joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011ec30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 1
je 0x14010a40e
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14011ec30
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [rcx + 0x70], 0
mov rbp, r8
mov r15, qword [rcx + 0x18]
mov r14, rdx
mov rbx, rcx
jne 0x14011ed23
cmp dword [rcx + 0x98], 0xffffffff
jne 0x14011ed87
mov rcx, qword [rcx + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14011ed81
mov rsi, r8
lea r9, [rax + 8]
xor edi, edi
mov r13d, 0x2000000
mov r8d, r13d
cmp rsi, r13
cmovl r8d, ebp
and qword [rax - 0x38], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14011ece8
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14011ece0
add rdi, rax
sub rsi, rax
cmp rdi, rbp
jge 0x14011ece0
mov rcx, qword [rbx + 0x78]
lea rdx, [rdi + r14]
mov r8d, r13d
lea r9, [rsp + 0x60]
cmp rsi, r13
cmovl r8d, esi
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14011eca1
test rdi, rdi
je 0x14011ece8
mov rax, rdi
jmp 0x14011ed95
or edx, 0xffffffff
lea rcx, [rsp + 0x78]
call fcn.140145228
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.14011d4bc
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx]
test eax, eax
je 0x14011ed72
cmp eax, 0xffffffff
je 0x14011ed81
sub eax, 1
mov dword [rcx], eax
jne 0x14011ed81
mov rcx, qword [rsp + 0x78]
jmp 0x14011ed72
call fcn.14011e9f0
test al, al
je 0x14011ed87
mov rcx, qword [rbx + 0x70]
call fcn.14016f758
test eax, eax
je 0x14011ed87
or edx, 0xffffffff
lea rcx, [rsp + 0x60]
call fcn.140145394
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.14011d4bc
mov rcx, qword [rsp + 0x60]
mov edx, dword [rcx]
test edx, edx
je 0x14011ed72
cmp edx, 0xffffffff
je 0x14011ed81
sub edx, 1
mov dword [rcx], edx
jne 0x14011ed81
mov rcx, qword [rsp + 0x60]
mov r8d, 8
lea edx, [r8 - 6]
call fcn.14010b388
or rax, 0xffffffffffffffff
jmp 0x14011ed95
mov r8, rbp
mov rdx, r14
mov rcx, rbx
call fcn.14010a42c
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x14011ef44
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 2
je 0x14010aafa
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14011ef44
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
cmp qword [rcx + 0x70], 0
mov rbp, r8
mov r15, qword [rcx + 0x18]
mov r14, rdx
mov rbx, rcx
jne 0x14011f04c
cmp dword [rcx + 0x98], 0xffffffff
jne 0x14011f04c
mov rcx, qword [rcx + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14011f046
mov rsi, r8
lea r9, [rsp + 0x60]
mov eax, 0x2000000
xor edi, edi
cmp rsi, rax
mov r8d, eax
cmovl r8d, ebp
and qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14011eff8
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14011eff3
add rdi, rax
sub rsi, rax
cmp rdi, rbp
jge 0x14011eff3
mov rcx, qword [rbx + 0x78]
lea rdx, [rdi + r14]
mov eax, 0x2000000
lea r9, [rsp + 0x60]
cmp rsi, rax
mov r8d, eax
cmovl r8d, esi
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14011efaf
test rdi, rdi
je 0x14011eff8
mov rax, rdi
jmp 0x14011f051
or edx, 0xffffffff
lea rcx, [rsp + 0x78]
call fcn.140145228
mov ebx, 2
mov r8, rax
mov edx, ebx
mov rcx, r15
call fcn.14011d4bc
mov rcx, qword [rsp + 0x78]
mov r8d, dword [rcx]
test r8d, r8d
je 0x14011f038
cmp r8d, 0xffffffff
je 0x14011f046
sub r8d, 1
mov dword [rcx], r8d
jne 0x14011f046
mov rcx, qword [rsp + 0x78]
mov r8d, 8
mov rdx, rbx
call fcn.14010b388
or rax, 0xffffffffffffffff
jmp 0x14011f051
call fcn.14010ab18
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14011f308
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140109dc4
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp method.QFSFileEngine.virtual_96
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rdi, qword [rcx + 8]
mov rsi, rcx
lea rcx, [rbp - 0x20]
call fcn.14010444c
mov rcx, rax
lea rdx, [rbp + 0x30]
call fcn.140104e80
mov rcx, rax
call fcn.14014385c
lea rcx, [rdi + 0x20]
mov rbx, rax
lea rdx, [rbp + 0x20]
call fcn.140104e80
mov rcx, rax
call fcn.14014385c
mov rcx, rax
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, qword [rbp + 0x20]
mov edi, 2
test eax, eax
setne bl
mov eax, dword [rcx]
lea r14d, [rdi + 6]
test eax, eax
je 0x14011f393
cmp eax, 0xffffffff
je 0x14011f39e
sub eax, 1
mov dword [rcx], eax
jne 0x14011f39e
mov rcx, qword [rbp + 0x20]
mov r8, r14
mov rdx, rdi
call fcn.14010b388
mov rcx, qword [rbp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14011f3b8
cmp eax, 0xffffffff
je 0x14011f3c3
sub eax, 1
mov dword [rcx], eax
jne 0x14011f3c3
mov rcx, qword [rbp + 0x30]
mov r8, r14
mov rdx, rdi
call fcn.14010b388
mov rcx, qword [rbp - 0x18]
mov eax, dword [rcx]
test eax, eax
je 0x14011f3dd
cmp eax, 0xffffffff
je 0x14011f3e8
sub eax, 1
mov dword [rcx], eax
jne 0x14011f3e8
mov rcx, qword [rbp - 0x18]
mov r8, r14
mov rdx, rdi
call fcn.14010b388
mov rcx, qword [rbp - 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14011f402
cmp eax, 0xffffffff
je 0x14011f40d
sub eax, 1
mov dword [rcx], eax
jne 0x14011f40d
mov rcx, qword [rbp - 0x20]
mov r8, r14
mov rdx, rdi
call fcn.14010b388
test bl, bl
jne 0x14011f460
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, edi
lea rcx, [rbp + 0x20]
mov r8d, eax
call fcn.1401453bc
lea r8, [rbp + 0x20]
mov edx, 0xa
mov rcx, rsi
call fcn.14011d4bc
mov rcx, qword [rbp + 0x20]
mov r9d, dword [rcx]
test r9d, r9d
je 0x14011f455
cmp r9d, 0xffffffff
je 0x14011f460
sub r9d, 1
mov dword [rcx], r9d
jne 0x14011f460
mov rcx, qword [rbp + 0x20]
mov r8, r14
mov rdx, rdi
call fcn.14010b388
mov rsi, qword [rsp + 0x78]
mov al, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x14011f588
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rax + 0x78]
cmp rdi, 0xffffffffffffffff
jne 0x14011f6d2
cmp dword [rax + 0x98], edi
jne 0x14011f6a6
cmp qword [rax + 0x70], 0
jne 0x14011f6a6
lea rdi, [rax + 0x20]
mov rcx, rdi
call fcn.140104ca0
test al, al
jne 0x14011f71f
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.140104774
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.14011a690
mov rcx, qword [rbp + 0x20]
mov r14d, 8
mov eax, dword [rcx]
test eax, eax
je 0x14011f618
cmp eax, 0xffffffff
je 0x14011f625
sub eax, 1
mov dword [rcx], eax
jne 0x14011f625
mov rcx, qword [rbp + 0x20]
mov r8, r14
mov edx, 2
call fcn.14010b388
mov edx, 3
lea rcx, [rbp - 0x10]
call fcn.14011b108
lea rcx, [rbp - 0x10]
test al, al
je 0x14011f69f
mov rdx, rsi
call fcn.14011bc70
mov dil, al
test al, al
jne 0x14011f68e
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x10]
call fcn.140123e3c
mov r8, rax
mov edx, 0xc
mov rcx, rbx
call fcn.14011d4bc
mov rcx, qword [rbp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14011f681
cmp eax, 0xffffffff
je 0x14011f68e
sub eax, 1
mov dword [rcx], eax
jne 0x14011f68e
mov rcx, qword [rbp + 0x20]
mov r8, r14
mov edx, 2
call fcn.14010b388
lea rcx, [rbp - 0x10]
call fcn.14011a760
mov al, dil
jmp 0x14011f721
call fcn.14011a760
jmp 0x14011f71f
cmp rdi, 0xffffffffffffffff
jne 0x14011f6d2
mov rcx, qword [rax + 0x70]
test rcx, rcx
je 0x14011f6bc
call fcn.140177648
jmp 0x14011f6c2
mov eax, dword [rax + 0x98]
mov ecx, eax
call fcn.140172dc0
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14011f71f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
mov r8, qword [rbx]
mov rdx, rsi
mov rcx, rbx
mov r14, rax
call qword [r8 + 0x38]
test al, al
je 0x14011f713
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14011f713
mov rax, qword [rbx]
cmp r14, rsi
mov rcx, rbx
cmovl rsi, r14
mov rdx, rsi
call qword [rax + 0x38]
mov al, 1
jmp 0x14011f721
mov rax, qword [rbx]
mov rdx, r14
mov rcx, rbx
call qword [rax + 0x38]
xor al, al
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
Function at 0x1401334bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor r12d, r12d
mov rbx, rcx
mov rcx, qword [rcx + 0xa0]
mov rbp, rdx
mov dl, byte [rsp + 0x88]
mov esi, r9d
mov word [rsp + 0x60], r12w
mov edi, r8d
mov r10b, r12b
cmp byte [rcx + 0x49], r12b
je 0x140133584
test dl, dl
jne 0x140133584
mov r14, qword [rcx + 0x68]
mov rdx, rcx
mov r15d, dword [r14 + 4]
test r15d, r15d
je 0x140133542
cmp qword [r14 + 0x10], r12
jl 0x140133542
cmp qword [r14 + 0x10], 0x18
jae 0x140133542
lea r8d, [r12 + 0x3c]
lea rdx, str.c:qt64qt_1544645195969workqtbaseincludeqtcore.._.._src_corelib_tools_qarraydata.h
lea rcx, str.size__0__offset___0__size_t_offset____sizeof_QArrayData_
call fcn.140122564
mov rdx, qword [rbx + 0xa0]
mov eax, dword [rdx + 0x4c]
mov r8d, esi
mov r9, qword [r14 + 0x10]
mov edx, edi
mov dword [rsp + 0x28], eax
add r9, r14
mov rcx, rbp
mov dword [rsp + 0x20], r15d
call fcn.14013df0c
mov edx, eax
mov dword [rbx + 8], eax
mov rax, qword [rbx + 0xa0]
cmp edx, 0xffffffff
setne r10b
mov rcx, qword [rax + 0x68]
mov eax, dword [rcx + 4]
mov dword [rbx + 0x98], eax
jmp 0x1401335f5
test rbp, rbp
mov dword [rbx + 8], esi
lea rax, [rsp + 0x60]
mov dword [rbx + 0x10], edi
cmovne rax, rbp
mov qword [rbx + 0x98], r12
mov qword [rbx], rax
mov eax, dword [rsp + 0x90]
mov dword [rbx + 0xc], eax
mov al, byte [rsp + 0x80]
mov byte [rbx + 0x14], al
cmp byte [rcx + 0x4a], r12b
je 0x1401335f5
test esi, esi
js 0x1401335f5
cmp esi, edi
jg 0x1401335f5
test dl, dl
je 0x1401335d0
mov rcx, rbx
call fcn.1401336a4
jmp 0x1401335f2
sub edi, dword [rcx + 0x70]
cmp esi, edi
jg 0x1401335f5
cmp byte [rcx + 0x48], r12b
jne 0x1401335c6
mov rdx, rbx
cmp byte [rcx + 0x58], r12b
je 0x1401335ed
call fcn.140132cd8
jmp 0x1401335f2
call fcn.14013055c
mov r10b, al
mov rdi, qword [rbx + 0x80]
test r10b, r10b
je 0x140133676
mov eax, dword [rbx + 8]
mov ebp, r12d
mov dword [rdi], eax
mov eax, dword [rbx + 0x98]
mov dword [rdi + 4], eax
add rdi, 8
mov esi, dword [rbx + 0x8c]
sub esi, 2
sar esi, 1
test esi, esi
jle 0x14013368c
mov rcx, qword [rbx + 0xa0]
mov edx, ebp
add rcx, 0x20
call fcn.14012d43c
movsxd rcx, dword [rax]
mov rax, qword [rbx + 0x68]
mov edx, dword [rax + rcx*4]
cmp edx, 0x7fffffff
je 0x140133660
mov rax, qword [rbx + 0x70]
mov ecx, dword [rax + rcx*4]
sub ecx, edx
test ecx, ecx
jle 0x14013365b
add edx, dword [rbx + 8]
jmp 0x140133665
mov edx, r12d
jmp 0x140133665
or ecx, 0xffffffff
or edx, ecx
mov dword [rdi], edx
inc ebp
mov dword [rdi + 4], ecx
add rdi, 8
cmp ebp, esi
jl 0x140133625
jmp 0x14013368c
movsxd r8, dword [rbx + 0x8c]
or edx, 0xffffffff
shl r8, 2
mov rcx, rdi
call fcn.140167a80
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140151f00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
and qword [rbp + 0x20], 0
lea r14, [0x1401a5d88]
mov rsi, rdx
mov qword [rcx], r14
mov rdi, rcx
lea r9, [rbp + 0x20]
mov rcx, rsi
xor r8d, r8d
mov edx, 0x4000
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140151fb5
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x30]
or r8d, 0xffffffff
call fcn.14013c1dc
mov rbx, qword [rax]
mov qword [rax], r14
mov r14d, 8
mov rcx, qword [rbp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x140151f79
cmp eax, 0xffffffff
je 0x140151f86
sub eax, 1
mov dword [rcx], eax
jne 0x140151f86
mov rcx, qword [rbp + 0x30]
mov r8, r14
mov edx, 2
call fcn.14010b388
mov rcx, qword [rdi]
mov qword [rdi], rbx
mov eax, dword [rcx]
test eax, eax
je 0x140151f9e
cmp eax, 0xffffffff
je 0x140151fab
sub eax, 1
mov dword [rcx], eax
jne 0x140151fab
mov r8, r14
mov edx, 2
call fcn.14010b388
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rdi]
cmp dword [rax + 4], 0
jne 0x140152023
mov ebx, 0x10
lea rdx, [0x140221820]
mov r8d, ebx
mov rcx, rsi
call fcn.1401678f0
test eax, eax
jne 0x140151fe2
lea rbx, str.C:_tempqt_common
jmp 0x140151fff
mov r8, rbx
lea rdx, [0x140221830]
mov rcx, rsi
call fcn.1401678f0
test eax, eax
jne 0x140152023
lea rbx, str.C:_tempqt_user
mov rcx, rbx
call fcn.14016a910
mov dword [rbp - 0x10], eax
lea rdx, [rbp - 0x10]
mov qword [rbp - 8], rbx
mov rcx, rdi
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
call fcn.140139824
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
Function at 0x140161488
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov r9, r8
mov r8, rdx
mov edx, ecx
lea rcx, [rsp + 0x58]
call fcn.140161640
mov rcx, qword [rsp + 0x58]
lea rax, [0x1401a5d88]
cmp rcx, rax
je 0x140161580
cmp byte [0x140238570], 0
lea rcx, [rsp + 0x58]
jne 0x1401614e5
mov edx, 0xa
call fcn.140006514
lea rcx, [rsp + 0x58]
call fcn.14014385c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14016157b
lea rdx, [rsp + 0x20]
call fcn.140005fec
mov rbx, qword [rax]
cmp dword [rbx + 4], 0
je 0x14016151f
cmp qword [rbx + 0x10], 0
jl 0x14016151f
cmp qword [rbx + 0x10], 0x18
jae 0x14016151f
mov r8d, 0x3c
lea rdx, str.c:qt64qt_1544645195969workqtbaseincludeqtcore.._.._src_corelib_tools_qarraydata.h
lea rcx, str.size__0__offset___0__size_t_offset____sizeof_QArrayData_
call fcn.140122564
add rbx, qword [rbx + 0x10]
mov ecx, 2
call fcn.14016af38
mov rcx, rax
lea rdx, [0x14019d4c4]
mov r8, rbx
call fcn.14000a214
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14016155b
cmp eax, 0xffffffff
je 0x140161569
sub eax, 1
mov dword [rcx], eax
jne 0x140161569
mov rcx, qword [rsp + 0x20]
mov edx, 1
lea r8d, [rdx + 7]
call fcn.14010b388
mov ecx, 2
call fcn.14016af38
mov rcx, rax
call fcn.140173228
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx]
test eax, eax
je 0x140161597
cmp eax, 0xffffffff
je 0x1401615a5
sub eax, 1
mov dword [rcx], eax
jne 0x1401615a5
mov rcx, qword [rsp + 0x58]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14010b388
add rsp, 0x30
pop rbx
ret
Function at 0x140162f88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx]
lea rbx, [rdx + 4]
mov rdi, rcx
mov ecx, dword [rdx]
and ecx, 0x10
and eax, 0x10
je 0x140163050
test ecx, ecx
je 0x14016300f
test eax, eax
jne 0x140162fcf
mov r8d, 0x2c2
lea rdx, str.c:qt64qt_1544645195969workqtbase_srccorelibjsonqjson_p.h
lea rcx, str.value.latinKey
call fcn.140122564
movzx esi, word [rbx]
lea rdx, [rbx + 2]
movzx ebx, word [rdi + 4]
lea rcx, [rdi + 6]
cmp ebx, esi
mov eax, esi
cmovb eax, ebx
test eax, eax
je 0x140162ff3
mov r8d, eax
call fcn.1401678f0
jmp 0x140162ff5
xor eax, eax
test eax, eax
js 0x140163006
jne 0x140162fff
cmp ebx, esi
jb 0x140163006
mov ecx, 1
jmp 0x140163008
xor cl, cl
mov al, cl
jmp 0x1401630fb
mov qword [rsp + 0x30], rbx
test eax, eax
jne 0x140163031
mov r8d, 0x2c2
lea rdx, str.c:qt64qt_1544645195969workqtbase_srccorelibjsonqjson_p.h
lea rcx, str.value.latinKey
call fcn.140122564
lea rax, [rdi + 4]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.140162f14
xor al, 1
jmp 0x1401630fb
test ecx, ecx
je 0x140163090
mov qword [rsp + 0x30], rbx
test eax, eax
je 0x140163076
mov r8d, 0x2bd
lea rdx, str.c:qt64qt_1544645195969workqtbase_srccorelibjsonqjson_p.h
lea rcx, str._value.latinKey
call fcn.140122564
lea rax, [rdi + 4]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.14016310c
jmp 0x1401630fb
test eax, eax
je 0x1401630ad
mov r8d, 0x2bd
lea rdx, str.c:qt64qt_1544645195969workqtbase_srccorelibjsonqjson_p.h
lea rcx, str._value.latinKey
call fcn.140122564
mov r8d, dword [rdi + 4]
mov ecx, 1
mov r9d, dword [rbx]
cmp r8d, r9d
mov edx, r9d
cmovl edx, r8d
add rdi, 8
add rbx, 4
jmp 0x1401630df
movzx eax, word [rbx]
sub edx, ecx
cmp word [rdi], ax
jne 0x1401630e5
add rdi, 2
add rbx, 2
test edx, edx
jne 0x1401630cd
sub edx, ecx
cmp edx, 0xffffffff
jne 0x1401630f2
cmp r8d, r9d
setge al
jmp 0x1401630fb
movzx eax, word [rbx]
cmp word [rdi], ax
setae al
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14016a720
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14016a5ab
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14016a5ab
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14016a5ab
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14016a5ab
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14016a5ab
cmp dword [rcx + 0x84], 0xe
jbe 0x14016a5ab
cmp dword [rcx + 0xf8], 0
je 0x14016a5ab
mov ecx, ebx
call fcn.14016a64c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14016a428
cmp dword [rbp + 0x20], 0
je 0x14016a5f8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14016a600
int3
xor r8d, r8d
xor edx, edx
jmp 0x14016a544

Function at 0x140185ccc
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x140185ca9
call fcn.1401727cc
mov dword [rax], 0x16
call fcn.14016f588
or eax, 0xffffffff
jmp 0x140185cc6
sub dword [rcx + 0x10], 1
jns 0x140185cb8
add rsp, 0x28
jmp fcn.1401847c8
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x140185c88
Function at 0x416180
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41630b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006979f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4161e5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4161f4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416213
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416223
cmp rbx, 0x1000
jae 0x4161eb
jmp 0x41628d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416235
xor edx, edx
jmp 0x416284
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006979f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x416219
jmp 0x416208
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006979f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x0054a67f]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x0054abb0]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0054d5c0]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x416340
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416566
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006979f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4163b3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4163c2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4163e5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4163f5
cmp rbx, 0x1000
jae 0x4163b9
nop
jmp 0x416478
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41640d
xor esi, esi
jmp 0x41646a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006979f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4163eb
jmp 0x4163d6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006979f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416500
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x0054abc9]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x0054abb0]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00546e67]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4164a0
call sym.runtime.printlock
lea rax, [0x0054abc9]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x0054abb0]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0054cbad]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS