joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002b00
Capabilities:
Create thread

Disassembly:
test rcx, rcx
jne 0x180002b7e
movsd xmm3, qword [0x180015030]
movsd xmm4, qword [0x180015020]
movsd xmm5, qword [0x180015018]
mov ecx, 1
mov eax, ecx
movsd xmm2, qword [0x18001bf58]
movapd xmm0, xmm3
andpd xmm0, xmm4
comisd xmm0, xmm5
jbe 0x180002b6b
nop word [rax + rax]
addsd xmm2, xmm3
add ecx, 2
neg eax
movd xmm3, eax
movd xmm0, ecx
cvtdq2pd xmm3, xmm3
cvtdq2pd xmm0, xmm0
divsd xmm3, xmm0
movapd xmm1, xmm3
andpd xmm1, xmm4
comisd xmm1, xmm5
ja 0x180002b40
mulsd xmm2, qword [0x180015010]
xor eax, eax
movsd qword [0x18001bf58], xmm2
ret
mov rdx, rcx
lea rcx, [0x180002920]
jmp fcn.180001080

Function at 0x180004a24
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.18000a39c
nop
cmp dword [0x18001bfc0], 1
je 0x1800049d0
mov dword [0x18001bfbc], 1
mov byte [0x18001bfb8], r12b
test ebx, ebx
jne 0x1800049bc
mov rcx, qword [0x18001dfe8]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800049a9
mov rcx, qword [0x18001dfe0]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x180004948
call fcn.18000733c
cmp qword [rdi], rax
jne 0x180004948
jmp 0x18000492e
cmp rdi, rsi
jb 0x1800049a9
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.18000733c
mov qword [rdi], rax
call rbx
mov rcx, qword [0x18001dfe8]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x18001dfe0]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x180004987
cmp r13, rax
je 0x1800049a7
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x18000492e
lea rdx, [0x1800144b0]
lea rcx, [0x180014498]
call fcn.180004778
lea rdx, [0x1800144c0]
lea rcx, [0x1800144b8]
call fcn.180004778
nop
test r12d, r12d
je 0x1800049df
mov ecx, 8
call fcn.18000a29c
test r12d, r12d
jne 0x180004a0a
mov dword [0x18001bfc0], 1
lea ecx, [r12 + 8]
call fcn.18000a29c
mov ecx, r15d
call fcn.18000470c
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x180004898

Function at 0x180004a30
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180004898
Function at 0x18000a0e7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18001a2b0]
jne 0x1800045da
rol rcx, 0x10
test cx, 0xffff
jne 0x1800045d6
repz ret
ror rcx, 0x10
jmp 0x18000a040
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18001c430]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18001c528]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18000a0c5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18001c430]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18000a0e7
mov rax, qword [rsp + 0x88]
mov qword [0x18001c528], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18001c4c8], rax
mov rax, qword [0x18001c528]
mov qword [0x18001c3a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18001c4b0], rax
mov dword [0x18001c390], 0xc0000409
mov dword [0x18001c394], 1
mov rax, qword [0x18001a2b0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18001a2b8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18001c428], eax
mov ecx, 1
call fcn.18000d5e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180016850]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18001c428], 0
jne 0x18000a16e
mov ecx, 1
call fcn.18000d5e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1800102f8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18000733c
xor ebx, ebx
mov rdi, rax
cmp qword [0x18001cca0], rbx
jne 0x1800103fe
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800104d3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800104d3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18001cca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18001cca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18001ccb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18001ccc0], rax
test rax, rax
je 0x1800103f5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18001ccb8], rax
jmp 0x180010405
mov rax, qword [0x18001ccb8]
jmp 0x18001040c
mov rax, qword [0x18001ccb8]
mov r11, qword [0x18001ccc0]
cmp rax, rdi
je 0x180010474
cmp r11, rdi
je 0x180010474
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18001ccc0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180010474
test rax, rax
je 0x180010474
call rsi
test rax, rax
je 0x18001046e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18001046e
test byte [rsp + 0x38], 1
jne 0x180010474
bts ebp, 0x15
jmp 0x1800104b2
mov rcx, qword [0x18001cca8]
cmp rcx, rdi
je 0x1800104b2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800104b2
call rax
mov rbx, rax
test rax, rax
je 0x1800104b2
mov rcx, qword [0x18001ccb0]
cmp rcx, rdi
je 0x1800104b2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800104b2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18001cca0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800104d3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800104d5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140010fc0
Capabilities:
Set console window title

Disassembly:
push rbp
push rdi
push rsi
push r12
push rbx
sub rsp, 0x90
mov rbp, rsp
mov rbx, rcx
xor r12, r12
nop
lea rax, [0x1400c7500]
mov qword [rbp + 0x40], rax
lea rcx, str.BeefIDE_Debug_Console
mov edx, 0x15
call fcn.1400055a0
mov rsi, rax
cmp rsi, 0x80
jge 0x140011082
lea rdx, [rsi + 1]
lea rax, [rdx*2]
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.1400387f0
sub rsp, rax
lea rcx, [rsp + 0x30]
test rdx, rdx
je 0x140011055
lea rax, [rdx*2]
mov qword [rbp + 0x78], r12
movabs rdi, 0x380000009e
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rax
lea r12, [rbp + 0x70]
lea rdx, [rdx*2]
cmp rdx, 2
jg 0x140011065
jmp 0x14001106a
mov edx, 2
mov qword [rbp + 0x38], rcx
mov r8, rdx
mov dl, 0xcc
call fcn.1400a0db0
mov rcx, qword [rbp + 0x38]
mov rdi, rcx
jmp 0x1400110dc
lea rdi, [rsi + 1]
lea rcx, [rdi*2]
call fcn.14006d070
lea rdi, [rdi*2]
cmp rdi, 2
jg 0x1400110a3
jmp 0x1400110a8
mov edi, 2
mov qword [rbp + 0x30], rax
mov r8, rdi
mov dl, 0xcc
mov rcx, rax
call fcn.1400a0db0
mov rax, qword [rbp + 0x30]
mov rdi, rax
mov qword [rbp + 0x60], r12
movabs rax, 0x60000009e
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x68], rdi
lea r12, [rbp + 0x58]
nop
nop
lea rdx, str.BeefIDE_Debug_Console
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8d, 0x15
lea rcx, [rbp + 0x48]
call fcn.1400053d3
lea rcx, [rbp + 0x48]
call fcn.14001b72a
mov word [rdi + rsi*2], 0
nop
mov rcx, rdi
call sub.KERNEL32.dll_SetConsoleTitleW
cmp r12, 0
je 0x14001117a
movabs rax, 0x60000009e
cmp qword [r12], rax
je 0x14001113b
movabs rax, 0x380000009e
cmp qword [r12], rax
je 0x140011154
jmp 0x14001117a
mov rax, r12
mov r12, qword [rax + 8]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x10], 0
je 0x140011152
call fcn.14006bcf0
jmp 0x140011113
mov rax, r12
mov r12, qword [rax + 8]
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jl 0x140011175
movabs rax, 0xdddddddddddddddd
mov qword [rdx], rax
jmp 0x140011178
mov byte [rdx], 0xdd
jmp 0x140011113
lea rsp, [rbp + 0x90]
pop rbx
pop r12
pop rsi
pop rdi
pop rbp
ret
Function at 0x14001dcd3
Capabilities:
Hash data with md5

Disassembly:
mov dword [rcx + 0x10], 0x67452301
mov dword [rcx + 0x14], 0xefcdab89
mov dword [rcx + 0x18], 0x98badcfe
mov dword [rcx + 0x1c], 0x10325476
mov dword [rcx + 8], 0
mov dword [rcx + 0xc], 0
ret

Function at 0x14001ea30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
movsxd rdi, edx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rax, 0xffffffffffffffff
je 0x14001ea85
xor ebx, ebx
lea r9, [rsp + 0x50]
mov r8d, edi
mov dword [rsp + 0x50], ebx
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rdi, rdi
jle 0x14001eaa1
xor ebx, ebx
nop dword [rax]
movsx ecx, byte [rsi + rbx]
call fcn.14006d13c
inc rbx
cmp rbx, rdi
jl 0x14001ea90
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140021ec0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
mov rdi, r8
mov rsi, rdx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400335d0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14002ec40
mov ebx, dword [rsp + 0x34]
movsxd r8, dword [rsp + 0x30]
test r14, r14
je 0x140021f4f
movsxd rdx, dword [rsi]
lea rcx, [r8 + 1]
cmp rdx, rcx
jl 0x140021f47
lea eax, [r8 + 1]
bt ebx, 0x1e
lea rdx, [rsp + 0x38]
movsxd r8, eax
cmovb rdx, qword [rsp + 0x38]
mov rcx, r14
mov dword [rsi], eax
call fcn.1400a0710
test rdi, rdi
je 0x140021f60
mov dword [rdi], 0
jmp 0x140021f60
test edx, edx
je 0x140021f4f
mov byte [r14], 0
lea eax, [r8 + 1]
mov dword [rsi], eax
test rdi, rdi
je 0x140021f60
mov dword [rdi], 2
shr ebx, 0x1f
test bl, bl
je 0x140021f71
mov rcx, qword [rsp + 0x38]
call fcn.14006bcf0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x140021f80
call fcn.14006bcf0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x1400230f0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x40
cmp dword [rcx], 0
mov rbx, rcx
je 0x14002319a
cmp byte [rcx + 0x40], 0
je 0x14002319a
add rcx, 8
mov qword [rsp + 0x50], rdi
test dword [rbx + 4], 0x40000000
je 0x140023121
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140023130
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x20]
bts eax, 0x1e
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x24], eax
call fcn.14002eae0
mov rcx, rax
call fcn.140033830
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x30]
mov edi, eax
test rcx, rcx
je 0x140023176
call fcn.14006bcf0
mov ecx, dword [rsp + 0x24]
shr ecx, 0x1f
test cl, cl
je 0x14002318b
mov rcx, qword [rsp + 0x28]
call fcn.14006bcf0
test edi, edi
mov rdi, qword [rsp + 0x50]
jne 0x14002319a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 0x18]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400231ae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400231c2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x30]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400231d6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x38]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400231ea
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbx + 4]
shr eax, 0x1f
test al, al
je 0x1400231fd
mov rcx, qword [rbx + 8]
call fcn.14006bcf0
mov edx, 0x48
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp fcn.1400387c8
Function at 0x140023960
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov r10d, r9d
mov r11, r8
and r10d, 1
shl r10d, 2
mov eax, r10d
test r9b, 2
je 0x140023984
test r8, r8
je 0x140023984
bts eax, 0x10
lea r8, [rsp + 0x58]
mov r9, rdx
mov qword [rsp + 0x28], r8
mov rdx, r11
mov r8, rcx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x1400239b4
mov ecx, dword [rsp + 0x58]
mov qword [rdx], rcx
add rsp, 0x38
ret

Function at 0x140023ce0
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140023d0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
je 0x140023d16
mov dword [rbx], 1
add rsp, 0x20
pop rbx
ret
test rbx, rbx
je 0x140023d16
mov dword [rbx], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1400245f0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov qword [rsp + 0x28], rcx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140024605
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x20]
bts eax, 0x1e
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x24], eax
call fcn.14002eae0
mov eax, dword [rsp + 0x24]
shr eax, 0x1f
test al, al
je 0x14002463e
mov rcx, qword [rsp + 0x28]
call fcn.14006bcf0
lea rcx, [rsp + 0x30]
call fcn.140033830
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140024685
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
je 0x140024690
cmp eax, 3
je 0x14002467d
cmp eax, 0xb7
mov ecx, 7
mov edx, 1
cmovne ecx, edx
mov dword [rbx], ecx
jmp 0x140024690
mov dword [rbx], 8
jmp 0x140024690
test rbx, rbx
je 0x140024690
mov dword [rbx], 0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002469f
call fcn.14006bcf0
add rsp, 0x40
pop rbx
ret

Function at 0x1400247f0
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov qword [rsp + 0x28], rcx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140024805
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x20]
bts eax, 0x1e
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x24], eax
call fcn.14002eae0
mov eax, dword [rsp + 0x24]
shr eax, 0x1f
test al, al
je 0x14002483e
mov rcx, qword [rsp + 0x28]
call fcn.14006bcf0
lea rcx, [rsp + 0x30]
call fcn.140033830
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140024883
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
je 0x14002488e
cmp eax, 2
je 0x14002487b
cmp eax, 0x91
mov ecx, 0xe
mov edx, 1
cmovne ecx, edx
mov dword [rbx], ecx
jmp 0x14002488e
mov dword [rbx], 8
jmp 0x14002488e
test rbx, rbx
je 0x14002488e
mov dword [rbx], 0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002489d
call fcn.14006bcf0
add rsp, 0x40
pop rbx
ret
Function at 0x140025340
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
lea r9, [rsp + 0x40]
xor ebx, ebx
mov rdi, r8
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140025395
mov rdx, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x40]
test rdx, rdx
je 0x140025387
cmp rcx, rdi
mov r8d, 0xb
cmovne ebx, r8d
mov dword [rdx], ebx
mov rax, rcx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x1400253ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], 1
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400256e0
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x1400261f0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov qword [rsp + 0x28], rcx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140026210
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x20]
bts eax, 0x1e
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x24], eax
call fcn.14002eae0
mov rcx, rax
call fcn.140033830
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x30]
mov edi, eax
test rcx, rcx
je 0x140026256
call fcn.14006bcf0
mov ecx, dword [rsp + 0x24]
shr ecx, 0x1f
test cl, cl
je 0x14002626b
mov rcx, qword [rsp + 0x28]
call fcn.14006bcf0
test edi, edi
jne 0x1400262ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
je 0x140026295
cmp eax, 1
je 0x140026295
test rbx, rbx
je 0x1400262b6
mov dword [rbx], 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
test rbx, rbx
je 0x1400262b6
mov dword [rbx], 8
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
test rbx, rbx
je 0x1400262b6
mov dword [rbx], 0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400287d0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x238
cmp qword [0x1400f2a70], 0
jne 0x140028857
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rax, [rsp + 0x20]
sub rax, 2
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140028800
mov ecx, dword [0x1400d5768]
movups xmm0, xmmword [str._ntdll.dll]
movups xmmword [rax], xmm0
mov dword [rax + 0x10], ecx
movzx ecx, word [0x1400d576c]
mov word [rax + 0x14], cx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x1400f2a70], rax
test rax, rax
je 0x140028857
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400f2a68], rax
add rsp, 0x238
ret

Function at 0x140028860
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x238
cmp qword [0x1400f2a88], 0
jne 0x140028904
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rax, [rsp + 0x20]
sub rax, 2
nop
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140028890
movups xmm0, xmmword [0x1400d5790]
mov ecx, dword [0x1400d57a8]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400d57a0]
movsd qword [rax + 0x10], xmm0
mov dword [rax + 0x18], ecx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x1400f2a88], rax
test rax, rax
je 0x140028904
lea rdx, str.SetThreadDescription
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400f2a88]
lea rdx, str.GetThreadDescription
mov qword [0x1400f2a78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400f2a80], rax
add rsp, 0x238
ret
Function at 0x140028910
Capabilities:
Read file via mapping

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400f2a60]
test rax, rax
jne 0x140028a25
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, str.BfpSharedInfo__d
lea rcx, [rsp + 0x30]
call fcn.14002e280
test dword [rsp + 0x34], 0x40000000
lea r8, [rsp + 0x38]
cmovne r8, qword [rsp + 0x38]
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test rax, rax
jne 0x1400289d3
test dword [rsp + 0x34], 0x40000000
lea rax, [rsp + 0x38]
cmovne rax, qword [rsp + 0x38]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 8
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor r9d, r9d
mov qword [rsp + 0x20], 8
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
mov qword [0x1400f2a60], rax
mov qword [rax], rcx
call qword [sym.imp.WINMM.dll_timeGetTime]
mov rcx, qword [0x1400f2a60]
mov dword [rcx + 4], eax
jmp 0x1400289f6
xor r9d, r9d
mov qword [rsp + 0x20], 8
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x1400f2a60], rax
mov ecx, 1
call qword [sym.imp.WINMM.dll_timeBeginPeriod]
mov ecx, dword [rsp + 0x34]
mov rbx, qword [0x1400f2a60]
shr ecx, 0x1f
test cl, cl
je 0x140028a1d
mov rcx, qword [rsp + 0x38]
call fcn.14006bcf0
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x140028e20
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rsi, rdx
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [rbx + 0x30]
lea rdi, [rbx + 0x10]
lea eax, [rcx + 1]
mov dword [rbx + 0x30], eax
cmp byte [rbx + 0x38], 0
jne 0x140028f58
cmp qword [rdi], 0
jne 0x140028f58
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [rdi], rax
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [rbx + 0x30]
lea eax, [rcx + 1]
mov dword [rbx + 0x30], eax
cmp byte [rbx + 0x38], 0
je 0x140028e99
mov dword [rbx + 0x30], ecx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140028f45
lea rax, [rsp + 0x50]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x28], rax
lea r8, [0x140029170]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [rbx + 0x24]
mov r14, rax
cmp dword [rbx + 0x20], ecx
jl 0x140028f24
mov eax, ecx
mov qword [rsp + 0x58], rbp
lea ebp, [rcx + 1]
cdq
sub eax, edx
sar eax, 1
add ebp, eax
movsxd rcx, ebp
shl rcx, 3
call fcn.14006d070
mov rdx, qword [rbx + 0x18]
mov rdi, rax
test rdx, rdx
je 0x140028f18
movsxd rcx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140028f0f
mov r8, rcx
mov rcx, rax
shl r8, 3
call fcn.1400a0710
mov rcx, qword [rbx + 0x18]
call fcn.14006bcf0
mov dword [rbx + 0x24], ebp
mov rbp, qword [rsp + 0x58]
mov qword [rbx + 0x18], rdi
movsxd rcx, dword [rbx + 0x20]
mov rax, qword [rbx + 0x18]
mov qword [rax + rcx*8], r14
inc dword [rbx + 0x20]
dec dword [rbx + 0x30]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14, qword [rsp + 0x60]
dec dword [rbx + 0x30]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdi, [rbx + 0x10]
jmp 0x140028f65
mov dword [rbx + 0x30], ecx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdx, qword [rdi]
xor r9d, r9d
mov rcx, qword [rsi + 0x10]
mov r8, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]