joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018880
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400188b0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x104c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x40]
mov edi, 4
mov dword [rsp + 0x34], eax
mov rax, rbx
mov r8d, edi
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub r8, 1
jne 0x140018910
movups xmm0, xmmword [rax]
mov rcx, qword [rsi + 0x10]
xor ebp, ebp
movups xmm1, xmmword [rax + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0xa098
movups xmmword [rdx], xmm0
mov dword [rsp + 0x1a110], ebp
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x20], rbp
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebp
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rax, [rsp + 0xa0e0]
nop word [rax + rax]
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rdi, 1
jne 0x140018a00
movups xmm0, xmmword [rax]
mov ecx, dword [rsp + 0xa0d0]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400188b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400188b0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x104c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x40]
mov edi, 4
mov dword [rsp + 0x34], eax
mov rax, rbx
mov r8d, edi
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub r8, 1
jne 0x140018910
movups xmm0, xmmword [rax]
mov rcx, qword [rsi + 0x10]
xor ebp, ebp
movups xmm1, xmmword [rax + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0xa098
movups xmmword [rdx], xmm0
mov dword [rsp + 0x1a110], ebp
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x20], rbp
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebp
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rax, [rsp + 0xa0e0]
nop word [rax + rax]
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rdi, 1
jne 0x140018a00
movups xmm0, xmmword [rax]
mov ecx, dword [rsp + 0xa0d0]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018ac0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140018af0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x104b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x40]
mov edi, 8
mov dword [rsp + 0x34], eax
mov rax, rbx
mov r8d, edi
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub r8, 1
jne 0x140018b50
movups xmm0, xmmword [rax]
mov rcx, qword [rsi + 0x10]
xor ebp, ebp
movups xmm1, xmmword [rax + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0xa098
movups xmmword [rdx], xmm0
mov dword [rsp + 0x1a110], ebp
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x20], rbp
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebp
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rax, [rsp + 0xa0e0]
nop word [rax + rax]
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rdi, 1
jne 0x140018c40
movups xmm0, xmmword [rax]
mov ecx, dword [rsp + 0xa0d0]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018af0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140018af0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x104b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x40]
mov edi, 8
mov dword [rsp + 0x34], eax
mov rax, rbx
mov r8d, edi
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub r8, 1
jne 0x140018b50
movups xmm0, xmmword [rax]
mov rcx, qword [rsi + 0x10]
xor ebp, ebp
movups xmm1, xmmword [rax + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0xa098
movups xmmword [rdx], xmm0
mov dword [rsp + 0x1a110], ebp
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x20], rbp
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebp
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rax, [rsp + 0xa0e0]
nop word [rax + rax]
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rdi, 1
jne 0x140018c40
movups xmm0, xmmword [rax]
mov ecx, dword [rsp + 0xa0d0]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018d00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140018d30
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x104e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x40]
mov edi, 4
mov dword [rsp + 0x34], eax
mov rax, rbx
mov r8d, edi
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub r8, 1
jne 0x140018d90
movups xmm0, xmmword [rax]
mov rcx, qword [rsi + 0x10]
xor ebp, ebp
movups xmm1, xmmword [rax + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0xa098
movups xmmword [rdx], xmm0
mov dword [rsp + 0x1a110], ebp
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x20], rbp
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebp
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rax, [rsp + 0xa0e0]
nop word [rax + rax]
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rdi, 1
jne 0x140018e80
movups xmm0, xmmword [rax]
mov ecx, dword [rsp + 0xa0d0]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018d30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140018d30
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x104e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x40]
mov edi, 4
mov dword [rsp + 0x34], eax
mov rax, rbx
mov r8d, edi
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub r8, 1
jne 0x140018d90
movups xmm0, xmmword [rax]
mov rcx, qword [rsi + 0x10]
xor ebp, ebp
movups xmm1, xmmword [rax + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0xa098
movups xmmword [rdx], xmm0
mov dword [rsp + 0x1a110], ebp
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x20], rbp
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebp
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rax, [rsp + 0xa0e0]
nop word [rax + rax]
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rdi, 1
jne 0x140018e80
movups xmm0, xmmword [rax]
mov ecx, dword [rsp + 0xa0d0]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140018f40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140018f70
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x104d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x40]
mov edi, 8
mov dword [rsp + 0x34], eax
mov rax, rbx
mov r8d, edi
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub r8, 1
jne 0x140018fd0
movups xmm0, xmmword [rax]
mov rcx, qword [rsi + 0x10]
xor ebp, ebp
movups xmm1, xmmword [rax + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0xa098
movups xmmword [rdx], xmm0
mov dword [rsp + 0x1a110], ebp
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x20], rbp
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebp
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rax, [rsp + 0xa0e0]
nop word [rax + rax]
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rdi, 1
jne 0x1400190c0
movups xmm0, xmmword [rax]
mov ecx, dword [rsp + 0xa0d0]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret