joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007860
Capabilities:
Terminate process

Disassembly:
xor edx, edx
jmp 0x140007920
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
mov ebp, 1
cmove rbx, rbp
mov esi, edx
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000798a
test sil, 2
jne 0x140007986
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140009670
mov ecx, ebp
call qword [sym.imp.MSVCR120.dll_exit]
int3
xor eax, eax
jmp 0x1400079f1
test sil, 4
je 0x1400079ee
test al, 3
jne 0x1400079e1
test bl, 3
jne 0x1400079e1
cmp rbx, 0x400
ja 0x1400079e1
xor r9d, r9d
mov rcx, rax
add rax, rbx
mov r8, rax
mov edx, r9d
sub r8, rdi
add r8, 3
shr r8, 2
cmp rdi, rax
cmova r8, r9
test r8, r8
je 0x1400079ee
nop dword [rax + rax]
inc rdx
mov dword [rcx], r9d
lea rcx, [rcx + 4]
cmp rdx, r8
jb 0x1400079d0
jmp 0x1400079ee
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140007890
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x20
mov edi, 1
test rcx, rcx
jne 0x1400078a7
test rdx, rdx
cmove rdx, rdi
call qword [sym.imp.MSVCR120.dll_realloc]
test rax, rax
jne 0x1400078e5
lea rcx, str.out_of_memory_n
mov qword [rsp + 0x30], rbx
call sub.libintl_8.dll_libintl_gettext
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140009670
mov ecx, edi
call qword [sym.imp.MSVCR120.dll_exit]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007920
Capabilities:
Terminate process

Disassembly:
xor edx, edx
jmp 0x140007920
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
mov ebp, 1
cmove rbx, rbp
mov esi, edx
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000798a
test sil, 2
jne 0x140007986
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140009670
mov ecx, ebp
call qword [sym.imp.MSVCR120.dll_exit]
int3
xor eax, eax
jmp 0x1400079f1
test sil, 4
je 0x1400079ee
test al, 3
jne 0x1400079e1
test bl, 3
jne 0x1400079e1
cmp rbx, 0x400
ja 0x1400079e1
xor r9d, r9d
mov rcx, rax
add rax, rbx
mov r8, rax
mov edx, r9d
sub r8, rdi
add r8, 3
shr r8, 2
cmp rdi, rax
cmova r8, r9
test r8, r8
je 0x1400079ee
nop dword [rax + rax]
inc rdx
mov dword [rcx], r9d
lea rcx, [rcx + 4]
cmp rdx, r8
jb 0x1400079d0
jmp 0x1400079ee
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.MSVCR120.dll_memset
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007a10
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov edi, 0x80
xor r14d, r14d
mov rcx, rdi
call fcn.140007860
mov rbx, qword [rsp + 0x60]
lea rbp, [rsp + 0x68]
mov rsi, rax
call qword [sym.imp.MSVCR120.dll__errno]
mov r9, rbp
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
mov dword [rax], r14d
call fcn.1400093e0
movsxd rcx, eax
test eax, eax
jns 0x140007abb
call qword [sym.imp.MSVCR120.dll__errno]
cmp dword [rax], r14d
je 0x140007a82
call qword [sym.imp.MSVCR120.dll__errno]
cmp dword [rax], 0xc
jne 0x140007add
cmp rdi, 0x3fffffff
jae 0x140007b21
mov ebx, 0x3fffffff
cmp rdi, 0x1fffffff
jae 0x140007aa1
lea rbx, [rdi + rdi]
mov qword [rsp + 0x20], r14
cmp rbx, rdi
jb 0x140007b13
mov rcx, rsi
call fcn.140007900
mov rdi, rbx
jmp 0x140007a36
lea rax, [rdi - 1]
mov rbx, rcx
cmp rcx, rax
jb 0x140007aa1
cmp rcx, rdi
jbe 0x140007a82
cmp rcx, 0x3ffffffd
ja 0x140007a82
lea eax, [rcx + 2]
movsxd rbx, eax
jmp 0x140007aa1
call qword [sym.imp.MSVCR120.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.MSVCR120.dll_strerror]
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
lea rdx, str.vsnprintf_failed:__s_n
lea rcx, [rax + 0x60]
mov r8, rbx
call fcn.140009670
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
mov rax, rsi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov rbx, rax
call qword [sym.imp.MSVCR120.dll___iob_func]
mov rdx, rbx
lea rcx, [rax + 0x60]
call fcn.140009670
mov ecx, 1
call qword [sym.imp.MSVCR120.dll_exit]
int3
Function at 0x1400080e0
Capabilities:
Get session user name

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov qword [rcx], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x140013d30]
mov dword [rsp + 0x30], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x140008141
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.user_name_lookup_failure:_error_code__lu
mov ebx, eax
call sub.libintl_8.dll_libintl_gettext
mov edx, ebx
mov rcx, rax
call fcn.140007a10
mov rbx, qword [rsp + 0x38]
mov qword [rdi], rax
xor eax, eax
add rsp, 0x20
pop rdi
ret
lea rax, [0x140013d30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400082a0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
cmp qword [str.msvcrt], 0
mov rsi, rcx
je 0x14000835b
mov qword [rsp + 0x30], rbp
lea rbp, str.msvcrt
mov qword [rsp + 0x38], rdi
xor edi, edi
mov rcx, rbp
mov ebx, edi
mov rax, qword [rbx + rbp + 0x10]
test rax, rax
jne 0x140008332
cmp qword [rbx + rbp + 8], rax
jne 0x140008337
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbx + rbp + 8], rax
test rax, rax
jne 0x140008302
mov qword [rbx + rbp + 8], 0xffffffffffffffff
jmp 0x140008337
lea rdx, [0x140010b30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + rbp + 0x10], rax
test rax, rax
jne 0x140008332
mov rcx, qword [rbx + rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + rbp + 8], 0xffffffffffffffff
jmp 0x140008337
mov rcx, rsi
call rax
inc rdi
lea rcx, [rdi + rdi*2]
lea rbx, [rcx*8]
cmp qword [rbx + rbp], 0
lea rcx, [rbx + rbp]
jne 0x1400082d3
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.MSVCR120.dll__strdup]
mov rbx, rax
test rax, rax
je 0x14000838b
mov edx, 0x3d
mov rcx, rax
call qword [sym.imp.MSVCR120.dll_strchr]
mov rdx, rax
test rax, rax
jne 0x140008399
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_free]
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov byte [rax], 0
inc rdx
or rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x1400083a3
test rax, rax
je 0x1400083be
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x140008382
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_free]
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.MSVCR120.dll__putenv]
Function at 0x140009550
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x478
mov rax, qword [0x140013460]
xor rax, rsp
mov qword [rsp + 0x450], rax
test rcx, rcx
jne 0x140009595
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 0x16
or eax, 0xffffffff
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000c8c0
add rsp, 0x478
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x470], rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44f]
mov qword [rsp + 0x460], rdi
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x44], 0
mov qword [rsp + 0x30], rax
call fcn.140009760
mov rdi, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
movzx ebx, byte [rsp + 0x44]
sub rdi, rcx
test bl, bl
jne 0x140009633
test rdi, rdi
je 0x140009633
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x468], rsi
mov esi, 1
mov edx, esi
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_fwrite]
mov ecx, dword [rsp + 0x40]
movzx ebx, bl
add ecx, eax
cmp rax, rdi
cmovne ebx, esi
mov rsi, qword [rsp + 0x468]
jmp 0x140009637
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x460]
or eax, 0xffffffff
test bl, bl
mov rbx, qword [rsp + 0x470]
cmovne ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000c8c0
add rsp, 0x478
ret

Function at 0x1400096f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov rdi, qword [rbx]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x140009742
test rdi, rdi
je 0x140009742
mov r9, qword [rbx + 0x18]
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
mov rax, qword [rbx + 8]
mov qword [rbx], rax
je 0x140009745
mov byte [rbx + 0x24], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a060
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
cmp dword [rsp + 0x50], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], r14
mov r14, rcx
mov edi, r8d
je 0x14000a0a5
movsxd rax, r9d
mov rbp, rcx
test r9d, r9d
je 0x14000a0a1
nop dword [rax]
dec rax
cmp byte [rbp], 0
je 0x14000a0a1
inc rbp
test rax, rax
jne 0x14000a090
sub ebp, ecx
jmp 0x14000a0b9
or rbp, 0xffffffffffffffff
nop dword [rax]
inc rbp
cmp byte [rcx + rbp], 0
jne 0x14000a0b0
sub edi, ebp
mov eax, 0
cmovs edi, eax
test edx, edx
je 0x14000a0c9
neg edi
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rsi
test edi, edi
jle 0x14000a133
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000a124
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x14000a124
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000a12d
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000a11d
test rsi, rsi
je 0x14000a11d
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x14000a11d
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec edi
test edi, edi
jg 0x14000a0d7
mov r8, rbx
mov edx, ebp
mov rcx, r14
call fcn.14000a8d0
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
test edi, edi
jns 0x14000a1ae
neg edi
movsxd rsi, edi
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000a1a0
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x14000a1a0
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000a1a9
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000a199
test rdi, rdi
je 0x14000a199
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000a199
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec rsi
jne 0x14000a153
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a240
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x80
mov rax, qword [0x140013460]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, qword [rsp + 0xd0]
xor ebp, ebp
movsx eax, dl
add eax, 0xffffffa8
mov r10, rcx
lea r11, str.0123456789abcdef
mov dword [rsp + 0x24], ebp
mov esi, ebp
cmp eax, 0x20
ja case.0x14000a2a5.89
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0xa490]
mov ecx, dword [rdx + rax*4 + 0xa478]
add rcx, rdx
jmp rcx
mov ecx, 0xa
test r10, r10
jns 0x14000a2be
mov dword [rsp + 0x24], 0x2d
neg r10
jmp 0x14000a2e7
test r8d, r8d
je 0x14000a2e7
mov dword [rsp + 0x24], 0x2b
jmp 0x14000a2e7
mov ecx, 8
jmp 0x14000a2e7
mov ecx, 0xa
jmp 0x14000a2e7
lea r11, str.0123456789ABCDEF
mov ecx, 0x10
mov qword [rsp + 0x90], rdi
mov edi, dword [rsp + 0xc0]
test r10, r10
jne 0x14000a308
cmp dword [rsp + 0xc8], esi
je 0x14000a308
test edi, edi
je 0x14000a32f
lea r8, [rsp + 0x30]
nop dword [rax]
xor edx, edx
mov rax, r10
inc esi
div rcx
lea r8, [r8 + 1]
mov r10, rax
movzx eax, byte [rdx + r11]
mov byte [r8 - 1], al
test r10, r10
jne 0x14000a310
mov eax, dword [rsp + 0xb0]
sub edi, esi
cmovs edi, ebp
sub eax, edi
sub eax, esi
cmovs eax, ebp
mov dword [rsp + 0x20], eax
test r9d, r9d
je 0x14000a351
neg eax
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0xb8]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x24]
mov r9, rbx
call fcn.14000aa40
test edi, edi
jle 0x14000a39b
nop
mov rax, qword [rbx + 0x10]
dec edi
test rax, rax
je 0x14000a38e
cmp qword [rbx], rax
jb 0x14000a38e
cmp qword [rbx + 0x18], rbp
je 0x14000a397
mov rcx, rbx
call fcn.1400096f0
mov rax, qword [rbx]
mov byte [rax], 0x30
inc qword [rbx]
test edi, edi
jg 0x14000a370
movsxd rdi, esi
test esi, esi
jle 0x14000a3e2
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
movsx esi, byte [rsp + rdi + 0x2f]
dec rdi
test rax, rax
je 0x14000a3d4
cmp qword [rbx], rax
jb 0x14000a3d4
cmp qword [rbx + 0x18], rbp
je 0x14000a3dd
mov rcx, rbx
call fcn.1400096f0
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
test rdi, rdi
jg 0x14000a3b0
mov eax, dword [rsp + 0x20]
test eax, eax
jns 0x14000a44b
neg eax
movsxd rsi, eax
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000a43d
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x14000a43d
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000a446
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], bpl
jne 0x14000a436
test rdi, rdi
je 0x14000a436
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000a436
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec rsi
jne 0x14000a3f0
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14000c8c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x14000a4c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
xor eax, eax
lea edi, [r8 - 1]
mov qword [rsp + 0x30], rbp
test edi, edi
mov rbx, r9
mov ebp, ecx
cmovs edi, eax
test edx, edx
je 0x14000a4e5
neg edi
mov qword [rsp + 0x38], rsi
test edi, edi
jle 0x14000a54c
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000a53d
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x14000a53d
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000a546
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000a536
test rsi, rsi
je 0x14000a536
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x14000a536
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec edi
test edi, edi
jg 0x14000a4f0
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000a569
cmp qword [rbx], rax
jb 0x14000a569
cmp qword [rbx + 0x18], 0
je 0x14000a572
mov rcx, rbx
call fcn.1400096f0
mov rax, qword [rbx]
mov byte [rax], bpl
inc qword [rbx]
mov rbp, qword [rsp + 0x30]
test edi, edi
jns 0x14000a5db
neg edi
movsxd rsi, edi
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000a5cd
mov rdi, qword [rbx]
cmp rdi, rax
jb 0x14000a5cd
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000a5d6
mov rcx, qword [rbx + 8]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000a5c6
test rdi, rdi
je 0x14000a5c6
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000a5c6
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec rsi
jne 0x14000a580
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a8d0
Capabilities:
Write file on windows

Disassembly:
test edx, edx
jle 0x14000a994
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov qword [rsp + 0x30], rsi
mov rbx, r8
mov ebp, edx
mov qword [rsp + 0x38], rdi
mov r14, rcx
nop word [rax + rax]
cmp qword [rbx + 0x10], 0
je 0x14000a90e
mov eax, dword [rbx + 0x10]
sub eax, dword [rbx]
jmp 0x14000a910
mov eax, ebp
test eax, eax
jg 0x14000a955
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000a97a
mov rcx, qword [rbx + 8]
mov rdi, qword [rbx]
sub rdi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000a94c
test rdi, rdi
je 0x14000a94c
mov r8, rdi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000a94c
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x14000a976
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
cmovl esi, eax
mov rdx, r14
movsxd rdi, esi
mov r8, rdi
call qword [sym.imp.MSVCR120.dll_memmove]
add qword [rbx], rdi
add r14, rdi
sub ebp, esi
test ebp, ebp
jg 0x14000a900
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000aa40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp dword [r8], 0
mov qword [rsp + 0x38], r14
mov rbx, r9
mov r14, rdx
mov rdi, r8
mov esi, ecx
jle 0x14000aadd
test ecx, ecx
je 0x14000aadd
mov qword [rsp + 0x30], rbp
mov ebp, dword [rdx]
test ebp, ebp
je 0x14000aaa3
mov rax, qword [r9 + 0x10]
test rax, rax
je 0x14000aa91
cmp qword [r9], rax
jb 0x14000aa91
cmp qword [r9 + 0x18], 0
je 0x14000aa9a
mov rcx, rbx
call fcn.1400096f0
mov rax, qword [rbx]
mov byte [rax], bpl
inc qword [rbx]
dec dword [rdi]
mov dword [r14], 0
cmp dword [rdi], 0
mov rbp, qword [rsp + 0x30]
jle 0x14000aadd
nop dword [rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000aacd
cmp qword [rbx], rax
jb 0x14000aacd
cmp qword [rbx + 0x18], 0
je 0x14000aad6
mov rcx, rbx
call fcn.1400096f0
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
dec dword [rdi]
cmp dword [rdi], 0
jg 0x14000aab0
xor eax, eax
cmp dword [r14], eax
setne al
cmp dword [rdi], eax
jle 0x14000ab54
nop dword [rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000ab3d
mov rsi, qword [rbx]
cmp rsi, rax
jb 0x14000ab3d
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000ab46
mov rcx, qword [rbx + 8]
sub rsi, rcx
cmp byte [rbx + 0x24], 0
jne 0x14000ab36
test rsi, rsi
je 0x14000ab36
mov r8, rsi
mov edx, 1
call qword [sym.imp.MSVCR120.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rsi
je 0x14000ab36
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rbx]
mov byte [rax], 0x20
inc qword [rbx]
dec dword [rdi]
xor eax, eax
cmp dword [r14], eax
setne al
cmp dword [rdi], eax
jg 0x14000aaf0
mov esi, dword [r14]
mov r14, qword [rsp + 0x38]
test esi, esi
je 0x14000aba6
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000ab7d
cmp qword [rbx], rax
jb 0x14000ab7d
cmp qword [rbx + 0x18], 0
je 0x14000ab86
mov rcx, rbx
call fcn.1400096f0
mov rax, qword [rbx]
mov byte [rax], sil
inc qword [rbx]
mov eax, dword [rdi]
test eax, eax
jle 0x14000aba0
dec eax
mov dword [rdi], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
jns 0x14000aba6
inc eax
mov dword [rdi], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b2d0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14000b2e6
lea rcx, [rbx + 3]
call qword [sym.imp.MSVCR120.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x14000b320
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 0xc
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, [rax + 1]
mov r8, rbx
mov rdx, rdi
mov byte [rax], 0x22
call sub.MSVCR120.dll_memcpy
mov rcx, rsi
mov word [rsi + rbx + 1], 0x22
call qword [sym.imp.MSVCR120.dll_system]
mov edi, eax
call qword [sym.imp.MSVCR120.dll__errno]
mov rcx, rsi
mov ebx, dword [rax]
call qword [sym.imp.MSVCR120.dll_free]
call qword [sym.imp.MSVCR120.dll__errno]
mov rsi, qword [rsp + 0x38]
mov dword [rax], ebx
mov rbx, qword [rsp + 0x30]
mov eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x14000ba70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14000ba98
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 2
xor eax, eax
add rsp, 0x20
pop rbx
ret
test al, 0x10
jne 0x14000bab0
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 0x14
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ecx, 0x120
mov qword [rsp + 0x30], rdi
call qword [sym.imp.MSVCR120.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000bae1
call qword [sym.imp.MSVCR120.dll__errno]
mov rdi, qword [rsp + 0x30]
mov dword [rax], 0xc
xor eax, eax
add rsp, 0x20
pop rbx
ret
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14000bae5
add rcx, 4
call qword [sym.imp.MSVCR120.dll_malloc]
mov rcx, rax
mov qword [rdi], rax
test rax, rax
jne 0x14000bb25
call qword [sym.imp.MSVCR120.dll__errno]
mov rcx, rdi
mov dword [rax], 0xc
call qword [sym.imp.MSVCR120.dll_free]
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, rax
nop dword [rax + rax]
movzx eax, byte [rbx]
lea rdx, [rdx + 1]
lea rbx, [rbx + 1]
mov byte [rdx - 1], al
test al, al
jne 0x14000bb30
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x14000bb50
cmp byte [rax + rcx - 1], 0x2f
je 0x14000bb9a
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x14000bb70
cmp byte [rax + rcx - 1], 0x5c
je 0x14000bb9a
lea rdx, [rcx - 1]
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x14000bb86
movzx eax, word [0x140010d94]
mov word [rdx], ax
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14000bba0
movzx eax, word [0x140010d98]
mov qword [rdi + 0x118], 0xffffffffffffffff
mov word [rcx], ax
xor eax, eax
mov dword [rdi + 8], eax
mov word [rdi + 0xc], ax
mov rax, rdi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x14000bbe0
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140013460]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x118]
lea rdx, [rsp + 0x20]
cmp rcx, 0xffffffffffffffff
jne 0x14000bc36
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbx + 0x118], rax
cmp rax, 0xffffffffffffffff
jne 0x14000bc6c
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 2
xor eax, eax
jmp 0x14000bca5
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000bc6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x14000bc5b
call qword [sym.imp.MSVCR120.dll__errno]
mov dword [rax], 0
xor eax, eax
jmp 0x14000bca5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000c190
xor eax, eax
jmp 0x14000bca5
lea rdx, [rsp + 0x4c]
mov rax, rbx
lea rcx, [rsp + 0x4c]
sub rax, rdx
lea rdx, [rax + 0x10]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx + rcx - 1], al
test al, al
jne 0x14000bc80
or rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax + 0x10], 0
jne 0x14000bc93
mov word [rbx + 0xe], ax
lea rax, [rbx + 8]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14000c8c0
add rsp, 0x170
pop rbx
ret