joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140155f48
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x140155f7f
call fcn.140156d3c
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.1401501b4
xor eax, eax
jmp 0x14015600d
mov rdx, r9
mov rcx, r8
call fcn.140155ee4
mov rbx, rax
test rax, rax
je 0x14015600a
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140155e10]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x140155ff7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140156cb0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140155fde
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140155fed
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1401675b4
jmp 0x14015600a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140156007
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1401640fc
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14016411c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140156cb0
or eax, 0xffffffff
jmp 0x14016411e
xor eax, eax
add rsp, 0x28
ret

Function at 0x14016c364
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14016c37a
mov al, 1
jmp 0x14016c3da
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14016c38b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14016c3d8
mov ecx, dword [rcx + 0x18]
nop
call fcn.14016f564
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14016c3d8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14016c3d8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14016c3d8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14016c3da
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14016ecb8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14016ed3f
mov rsi, rbx
cmp word [rax], bp
je 0x14016ecfe
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14016ece8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14016ece4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1401675f0
mov rdi, rax
test rax, rax
je 0x14016ed2c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14014b350
mov rbp, rdi
xor ecx, ecx
call fcn.1401675b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401719f8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140167250
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140171a99
cmp ebx, dword [rsp + 0x30]
je 0x140171a92
test esi, esi
je 0x140171a92
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140171a6d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140171a7a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140171a57
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140171a7e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140171a9b
mov eax, 1
jmp 0x140171a9b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140176a50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140176a78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140176a78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x2fc531e90
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc532f70
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc532892
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc555108]
test eax, eax
je 0x2fc53292a
lea rax, [0x2fc5550e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc555110]
mov qword [rbp - 8], rax
jmp 0x2fc53290e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc532902
cmp qword [rbp - 0x10], 0
je 0x2fc532902
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc5328c8
lea rax, [0x2fc5550e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc53292b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc532a30
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc532a58
mov eax, 0
jmp 0x2fc532aa6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc532a81
mov eax, 0
jmp 0x2fc532aa6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc532aa1
mov eax, 0
jmp 0x2fc532aa6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc532aac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc532b2a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc532b21
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc532b21
mov rax, qword [rbp - 8]
jmp 0x2fc532b3f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc532af4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d5e70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d6f50
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d6872
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f9108]
test eax, eax
je 0x2fc4d690a
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f9110]
mov qword [rbp - 8], rax
jmp 0x2fc4d68ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d68e2
cmp qword [rbp - 0x10], 0
je 0x2fc4d68e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d68a8
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d690b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d6a10
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6a38
mov eax, 0
jmp 0x2fc4d6a86
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d6a61
mov eax, 0
jmp 0x2fc4d6a86
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6a81
mov eax, 0
jmp 0x2fc4d6a86
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d6a8c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d6b0a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d6b01
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d6b01
mov rax, qword [rbp - 8]
jmp 0x2fc4d6b1f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d6ad4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4da880
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4db960
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4db282
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fd108]
test eax, eax
je 0x2fc4db31a
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fd110]
mov qword [rbp - 8], rax
jmp 0x2fc4db2fe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4db2f2
cmp qword [rbp - 0x10], 0
je 0x2fc4db2f2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4db2b8
lea rax, [0x2fc4fd0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4db31b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4db420
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4db448
mov eax, 0
jmp 0x2fc4db496
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4db471
mov eax, 0
jmp 0x2fc4db496
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4db491
mov eax, 0
jmp 0x2fc4db496
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4db49c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4db51a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4db511
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4db511
mov rax, qword [rbp - 8]
jmp 0x2fc4db52f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4db4e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14018ffe0]
mov dword [rax], 1
mov rax, qword [0x14018fff0]
mov dword [rax], 1
mov rax, qword [0x140190000]
mov dword [rax], 1
mov rax, qword [0x14018ffd0]
mov dword [rax], 1
mov rax, qword [0x14018fe40]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x14000b2d0
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r13, rcx
mov rcx, rdx
mov edx, 1
mov rbx, r8
mov r9, r13
call sym.fread
mov r12, rax
cmp rbx, rax
je 0x14000b303
mov rcx, r13
call sym.ferror
test eax, eax
jne 0x14000b310
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
mov rcx, r13
call sym.checkErr__stdZsyncio_u162.part.0
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
ret

Function at 0x14000bd30
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov rcx, rdx
mov edx, 1
mov r9, r12
call sym.fwrite
mov rcx, r12
mov r13, rax
call sym.ferror
test eax, eax
je 0x14000bd62
mov rcx, r12
call sym.checkErr__stdZsyncio_u162.part.0
mov rax, r13
add rsp, 0x28
pop r12
pop r13
ret
Function at 0x14000c080
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rax, [0x1401694e0]
mov r14, rcx
mov r13, rdx
lea rcx, [rsp + 0x20]
mov edx, 0xfa0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov rbx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
test rbx, rbx
jle 0x14000c1f8
mov rcx, qword [0x14018fe10]
lea rdi, [rsp + 0x30]
movabs r15, 0x7fffffffffffffff
movabs rbp, 0x8000000000000000
call sym.__emutls_get_address
mov rsi, rax
nop dword [rax]
mov rax, qword [rsp + 0x48]
mov r9, r13
mov r8d, 0xfa0
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
mov r12, rax
cmp rax, 0xfa0
je 0x14000c190
mov rcx, r13
call sym.ferror
test eax, eax
je 0x14000c153
mov rcx, r13
call sym.checkErr__stdZsyncio_u162.part.0
cmp byte [rsi], 0
je 0x14000c240
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000c170
test byte [rcx + 7], 0x40
je 0x14000c230
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, r14
movups xmmword [r14], xmm0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp byte [rsi], 0
jne 0x14000c15c
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
test rbx, rbx
jle 0x14000c1f8
mov r8, rbx
add r8, 1
jo 0x14000c20d
test r8, r8
js 0x14000c218
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
add rdx, 8
lea rcx, [rcx + rax + 8]
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x14000c20d
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jg 0x14000c118
nop dword [rax]
xor ecx, ecx
lea rdx, [rbx - 1]
call sym.raiseIndexError2
mov rcx, qword [rsp + 0x48]
jmp 0x14000c161
call sym.raiseOverflow
jmp 0x14000c1e3
mov r8, r15
xor edx, edx
mov rcx, rbp
call sym.raiseRangeErrorI
jmp 0x14000c1e3
call sym.deallocShared
jmp 0x14000c170
test r12, r12
js 0x14000c2b8
lea rcx, [rsp + 0x40]
mov rdx, r12
call sym.setLengthStrV2
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call sym.prepareAdd
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test rbx, rbx
jle 0x14000c161
mov r8, rbx
add r8, 1
jo 0x14000c2fb
test r8, r8
js 0x14000c2d6
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
lea r9, [rdx + rax + 8]
lea rdx, [rcx + 8]
mov rcx, r9
call sym.memcpy
add rbx, qword [rsp + 0x30]
jo 0x14000c2fb
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x48]
jmp 0x14000c161
movabs r8, 0x7fffffffffffffff
mov rcx, r12
xor edx, edx
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x14000c161
movabs rcx, 0x8000000000000000
xor edx, edx
movabs r8, 0x7fffffffffffffff
call sym.raiseRangeErrorI
mov rcx, qword [rsp + 0x48]
jmp 0x14000c161
call sym.raiseOverflow
jmp 0x14000c15c
Function at 0x14000c310
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r14, rcx
mov r13, rdx
mov r12, r8
test r8, r8
js 0x14000c400
lea rdi, [rsp + 0x20]
mov rdx, r8
mov rcx, rdi
call sym.mnewString
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
test rdx, rdx
jle 0x14000c450
mov rax, qword [rsp + 0x38]
mov r9, r13
mov r8, r12
mov edx, 1
lea rcx, [rax + 8]
call sym.fread
mov r15, rax
cmp r12, rax
je 0x14000c392
mov rcx, r13
call sym.ferror
test eax, eax
jne 0x14000c420
mov rcx, qword [0x14018fe10]
call sym.__emutls_get_address
cmp byte [rax], 0
mov rbx, rax
jne 0x14000c3de
mov rcx, r13
call sym.fgetc
mov rdx, r13
mov ecx, eax
mov esi, eax
call sym.ungetc
cmp byte [rbx], 0
jne 0x14000c3de
test esi, esi
jns 0x14000c460
cmp r12, r15
jle 0x14000c3de
test r15, r15
js 0x14000c430
lea rcx, [rsp + 0x30]
mov rdx, r15
call sym.setLengthStrV2
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, r14
movups xmmword [r14], xmm0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, r12
call sym.raiseRangeErrorI
jmp 0x14000c3de
mov rcx, r13
call sym.checkErr__stdZsyncio_u162.part.0
jmp 0x14000c392
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, r15
call sym.raiseRangeErrorI
jmp 0x14000c3de
sub rdx, 1
xor ecx, ecx
call sym.raiseIndexError2
jmp 0x14000c3de
mov rdx, r13
mov rcx, rdi
call sym.readAllBuffer__stdZsyncio_u511
cmp byte [rbx], 0
mov rsi, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
jne 0x14000c4bf
lea rcx, [rsp + 0x30]
mov rdx, rsi
call sym.prepareAdd
test rsi, rsi
jle 0x14000c4bf
mov r8, rsi
add r8, 1
jo 0x14000c4e1
test r8, r8
js 0x14000c4f0
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
lea rcx, [rdx + rax + 8]
lea rdx, [r12 + 8]
call sym.memcpy
add rsi, qword [rsp + 0x30]
jo 0x14000c4e1
mov qword [rsp + 0x30], rsi
test r12, r12
je 0x14000c3de
test byte [r12 + 7], 0x40
jne 0x14000c3de
mov rcx, r12
call sym.deallocShared
jmp 0x14000c3de
call sym.raiseOverflow
jmp 0x14000c4bf
movabs r8, 0x7fffffffffffffff
xor edx, edx
movabs rcx, 0x8000000000000000
call sym.raiseRangeErrorI
jmp 0x14000c4bf

Function at 0x14000c980
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r12, rcx
mov rbx, r8
mov rcx, rdx
test r8, r8
jle 0x14000c9d0
mov r9, r12
mov edx, 1
call sym.fread
mov r13, rax
cmp rbx, rax
je 0x14000c9c0
mov rcx, r12
call sym.ferror
test eax, eax
je 0x14000c9c0
mov rcx, r12
call sym.checkErr__stdZsyncio_u162.part.0
mov rax, r13
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
lea rdx, [r8 - 1]
xor ecx, ecx
call sym.raiseIndexError2
mov rax, r13
add rsp, 0x20
pop rbx
pop r12
pop r13
ret

Function at 0x14000cc60
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov rcx, rdx
mov r13, rdx
call sym.strlen
mov rcx, r13
mov r9, r12
mov edx, 1
mov r8, rax
call sym.fwrite
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp sym.fflush