joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e140
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r15d, edx
mov rbp, rcx
xor esi, esi
xor r14d, r14d
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, qword [0x1400970d8]
mov rdi, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14002e199
lea ecx, [rsi + 2]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
mov r14d, 1
mov rcx, rsi
neg rcx
sbb ebx, ebx
not ebx
and ebx, 0x2714
test rsi, rsi
je 0x14002e28b
lea r8, [rsp + 0x40]
mov edx, 0x20
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectA]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
je 0x14002e28b
mov eax, dword [rsp + 0x48]
lea rcx, [rsp + 0x60]
mov r9d, dword [rsp + 0x44]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetRect]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SaveDC]
mov rcx, rbp
mov ebx, eax
call fcn.14002ca20
test eax, eax
je 0x14002e212
xor edx, edx
mov rcx, rdi
call fcn.14007cd6c
mov r8d, 2
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DPtoLP]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_RestoreDC]
mov edx, 0x96
lea rcx, [rsp + 0x60]
mov r8d, edx
call qword [sym.imp.USER32.dll_OffsetRect]
mov edx, 4
lea rcx, [rsp + 0x60]
mov r8d, edx
call qword [sym.imp.USER32.dll_InflateRect]
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.USER32.dll_ReleaseDC]
xor edi, edi
lea r8, [rsp + 0x60]
and dword [rsp + 0x30], edi
mov r9d, r15d
mov dword [rsp + 0x28], 1
mov rcx, rbp
mov qword [rsp + 0x20], rsi
lea edx, [rdi + 6]
call fcn.14002ced0
mov ebx, eax
test rdi, rdi
je 0x14002e29c
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.USER32.dll_ReleaseDC]
test r14d, r14d
je 0x14002e2a7
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14008a940
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140030104
Capabilities:
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
xor r14d, r14d
movaps xmmword [rsp + 0x40], xmm6
movsxd r12, r8d
mov ebp, r9d
mov rsi, rdx
mov r15, rcx
test r9d, r9d
jns 0x14003013f
mov rdi, qword [rsp + 0xa0]
neg ebp
jmp 0x1400301aa
mov ecx, 9
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rcx, qword [r15 + 0x40]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov r9, qword [rsp + 0xa0]
mov edx, ebp
mov rdi, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, rdi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call fcn.14003bdf0
mov rcx, qword [r15 + 0x40]
mov rdx, rdi
mov r14d, eax
call qword [sym.imp.USER32.dll_ReleaseDC]
mov ebp, dword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
imul rbx, r12, 0xd4
movsxd rax, edi
mov r15d, dword [rbx + rsi + 0x48]
mov r12d, dword [rbx + rsi + 0x4c]
sub r15d, dword [rbx + rsi + 0x40]
sub r12d, dword [rbx + rsi + 0x44]
mov dword [rbx + rsi + 0x80], 0x6a
cmp rax, rdi
je 0x1400301ed
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc0000095
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
movsd xmm3, qword [0x14008e678]
lea eax, [rbp + 1]
movsd xmm4, qword [0x14008e648]
movd xmm6, r15d
movaps xmm0, xmm4
cvtdq2pd xmm6, xmm6
mov dword [rbx + rsi + 0x84], edi
mov dword [rbx + rsi + 0x88], eax
movd xmm5, r12d
comisd xmm6, xmm3
cvtdq2pd xmm5, xmm5
movaps xmm1, xmm6
movaps xmm2, xmm5
jbe 0x14003023e
movaps xmm0, xmm3
divsd xmm0, xmm6
mulsd xmm2, xmm0
mulsd xmm1, xmm0
comisd xmm2, xmm3
jbe 0x14003025a
divsd xmm3, xmm2
movaps xmm2, xmm5
movaps xmm1, xmm6
mulsd xmm0, xmm3
mulsd xmm2, xmm0
mulsd xmm1, xmm0
ucomisd xmm0, xmm4
jp 0x140030262
je 0x140030288
cvttsd2si ecx, xmm1
cvttsd2si eax, xmm2
sub ecx, r15d
add dword [rbx + rsi + 0x48], ecx
add dword [rbx + rsi + 0x38], ecx
add dword [rbx + rsi + 0x28], ecx
sub eax, r12d
add dword [rbx + rsi + 0x4c], eax
add dword [rbx + rsi + 0x3c], eax
add dword [rbx + rsi + 0x2c], eax
movaps xmm6, xmmword [rsp + 0x40]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14003c520
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov dword [rax + 0x10], edx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x60
and qword [rax - 0x48], 0
mov ebp, ecx
mov rcx, qword [0x1400b8a28]
mov edi, r9d
mov esi, r8d
xor r14d, r14d
xor r13d, r13d
call qword [sym.imp.USER32.dll_SetCursor]
lea ebx, [r14 + 1]
mov dword [0x140096f20], ebx
test edi, edi
jle 0x14003c72c
lea rax, [rsp + 0x48]
mov r9d, edi
mov qword [rsp + 0x28], rax
lea edx, [rbx + 0x6d]
lea rax, [rsp + 0x40]
mov r8d, esi
mov ecx, ebp
mov qword [rsp + 0x20], rax
call fcn.1400394d0
mov ebx, eax
test eax, eax
jne 0x14003c72c
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, 0x408
lea ecx, [rbx + 0x42]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x14003c6ce
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r8, [rsp + 0x98]
mov rdx, r15
mov rcx, rax
mov rbx, rax
call fcn.14003c748
mov eax, dword [rsp + 0x98]
mov rcx, rbx
lea eax, [rax*4 + 0x28]
cdqe
add rax, r15
mov qword [rsp + 0x48], rax
call qword [sym.imp.GDI32.dll_CreatePalette]
mov r14, rax
test rax, rax
je 0x14003c639
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectPalette]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_RealizePalette]
mov r8d, dword [r15 + 8]
mov rcx, rdi
mov edx, dword [r15 + 4]
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor ebx, ebx
mov rsi, rax
test rsi, rsi
mov eax, 0x2714
cmove ebx, eax
test ebx, ebx
jne 0x14003c6c0
and dword [rsp + 0x30], ebx
xor r8d, r8d
mov rax, qword [rsp + 0x48]
mov rdx, rsi
mov r9d, dword [r15 + 8]
mov rcx, rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.GDI32.dll_SetDIBits]
test eax, eax
sete bl
test eax, eax
je 0x14003c6c0
mov rcx, qword [0x1400970d8]
mov ebx, 0x2714
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14003c6c0
mov rdx, rsi
mov ecx, 2
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x14003c6ba
xor ebx, ebx
xor esi, esi
call qword [sym.imp.USER32.dll_CloseClipboard]
test rsi, rsi
je 0x14003c6ce
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test rbp, rbp
je 0x14003c6fb
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test r14, r14
je 0x14003c721
xor r8d, r8d
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectPalette]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_RealizePalette]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x14003cd08
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rcx, qword [0x1400970d8]
xor esi, esi
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14003cdcf
lea ecx, [rsi + 8]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbp, rax
test rax, rax
je 0x14003cdc9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
movsxd rdx, eax
lea ecx, [rsi + 0x42]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14003cdc9
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rsi
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r12, rax
test r14d, r14d
jle 0x14003cdb7
mov r13d, 0xfa00
cmp r14d, r13d
mov edi, r14d
mov rdx, r15
mov rcx, r12
cmovg edi, r13d
mov r8d, edi
mov ebx, edi
call sub.VCRUNTIME140.dll_memmove
add r15, rbx
add r12, rbx
sub r14d, edi
test r14d, r14d
jg 0x14003cd8f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14003d3e0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x30
mov rbp, rcx
mov r14, rdx
mov rcx, rdx
or rdi, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
mov rsi, rax
call fcn.140060aa8
mov ecx, dword [rsi + 0x26]
lea r9, [rsp + 0x70]
and dword [0x140096e78], 0
lea edx, [rdi + 0x65]
lea r8d, [rdi + 0x73]
call fcn.14004564c
mov ecx, dword [0x140096e78]
lea edx, [rdi + 2]
test eax, eax
lea r13d, [rdi + 3]
cmove ecx, edx
and qword [0x140096eb8], 0
and dword [0x140096eb4], 0
mov edx, 0xfffe
mov dword [0x140096e78], ecx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor ebx, ebx
mov ecx, 0x2714
test rax, rax
mov qword [0x140096eb8], rax
cmove ebx, ecx
test ebx, ebx
jne 0x14003d5e1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, 0x1002
mov rcx, rbp
mov qword [0x140096ec0], rax
call fcn.14007d020
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14003d4aa
mov ebx, 0x2713
jmp 0x14003d5e1
mov rcx, qword [rsi + 0xfe]
test rcx, rcx
je 0x14003d4c9
call fcn.140042df8
mov ebx, eax
test eax, eax
je 0x14003d4c9
or ebx, 0xffffffff
jmp 0x14003d5e1
mov r8d, dword [rsi + 0xf6]
mov rcx, rsi
call fcn.1400410bc
test ebx, ebx
jne 0x14003d5e1
mov r8d, dword [rsi + 0xf6]
lea r9, [rsp + 0x78]
mov ecx, dword [rsi + 0x26]
lea edx, [rbx + 0x65]
mov dword [rsp + 0x70], 1
call fcn.14004564c
mov ebx, eax
test eax, eax
jne 0x14003d545
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0x70]
mov ecx, dword [rsi + 0x26]
call fcn.14004172c
mov ebx, eax
test eax, eax
jne 0x14003d545
mov rcx, rsi
call fcn.140041468
mov ebx, eax
test eax, eax
jne 0x14003d545
mov rcx, rsi
call fcn.1400415cc
mov ebx, eax
test eax, eax
jne 0x14003d545
mov eax, dword [rsp + 0x70]
dec eax
mov dword [0x140096e7c], eax
test ebx, ebx
jne 0x14003d5e1
mov rcx, rdi
call fcn.14003d64c
mov ebx, eax
test eax, eax
jne 0x14003d5e1
mov rdx, rdi
mov rcx, rsi
call fcn.14003d77c
mov ebx, eax
test eax, eax
jne 0x14003d5e1
mov rdx, rdi
mov rcx, rsi
call fcn.14003dd00
mov ebx, eax
test eax, eax
jne 0x14003d5e1
mov eax, 0x6002
lea rdx, [rsp + 0x70]
mov r8, r13
mov word [rsp + 0x70], ax
mov rcx, rdi
call fcn.140040e10
mov ebx, eax
test eax, eax
jne 0x14003d5e1
mov eax, 0x6001
lea rdx, [rsp + 0x70]
mov r8, r13
mov word [rsp + 0x70], ax
mov rcx, rdi
call fcn.140040e10
mov ebx, eax
test eax, eax
jne 0x14003d5e1
mov rcx, rdi
call fcn.140040dc0
mov ebx, eax
test eax, eax
jne 0x14003d5e1
mov rcx, rdi
call fcn.140041a00
mov rcx, rdi
call fcn.140040dc0
mov ebx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x140096eb8]
test rcx, rcx
je 0x14003d611
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x140096eb8]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [0x140096eb8], 0
cmp rdi, 0xffffffffffffffff
je 0x14003d620
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x14003d62d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov ecx, r13d
call fcn.140078200
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x140040dc0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov r8d, dword [0x140096eb4]
test r8d, r8d
je 0x140040dff
mov rdx, qword [0x140096ec0]
lea r9, [rsp + 0x48]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140040e06
mov eax, dword [0x140096eb4]
cmp dword [rsp + 0x48], eax
jne 0x140040e06
and dword [0x140096eb4], 0
xor eax, eax
add rsp, 0x38
ret
mov eax, 0x2713
jmp 0x140040e01

Function at 0x140041934
Capabilities:
Encrypt data using rc4 prga
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r12d, r12d
mov rsi, r9
mov r14, r8
mov ebx, edx
mov r15, rcx
test edx, edx
jle 0x1400419d9
mov rbp, qword [rsp + 0x80]
lea r13d, [r12 + 1]
mov eax, 0xfffe
movzx edi, ax
cmp ebx, eax
jg 0x14004197e
movzx edi, bx
movzx r8d, di
lea r9, [rsp + 0x68]
mov rdx, rbp
mov qword [rsp + 0x20], r12
mov rcx, r15
sub ebx, r8d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400419f8
cmp r12w, di
jae 0x1400419d0
mov rdx, rbp
movzx r8d, di
movzx ecx, byte [rdx]
add word [r14], cx
xor byte [rsi], cl
movzx eax, word [rsi]
add ax, ax
cmp word [rsi], r12w
jge 0x1400419c5
or ax, r13w
add rdx, r13
mov word [rsi], ax
sub r8, r13
jne 0x1400419ac
mov eax, 0xfffe
test ebx, ebx
jg 0x140041974
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 0x2713
jmp 0x1400419db

Function at 0x140041a00
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
je 0x140041ab3
mov r14d, 0xa
mov dword [rsp + 0x36], eax
xor ebp, ebp
mov dword [rsp + 0x30], r14d
xor r9d, r9d
mov word [rsp + 0x34], bp
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140041ab3
lea rax, [0x140097720]
mov edx, edi
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x32]
mov rcx, rbx
call fcn.140041934
test eax, eax
jne 0x140041ab8
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140041ab3
lea r9, [rsp + 0x30]
mov r8d, r14d
mov edx, 0xfff
mov rcx, rbx
call fcn.140040d4c
jmp 0x140041ab8
mov eax, 0x2713
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008a940
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x140042d2c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx edi, dx
mov rsi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbp, rax
mov rcx, qword [rax + 0x14]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [rax + 0x14], 0xffffffff
je 0x140042dcc
lea eax, [rdi - 9]
mov ecx, 0xfffb
test cx, ax
je 0x140042d8d
cmp di, 0x26
je 0x140042d7a
cmp di, 0x28
jne 0x140042dcc
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
shr rax, 8
test al, al
jne 0x140042dcc
cmp di, 9
jne 0x140042dab
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
shr rax, 8
mov edx, ebx
test al, al
setne dl
jmp 0x140042db4
cmp di, 0x26
mov edx, ebx
sete dl
mov rcx, rsi
call fcn.140042c50
test eax, eax
je 0x140042dc7
mov ecx, eax
call fcn.140060714
mov ebx, 1
mov rcx, qword [rbp + 0x14]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400451c4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
movsxd rax, ecx
xor r9d, r9d
imul rbx, rax, 0xda
mov rax, qword [0x1400b94f0]
xor r8d, r8d
mov rdi, qword [rbx + rax + 0xc]
mov edx, dword [rbx + rax + 6]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x140045245
mov rdx, qword [0x1400b94f0]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
add rdx, 2
add rdx, rbx
mov r8d, 0xda
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140045245
mov rcx, qword [0x1400b94f0]
movzx eax, word [rbx + rcx + 0xa]
test al, 1
je 0x140045241
xor ax, 1
mov word [rbx + rcx + 0xa], ax
xor eax, eax
jmp 0x14004524a
mov eax, 0x2713
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14004528c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x1400b94f0]
mov r14, rcx
xor edi, edi
movsxd r13, edx
imul r9, r13, 0xda
mov rsi, qword [r14 + 0xa]
mov r12d, r8d
mov r15d, edi
mov ecx, dword [r9 + rax + 6]
mov rax, qword [r9 + rax + 0xc]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x78], ecx
test rsi, rsi
je 0x14004536c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
mov ebp, eax
mov rcx, rsi
mov eax, 0x4000
and bp, ax
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rbx, rax
test eax, eax
js 0x14004530a
movsxd rcx, ebx
cmp rcx, rax
je 0x14004531f
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc0000095
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
test ebx, ebx
jne 0x140045328
test bp, bp
je 0x140045383
mov rcx, rsi
test bp, bp
je 0x14004534a
movsxd rdx, dword [r14 + 6]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
mov rsi, rax
test rax, rax
je 0x140045383
jmp 0x140045393
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rsi
mov ebx, dword [rax + 0xa]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp ebx, dword [r14 + 6]
je 0x140045393
mov eax, 3
jmp 0x14004547f
movsxd rdx, dword [r14 + 6]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
jne 0x14004538d
mov eax, 0x2714
jmp 0x14004547f
mov r15d, 1
mov edx, dword [rsp + 0x78]
xor r9d, r9d
mov rbx, qword [rsp + 0x88]
xor r8d, r8d
add edx, dword [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1400453c1
mov ebx, 0x2713
jmp 0x140045462
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, dword [r14 + 6]
lea r9, [rsp + 0x70]
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400453b7
mov eax, dword [r14 + 2]
cmp dword [rbp + 6], eax
je 0x1400453fb
mov ebx, 4
jmp 0x140045455
mov eax, dword [r14 + 6]
cmp dword [rbp + 0xa], eax
je 0x14004540b
mov ebx, 3
jmp 0x140045455
movsx eax, word [rbp + 2]
cmp eax, r12d
je 0x14004541b
mov ebx, 5
jmp 0x140045455
and word [rbp + 0xe], 8
mov ebx, edi
mov word [rbp + 4], r13w
test r12d, r12d
jns 0x140045455
test r15d, r15d
je 0x140045455
cmp word [r14], 0xfffd
je 0x140045455
mov edx, edi
cmp di, word [rbp + 0x10]
jge 0x140045455
lea rcx, [rbp + 0x1c]
mov qword [rcx], rdi
inc edx
movsx eax, word [rbp + 0x10]
lea rcx, [rcx + 0x12]
cmp edx, eax
jl 0x140045444
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
je 0x140045476
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140045479
mov rdi, rsi
mov qword [r14 + 0xa], rdi
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004590c
Capabilities:
Get file size

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd rsi, ecx
xor edi, edi
mov ecx, esi
mov dword [rsp + 0x78], edi
call fcn.140046bf4
test eax, eax
jne 0x140045b34
mov ecx, esi
call fcn.140045770
test eax, eax
jne 0x140045b34
lea r9, [rsp + 0x80]
mov ecx, esi
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x20]
call fcn.140046380
mov ebx, eax
test eax, eax
jne 0x140045b34
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r13d, dword [rsp + 0x88]
xor r15d, r15d
mov r14d, dword [rsp + 0x80]
movsx r12d, word [rax]
test r12d, r12d
jle 0x140045acd
imul rcx, rsi, 0xda
lea r9d, [r12 - 1]
mov qword [rsp + 0x88], rcx
lea rdi, [rax + 4]
lea r11d, [rbx + 4]
lea r10d, [rbx + 1]
mov rax, qword [0x1400b94f0]
movsx ecx, word [rcx + rax + 0x14]
mov eax, dword [rdi + 8]
sar eax, cl
mov edx, eax
shl edx, cl
lea r8d, [rax + 1]
shl r8d, cl
mov ecx, r13d
cmp edx, dword [rdi + 8]
cmovge r8d, edx
add r8d, dword [rdi + 4]
cmp r15d, r9d
je 0x1400459e9
mov ecx, dword [rdi + 0x1a]
movzx eax, word [rdi]
add ax, r11w
cmp ax, r10w
jbe 0x1400459fb
add dword [rsp + 0x78], r10d
cmp r8d, ecx
jg 0x140045b44
jge 0x140045a12
sub r8d, ecx
add r14d, r8d
js 0x140045ac2
mov rcx, qword [rdi + 0xc]
test rcx, rcx
je 0x140045aa9
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
mov ecx, 0x4000
test cx, ax
jne 0x140045a9a
mov rcx, qword [rdi + 0xc]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
movzx ecx, word [rdi + 2]
mov rdx, rax
cmp word [rax], cx
je 0x140045a4c
mov ebx, InitCommonControls
jmp 0x140045a88
movzx eax, word [rdi]
cmp word [rdx + 2], ax
je 0x140045a5c
mov ebx, 5
jmp 0x140045a88
movsx eax, word [rdx + 4]
cmp eax, esi
je 0x140045a6b
mov ebx, 0x12
jmp 0x140045a88
mov eax, dword [rdi + 4]
cmp dword [rdx + 6], eax
je 0x140045a7a
mov ebx, 4
jmp 0x140045a88
mov eax, dword [rdi + 8]
mov ecx, 3
cmp dword [rdx + 0xa], eax
cmovne ebx, ecx
mov rcx, qword [rdi + 0xc]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
jne 0x140045b1c
mov r11d, 4
lea r9d, [r12 - 1]
lea r10d, [r11 - 3]
add rdi, 0x16
add r15d, r10d
cmp r15d, r12d
jge 0x140045ac9
mov rcx, qword [rsp + 0x88]
jmp 0x1400459b7
mov ebx, 0x13
jmp 0x140045b1c
mov edi, dword [rsp + 0x78]
mov r8, qword [0x1400b94f0]
mov eax, ebx
test r14d, r14d
mov ebx, 0x13
mov edx, 0x1e
cmovne eax, ebx
imul rcx, rsi, 0xda
mov ebx, eax
movsx eax, word [rcx + r8 + 0x16]
cmp edi, eax
cmovne ebx, edx
test ebx, ebx
jne 0x140045b1c
mov rcx, qword [rcx + r8 + 0xc]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, r13d
je 0x140045b1c
lea edx, [r13 + 1]
cmp eax, edx
lea ecx, [rbx + 0x1c]
cmovne ebx, ecx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebx
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ebx, reloc.COMCTL32.dll_InitCommonControls
jmp 0x140045b1c