rdi, rcx
sal r14d, 0x54
bsr rbp, rcx
inc r14b
mov rax, r10
movsx r14, sp
cmp r10d, 0x1ca032d
movzx rcx, sp
mov ebp, r9d
test r15b, 0x32
sar rax, 6
xadd dl, dh
rol sil, 0xf
or sil, 0xa3
lea rcx, [0x1400ba940]
adc dl, 0xb0
and r10d, 0x3f
add r14w, bp
btc si, r8w
lea rbp, [rbp + r8]
test spl, spl
mov rsi, r8
mov rax, qword [rcx + rax*8]
inc rdx
lea rdx, [r10 + r10*8]
rcr r14d, cl
mov r14, qword [rax + rdx*8 + 0x28]
test r11w, 0x32e4
sub eax, eax
jmp 0x1404dc6d6
mov qword [rdi], rax
stc
cmp dx, 0x6ac0
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x1404dc6ea
jae 0x1404dc7e9
lea rbx, [rsp + 0x40]
test r11b, 0xbf
cmp rsi, rbp
jae 0x1404dc75c
mov al, byte [rsi]
jmp 0x1404dc709
inc rsi
cmp al, 0xa
jmp 0x1404dc713
jne 0x1404dc72c
inc dword [rdi + 8]
mov byte [rbx], 0xd
jmp 0x1404dc724
inc rbx
jmp 0x1404dc72c
mov byte [rbx], al
cdqe
movsx ax, r9b
lahf
inc rbx
movsxd rax, r9d
cmp bx, 0x5660
lea rax, [rsp + 0x143f]
jmp 0x1404dc74e
cmp rbx, rax
jmp 0x1404dc756
jb 0x1404dc6f9
and qword [rsp + 0x20], 0
jmp 0x1404dc76b
lea rax, [rsp + 0x40]
sub ebx, eax
lea r9, [rsp + 0x30]
movsx cx, r12b
mov r8d, ebx
cqo
cmovbe edx, r14d
lea rdx, [rsp + 0x40]
jmp 0x1404dc78f
mov rcx, r14
jmp 0x1404dc797
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404dc7d8
mov eax, dword [rsp + 0x30]
clc
test sp, 0x4ecb
add dword [rdi + 4], eax
cmc
test r14b, 0x14
stc
cmp eax, ebx
jmp 0x1404dc7bf
jb 0x1404dc7e9
cmp rsi, rbp
jmp 0x1404dc7cd
jb 0x1404dc6f0
jmp 0x1404dc7e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
jmp 0x1404dc7e9
mov rax, rdi
ror ch, cl
mov rcx, qword [rsp + 0x1440]
cmp dh, 0x21
cmp r11w, r11w
xor rcx, rsp
call fcn.1404a04c2
lea r11, [rsp + 0x1450]
sets sil
movzx edi, r11w
mov ebp, r8d
mov rbx, qword [r11 + 0x20]
bswap di
mov r14w, si
mov rbp, qword [r11 + 0x30]
mov r14b, 0x3f
mov rsp, r11
mov si, si
setle sil
cmovo si, sp
pop r14
movsx di, spl
jmp 0x1404dc847
pop rdi
not sil
xchg si, si
pop rsi
jmp 0x1404dc854
ret
Function at 0x1404dc855
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
movsx rax, dx
push rsi
xchg al, ah
movzx eax, r12w
jmp 0x1404dc882
push rdi
movzx rax, ax
cwde
nop
push r14
mov eax, 0x1450
jmp 0x1404dc895
call fcn.1404490cf
sub rsp, rax
clc
movsxd rax, r10d
xor dil, 0x87
mov rax, qword [0x1400b7288]
sal r14b, cl
xor rsi, 0x1b665070
sar r14b, 0x22
xor rax, rsp
bsf di, sp
adc rdi, 0x3d5f1bc5
sbb edi, 0x6e4554b2
mov qword [rsp + 0x1440], rax
sbb r14, rbx
and ah, 0x47
movsxd r10, edx
sub rbp, 0x514227a3
clc
mov rdi, rcx
mov rax, r10
mov ebp, r9d
bt rdx, 0x8e
sar rax, 6
lea rcx, [0x1400ba940]
and r10d, 0x3f
rcr sil, cl
bts r14w, di
adc dl, 0xdd
add rbp, r8
rcl r14d, 0x16
mov rsi, r8
movsx r14, r15w
btr r14d, eax
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
xor r14w, 0x71c3
mov r14, qword [rax + rdx*8 + 0x28]
stc
sub eax, eax
mov qword [rdi], rax
test r12d, 0x96c22b6
jmp 0x1404dc94a
mov dword [rdi + 8], eax
clc
jmp 0x1404dc953
cmp r8, rbp
jae 0x1404dca49
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404dc969
jae 0x1404dc9ce
movzx eax, word [rsi]
add rsi, 2
cmp r13w, r9w
cmp ax, 0xa
jmp 0x1404dc983
jne 0x1404dc9a5
add dword [rdi + 8], 2
movzx ecx, r12w
mov ecx, 0xd
mov word [rbx], cx
cmp dil, r14b
add rbx, 2
test r9d, edi
clc
stc
mov word [rbx], ax
bt rax, rcx
add al, r9b
rcr eax, 0x59
add rbx, 2
neg al
lea rax, [rsp + 0x143e]
cmp rbx, rax
jmp 0x1404dc9c8
jb 0x1404dc961
and qword [rsp + 0x20], 0
movzx r9d, r13w
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
sar r8w, cl
rcl ch, 0x5e
sar rbx, 1
movzx ecx, cx
adc dh, 0x18
shr ch, cl
lea rdx, [rsp + 0x40]
xor cx, r10w
movzx cx, r10b
add ebx, ebx
mov rcx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404dca41
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
cmp spl, 0x1c
cmp eax, ebx
jmp 0x1404dca2d
jb 0x1404dca49
cmp rsi, rbp
jb 0x1404dc95c
jmp 0x1404dca49
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov rax, rdi
mov cl, r12b
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404dca5f
call fcn.1404a04c2
lea r11, [rsp + 0x1450]
movsx bx, r13b
mov bl, r14b
mov rbx, qword [r11 + 0x20]
bswap di
cmovs rbp, rdi
mov rbp, qword [r11 + 0x30]
not rsi
jmp 0x1404dca8b
mov rsp, r11
movzx r14w, r10b
pop r14
xchg dil, sil
bswap edi
not sil
pop rdi
pop rsi
jmp 0x1404dcaa4
ret
Function at 0x1404dcaa5
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
setl al
cbw
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
movsx rax, di
movzx eax, r8w
cwde
push r14
push r15
mov al, r8b
cwde
mov eax, 0x1470
jmp 0x1404dcad6
call fcn.1404490cf
sub rsp, rax
and dil, al
stc
mov rax, qword [0x1400b7288]
xor rax, rsp
sar ebx, 0x43
setno bl
mov qword [rsp + 0x1460], rax
cmc
shld r10w, r9w, 0xc5
movsxd r10, edx
mov rbx, rcx
mov rax, r10
mov r14d, r9d
sub dl, dh
movsx edx, r14w
sar rax, 6
sub r12b, 0x66
lea rcx, [0x1400ba940]
and r10d, 0x3f
btc rdi, rdx
bts di, bx
rol edx, 0x67
lea r14, [r14 + r8]
sal dx, cl
movzx edi, sp
mov r15, r8
mov rdi, r8
mov rax, qword [rcx + rax*8]
btc dx, 0x15
lea rdx, [r10 + r10*8]
btc r12w, cx
mov r12w, 0x556b
sar r12w, cl
mov r12, qword [rax + rdx*8 + 0x28]
sub eax, eax
clc
mov qword [rbx], rax
cmp r8, r14
jmp 0x1404dcb6f
mov dword [rbx + 8], eax
jae 0x1404dcd09
lea rax, [rsp + 0x50]
test edx, 0x314803d1
cmp r12b, r15b
cmp rdi, r14
jmp 0x1404dcb8e
jae 0x1404dcbe4
movzx ecx, word [rdi]
add rdi, 2
test dl, 0x36
cmc
cmp cx, 0xa
jmp 0x1404dcba8
jne 0x1404dcbc1
mov edx, 0xd
clc
mov word [rax], dx
add rax, 2
clc
jmp 0x1404dcbc1
mov word [rax], cx
add rax, 2
bts ecx, esp
cmovae cx, dx
and cl, r15b
lea rcx, [rsp + 0x6f8]
stc
cmp rax, rcx
jb 0x1404dcb86
and qword [rsp + 0x38], 0
movzx r8, bx
sar r8w, 0x35
lea rcx, [rsp + 0x50]
rcl r8, cl
jmp 0x1404dcc00
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
rcl r9d, cl
sub rax, rcx
mov dword [rsp + 0x28], 0xd55
rol r9w, cl
adc cl, 0x27
movsx cx, cl
lea rcx, [rsp + 0x700]
ror r9w, cl
rol r9b, 0xb9
sar rax, 1
movzx r9w, r10b
jmp 0x1404dcc45
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov ecx, 0xfde9
cmc
sub edx, edx
call fcn.1404c9bd0
mov ebp, eax
jmp 0x1404dcc61
test eax, eax
je 0x1404dccfe
xor esi, esi
test eax, eax
jmp 0x1404dcc72
je 0x1404dcce2
and qword [rsp + 0x20], 0
shld r9, r11, 0xca
rcl dl, 0xc2
ror r9b, cl
lea rdx, [rsp + 0x700]
or r9b, 0x27
mov ecx, esi
btc r9d, 0x80
lea r9, [rsp + 0x40]
setp r8b
mov r8d, ebp
cmp edi, 0x160f5771
add rdx, rcx
mov rcx, r12
cmc
cmp rsp, rsi
sub r8d, esi
jmp 0x1404dccc0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1404dccfe
add esi, dword [rsp + 0x40]
test r8b, r13b
cmp esi, ebp
jmp 0x1404dccdc
jb 0x1404dcc78
mov eax, edi
sub eax, r15d
stc
test r13d, 0x305f1765
mov dword [rbx + 4], eax
test bpl, 0x85
cmp rdi, r14
jmp 0x1404dcb72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
cmp al, spl
mov rax, rbx
rcr cx, 0xbe
ror cl, cl
btc ecx, 0x4d
mov rcx, qword [rsp + 0x1460]
clc
jmp 0x1404dcd24
xor rcx, rsp
jmp 0x1404dcd2c
call fcn.1404a04c2
lea r11, [rsp + 0x1470]
movsxd rbx, ebx
mov si, r10w
movzx rbp, r9w
mov rbx, qword [r11 + 0x30]
mov dil, 5
movsx r15w, al
xchg r14b, r12b
mov rbp, qword [r11 + 0x40]
jmp 0x1404dcd5c
mov rsp, r11
xchg r15b, r14b
sete r15b
pop r15
mov r14b, 0xca
bswap edi
cmovnp r12d, r10d
pop r14
pop r12
bswap edi
movzx si, r15b
pop rdi
jmp 0x1404dcd8a
pop rsi
jmp 0x1404dcd90
ret
Function at 0x1404e03a6
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub r9b, dil
adc r8w, r13w
sub rsp, 0x20
mov r9b, r14b
mov ebx, ecx
movsxd r8, eax
lea r9, [0x1400c8ea0]
movsx dx, r13b
movzx rdx, sp
mov ecx, 2
movsx r8d, r8w
cmovns rdx, r9
movsxd r8, r13d
lea r8, [0x1400c8e98]
xchg dx, dx
movsx dx, dil
movzx edx, di
lea rdx, [0x1400cf758]
call fcn.1404e0579
mov ecx, ebx
cmp eax, ebp
jmp 0x1404e0408
test rax, rax
jmp 0x1404e0410
je 0x1404e042b
add rsp, 0x20
movzx rbx, bp
pop rbx
jmp 0x1404e0424
push qword [0x1400b8d90]
ret
add rsp, 0x20
cmovg bx, cx
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404e043b
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
rcl rbx, 0x4e
inc bh
push rdi
bswap rdi
bt r8w, 0x5b
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1400c8ea8]
movsx r8, ax
mov edi, ecx
movsxd rcx, esi
movsx ecx, r13w
cmovs dx, si
lea rdx, [0x1400cf748]
movsx r8w, bl
movzx r8, r8w
mov ecx, 3
lea r8, [0x1400c8ea0]
jmp 0x1404e0490
call fcn.1404e0579
mov rdx, rbx
rcl ecx, cl
mov ecx, edi
test rax, rax
jmp 0x1404e04a4
je 0x1404e04b5
call qword [case.0x1404cbcda.0]
jmp 0x1404e04bb
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
sar di, 0xac
add rsp, 0x20
movzx rdi, bx
pop rdi
jmp 0x1404e04d2
ret
Function at 0x1404e0e16
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
jmp 0x1404e0e2e
mov qword [rsp + 0x10], rbp
cmp r15w, 0x3f98
cmc
mov qword [rsp + 0x18], rsi
btc esi, 0xf
bt esi, 0x1e
push rdi
sub rsp, 0x30
btc di, 0xbd
test r9b, r9b
movsxd rdi, r8d
mov r8d, ecx
mov rsi, rdx
stc
jmp 0x1404e0e63
test ecx, 0xfffff3ff
jmp 0x1404e0e6e
jne 0x1404e0e85
cmp ecx, 0xc00
jmp 0x1404e0e7f
jne 0x1404e0ffd
test rsi, rsi
jmp 0x1404e0e8d
jne 0x1404e0ea0
test edi, edi
jmp 0x1404e0e9a
jg 0x1404e0ffd
test edi, edi
jmp 0x1404e0ea7
js 0x1404e0ffd
sub r9d, r9d
ror bpl, 0xaa
lea rbp, reloc.d2d1.dll_Ordinal_1
movsx r10d, bp
mov r10d, 0xe3
mov rcx, 0x26303a92
sbb rax, rbp
movzx cx, cl
lea eax, [r10 + r9]
cdq
sub eax, edx
bts cx, sp
mov edx, r8d
xor rcx, 0x2a66fc1
rol cx, cl
or cl, 0xe3
sar eax, 1
movsxd rcx, eax
jmp 0x1404e0ef8
shl rcx, 4
test spl, 0x98
cmp ax, r13w
sub edx, dword [rcx + rbp]
jmp 0x1404e0f0c
je 0x1404e0f56
test edx, edx
lea ecx, [rax - 1]
cmovns ecx, r10d
dec r10d
inc eax
and r10w, 0x2c57
test edx, edx
movzx r10w, dl
not r10w
mov r10d, ecx
jmp 0x1404e0f39
cmovns r9d, eax
clc
stc
cmp r9d, ecx
jmp 0x1404e0f47
jle 0x1404e0ed3
or eax, 0xffffffff
jmp 0x1404e0f56
test eax, eax
jmp 0x1404e0f5d
js 0x1404e0ffd
cdqe
sbb ecx, 0xa1a2503
inc cl
mov edx, 0x55
not cx
rcl cx, cl
bsr ecx, esi
add rax, rax
bswap cx
movzx cx, bpl
mov rbp, qword [rbp + rax*8 + 8]
mov rcx, rbp
jmp 0x1404e0f93
call fcn.1400e0285
mov rbx, rax
cmp r12d, 0x26b4207e
cmp r11b, r10b
test edi, edi
jmp 0x1404e0fac
jle 0x1404e0ff0
cmp ebx, edi
jmp 0x1404e0fb9
jge 0x1404e0ffd
mov rdx, rdi
movsxd r8, eax
cmovns cx, r11w
setno ch
mov r8, rbp
mov cx, si
mov ch, 0x3a
mov rcx, rsi
jmp 0x1404e0fde
call fcn.1404ca768
test eax, eax
jmp 0x1404e0fea
jne 0x1404e1037
lea eax, [rbx + 1]
jmp 0x1404e0ff8
jmp 0x1404e1004
sub eax, eax
bsf si, r12w
mov rbx, qword [rsp + 0x40]
add bp, 0x373c
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movzx edi, r11w
adc dil, 8
add rsp, 0x30
movzx edi, r9w
movsx edi, r14w
movzx di, al
pop rdi
jmp 0x1404e1036
ret
and qword [rsp + 0x20], 0
test r8w, 0x5884
cmp dil, 6
clc
xor r9d, r9d
cmc
cmp eax, esi
xor r8d, r8d
cmp ah, 0x46
sub edx, edx
test al, 0x2c
sub ecx, ecx
jmp 0x1404e105f
call fcn.1404b6ac6
int3
Function at 0x140003a30
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003a64
cmp word [rcx], 0x5a4d
jne 0x140003a64
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003a64
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a64
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003970
test eax, eax
jne 0x140003a80
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.1400039e0
test rax, rax
je 0x140003a75
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004235
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004130
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400040d0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004cf0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004d13
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004d13
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004dc1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140537330]
mov r8, rcx
mov rcx, r9
call fcn.140004cf0
test eax, eax
je 0x140004ded
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004d14
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Read file on windows
Terminate process

Disassembly:
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x490
mov rax, qword [0x1400050d8]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor r12d, r12d
mov r13, r9
mov rdi, r8
mov r15d, edx
mov esi, ecx
cmp r8, r9
jbe 0x14000104e
lea rcx, str.copy_some_to_file:_panic:_startin___startout__n
call qword [sym.imp.hdf5_tools.dll_error_msg]
lea ecx, [r12 + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x488], rbx
mov rbx, qword [rsp + 0x4e0]
test rbx, rbx
jns 0x140001093
lea rdx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64]
test eax, eax
jns 0x14000108b
lea rcx, str.Cant_stat_file__n
call qword [sym.imp.hdf5_tools.dll_error_msg]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0x38]
test rbx, rbx
jne 0x14000109c
xor eax, eax
jmp 0x14000117f
mov qword [rsp + 0x480], rbp
mov qword [rsp + 0x478], r14
test rbx, rbx
jle 0x14000116b
lea rbp, [r13 - 0x200]
add rbp, rbx
lea r14, [rdi - 0x200]
cmp rbx, 0x200
cmovle rbp, r13
add r14, rbx
cmp rbx, 0x200
cmovle r14, rdi
nop
movsxd rdx, ebp
xor r8d, r8d
mov ecx, r15d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseeki64]
movsxd rdx, r14d
xor r8d, r8d
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseeki64]
lea rdx, [rsp + 0x60]
mov ecx, esi
mov r8d, 0x200
cmp rbx, 0x200
jg 0x140001116
mov r8d, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
movsxd rdi, eax
test rdi, rdi
jle 0x1400011c0
mov r8d, edi
lea rdx, [rsp + 0x60]
mov ecx, r15d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
test eax, eax
js 0x1400011a7
sub rbx, rdi
add r12, rdi
cmp rbx, 0x200
mov rax, rdi
cmovle rax, rbx
sub rbp, rax
cmp rbx, 0x200
cmovle rdi, rbx
sub r14, rdi
test rbx, rbx
jg 0x1400010e0
mov rbp, qword [rsp + 0x480]
lea rax, [r12 + r13]
mov r14, qword [rsp + 0x478]
mov rbx, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140001cc0
add rsp, 0x490
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
lea rcx, str.Write_error__n
call qword [sym.imp.hdf5_tools.dll_error_msg]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.Read_error__n
call qword [sym.imp.hdf5_tools.dll_error_msg]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rsi
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
mov ecx, dword [rax + 0x18]
push rax
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
add rax, rdx
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140001ab0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001ae3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140001b27
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140001b22
cmp rbx, r11
jae 0x140001b27
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140001b10
cmp rbx, r11
jb 0x140001b2b
xor eax, eax
jmp 0x140001b37
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400049f0
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1100
mov r9d, 0x400
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
call fcn.14000bbec
mov rcx, rax
test rax, rax
setne bl
test ebx, ebx
jne 0x140004a55
mov ecx, 0x80004005
call fcn.140002000
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov r9, qword [rsp + 0x78]
lea rdx, str.error__d_n_s
lea rcx, [rsp + 0x70]
call fcn.140001a80
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
call fcn.140002690
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140006890
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140006890
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov r14, rdx
mov rbx, rcx
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [0x14003f47c]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14003f47c]
mov rcx, r14
call fcn.140002590
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r13, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [rbx + 0x248], 0
je 0x140006a03
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileType]
test al, 1
jne 0x1400069d2
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, r12d
mov r8, qword [r14]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14000b338
mov rsi, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, qword [r14]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebx, eax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor eax, eax
mov rcx, r12
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x90]
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov rcx, rsi
call fcn.14000b330
jmp 0x140006a84
mov rdx, qword [r14]
mov r8d, dword [rdx - 0x10]
add r8d, r8d
xor r15d, r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x90]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x140006a84
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebp, eax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov rdx, qword [r14]
movsxd rbx, dword [rdx - 0x10]
lea ecx, [rbx + 1]
movsxd rcx, ecx
call fcn.14000b338
mov rsi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140023010
mov r8d, ebx
mov rdx, rsi
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_CharToOemBuffW]
mov byte [rbx + rsi], 0
xor r15d, r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x90]
mov r8d, ebx
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov rcx, rsi
call fcn.14000b330
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140006aa2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret