joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007c40
Capabilities:
Terminate process

Disassembly:
xor edx, edx
jmp 0x140007c40
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test rcx, rcx
mov edi, 1
mov esi, edx
cmovne rdi, rcx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140007cb3
test sil, 2
jne 0x140007ca1
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
lea ecx, [rbx + 2]
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rdi
call fcn.14000a880
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test sil, 4
je 0x140007d0d
movzx eax, dil
or al, bl
test al, 3
jne 0x140007d00
cmp rdi, 0x400
ja 0x140007d00
xor edx, edx
lea rcx, [rdi + 3]
shr rcx, 2
lea rax, [rdi + rbx]
cmp rbx, rax
cmova rcx, rdx
test rcx, rcx
je 0x140007d0d
xor eax, eax
mov rdi, rbx
rep stosd dword [rdi], eax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140007d20
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x38
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edi, 0x80
mov ecx, edi
mov r14d, dword [rax]
call fcn.140007b90
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea r9, [rsp + 0x78]
mov edx, edi
mov rcx, rsi
mov dword [rax], r14d
mov rbp, qword [rsp + 0x70]
mov r8, rbp
call fcn.14000a560
test eax, eax
js 0x140007dd8
nop dword [rax]
movsxd rcx, eax
cmp rcx, rdi
jb 0x140007d95
cmp eax, 0x3ffffffe
ja 0x140007e24
inc eax
movsxd rbx, eax
cmp rbx, rdi
jb 0x140007e14
mov rcx, rsi
call fcn.140007c30
mov rcx, rbx
call fcn.140007b90
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea r9, [rsp + 0x78]
mov rdx, rbx
mov rcx, rsi
mov dword [rax], r14d
mov rbp, qword [rsp + 0x70]
mov r8, rbp
call fcn.14000a560
mov rdi, rbx
test eax, eax
jns 0x140007d80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call fcn.14000be10
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbp
lea rdx, str.vsnprintf_failed:__s_with_format_string___s__n
mov rcx, rax
mov r8, rbx
call fcn.14000a880
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, rsi
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.out_of_memory_n
call sub.libintl_8.dll_libintl_gettext
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.14000a880
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140008580
Capabilities:
Accept command line arguments
Query environment variable
Terminate process

Disassembly:
sub rsp, 0x48
lea rcx, str.PG_RESTRICT_EXEC
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [0x140017540], rax
test rax, rax
je 0x1400085b4
movzx ecx, byte [rax]
cmp cl, byte [0x140011da4]
jne 0x1400085b4
movzx eax, byte [rax + 1]
cmp al, byte [0x140011da5]
je 0x140008621
xor eax, eax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call fcn.1400079b0
lea rcx, str.PG_RESTRICT_EXEC1
mov rbx, rax
call fcn.140009280
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400086a0
mov rbx, qword [rsp + 0x40]
test rax, rax
jne 0x140008626
cmp dword [0x140017548], 4
jg 0x140008621
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.could_not_re_execute_with_restricted_token:_error_code__lu
mov ecx, 4
mov r8d, eax
call fcn.140008210
add rsp, 0x48
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x20]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14000868d
cmp dword [0x140017548], 4
jg 0x140008681
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.could_not_get_exit_code_from_subprocess:_error_code__lu
mov ecx, 4
mov r8d, eax
call fcn.140008210
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400089a0
Capabilities:
Get session user name

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov qword [rcx], 0
lea rcx, [0x140016ce0]
mov dword [rsp + 0x30], 0x101
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x140008a01
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.user_name_lookup_failure:_error_code__lu
mov ebx, eax
call sub.libintl_8.dll_libintl_gettext
mov rcx, rax
mov edx, ebx
call fcn.140007d20
mov rbx, qword [rsp + 0x38]
mov qword [rdi], rax
xor eax, eax
add rsp, 0x20
pop rdi
ret
lea rax, [0x140016ce0]
add rsp, 0x20
pop rdi
ret

Function at 0x140009280
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rbx, rax
test rax, rax
je 0x140009389
mov edx, 0x3d
mov rcx, rax
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x140009380
mov byte [rax], 0
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx + 1], 0
jne 0x1400092c0
test rcx, rcx
je 0x1400092e4
lea rdx, [rax + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x140009380
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [str.msvcrt]
test rax, rax
je 0x14000936c
mov qword [rsp + 0x30], rbp
xor ebp, ebp
mov qword [rsp + 0x40], rsi
mov ebx, ebp
lea rsi, str.msvcrt
nop
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rbp
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
test eax, eax
je 0x140009355
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140009355
lea rdx, [0x1400120d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000934a
mov rcx, rdi
call rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rsi + rbx*8 + 8]
inc rbx
test rax, rax
jne 0x140009310
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x48]
mov eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
Function at 0x1400093a0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, 0xffffffffffffffff
mov rsi, rcx
mov rcx, rbx
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400093c0
add rcx, 2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400094e4
mov r8, rsi
lea rdx, [0x1400120e0]
mov rcx, rax
call fcn.14000a6e0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rsi, rax
test rax, rax
je 0x1400094db
mov edx, 0x3d
mov rcx, rax
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x1400094d2
mov byte [rax], 0
nop
inc rbx
cmp byte [rax + rbx + 1], 0
jne 0x140009420
test rbx, rbx
je 0x140009444
lea rdx, [rax + 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x1400094d2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [str.msvcrt]
test rax, rax
je 0x1400094c7
mov qword [rsp + 0x30], rbp
lea rsi, str.msvcrt
xor ebp, ebp
mov ebx, ebp
nop dword [rax]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rbp
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
test eax, eax
je 0x1400094b5
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400094b5
lea rdx, [0x1400120d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400094aa
mov rcx, rdi
call rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [rsi + rbx*8 + 8]
inc rbx
test rax, rax
jne 0x140009470
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
jmp 0x1400094db
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a750
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x478
mov rax, qword [0x1400163a0]
xor rax, rsp
mov qword [rsp + 0x450], rax
test rcx, rcx
jne 0x14000a797
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000e240
add rsp, 0x478
ret
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x470], rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x460], rdi
mov dword [rsp + 0x40], 0
mov byte [rsp + 0x44], 0
call fcn.14000ab30
mov rcx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
movzx ebx, byte [rsp + 0x44]
sub rdi, rcx
test bl, bl
jne 0x14000a835
test rdi, rdi
je 0x14000a835
mov r9, qword [rsp + 0x38]
mov r8, rdi
mov qword [rsp + 0x468], rsi
mov esi, 1
mov edx, esi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, dword [rsp + 0x40]
add ecx, eax
movzx ebx, bl
cmp rax, rdi
cmovne ebx, esi
mov rsi, qword [rsp + 0x468]
jmp 0x14000a839
mov ecx, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x460]
test bl, bl
mov rbx, qword [rsp + 0x470]
mov eax, 0xffffffff
cmovne ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14000e240
add rsp, 0x478
ret

Function at 0x14000b280
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
mov r14d, ecx
cmp edx, 1
jne 0x14000b2e9
mov rax, qword [r8 + 0x10]
test rax, rax
je 0x14000b2cf
cmp qword [r8], rax
jb 0x14000b2cf
cmp qword [r8 + 0x18], 0
jne 0x14000b2c7
inc dword [r8 + 0x20]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, rbx
call fcn.14000b7d0
mov rax, qword [rbx]
mov byte [rax], r14b
inc qword [rbx]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edx, edx
jle 0x14000b381
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
nop dword [rax + rax]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000b30d
sub eax, dword [rbx]
jmp 0x14000b30f
mov eax, ebp
test eax, eax
jg 0x14000b351
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000b374
cmp byte [rbx + 0x24], 0
mov rcx, qword [rbx + 8]
jne 0x14000b348
mov rdi, qword [rbx]
sub rdi, rcx
je 0x14000b348
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000b348
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x14000b36e
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
mov edx, r14d
cmovl esi, eax
movsxd rdi, esi
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
add qword [rbx], rdi
sub ebp, esi
test ebp, ebp
jg 0x14000b300
jmp 0x14000b377
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000b3a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov ebp, edx
mov r14, rcx
cmp edx, 1
jne 0x14000b3f9
mov rax, qword [r8 + 0x10]
movzx edi, byte [rcx]
test rax, rax
je 0x14000b3eb
cmp qword [r8], rax
jb 0x14000b3eb
cmp qword [r8 + 0x18], 0
jne 0x14000b3e3
inc dword [r8 + 0x20]
jmp 0x14000b485
mov rcx, rbx
call fcn.14000b7d0
mov rax, qword [rbx]
mov byte [rax], dil
inc qword [rbx]
jmp 0x14000b485
test edx, edx
jle 0x14000b485
mov qword [rsp + 0x30], rsi
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000b413
sub eax, dword [rbx]
jmp 0x14000b415
mov eax, ebp
test eax, eax
jg 0x14000b457
mov r9, qword [rbx + 0x18]
test r9, r9
je 0x14000b47d
cmp byte [rbx + 0x24], 0
mov rcx, qword [rbx + 8]
jne 0x14000b44e
mov rdi, qword [rbx]
sub rdi, rcx
je 0x14000b44e
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
je 0x14000b44e
mov byte [rbx + 0x24], 1
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x14000b477
mov rcx, qword [rbx]
cmp eax, ebp
mov esi, ebp
mov rdx, r14
cmovl esi, eax
movsxd rdi, esi
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
add qword [rbx], rdi
add r14, rdi
sub ebp, esi
test ebp, ebp
jg 0x14000b406
jmp 0x14000b480
add dword [rbx + 0x20], ebp
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000b7d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
cmp byte [rbx + 0x24], 0
jne 0x14000b82e
mov qword [rsp + 0x30], rdi
mov rdi, qword [rbx]
sub rdi, rcx
je 0x14000b820
mov r9, qword [rbx + 0x18]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add dword [rbx + 0x20], eax
cmp rax, rdi
mov rax, qword [rbx + 8]
mov qword [rbx], rax
je 0x14000b815
mov byte [rbx + 0x24], 1
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x30]
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x14000c840
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14000c860
lea rcx, [rbx + 3]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x14000c89a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0xc
lea eax, [rsi - 1]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, [rax + 1]
mov byte [rax], 0x22
mov r8, rbx
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
mov word [rsi + rbx + 1], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edi, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rsi
mov ebx, dword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rsi, qword [rsp + 0x38]
mov dword [rax], ebx
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000cfa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14000cfc8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 2
xor eax, eax
add rsp, 0x20
pop rbx
ret
test al, 0x10
jne 0x14000cfe0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x14
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ecx, 0x120
mov qword [rsp + 0x30], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000d011
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, qword [rsp + 0x30]
mov dword [rax], 0xc
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x14000d020
add rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi], rax
mov rcx, rax
test rax, rax
jne 0x14000d060
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, rdi
mov dword [rax], 0xc
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14000d060
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
mov rdx, rcx
nop
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x14000d080
cmp byte [rax + rcx - 1], 0x2f
je 0x14000d0cc
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x14000d0a0
cmp byte [rax + rcx - 1], 0x5c
je 0x14000d0cc
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14000d0b5
movzx eax, word [0x140012814]
mov word [rcx], ax
mov rdx, qword [rdi]
dec rdx
nop
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x14000d0d0
movzx eax, word [0x140012818]
mov word [rdx], ax
xor eax, eax
mov dword [rdi + 8], eax
mov word [rdi + 0xc], ax
mov rax, rdi
mov qword [rdi + 0x118], 0xffffffffffffffff
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x14000d110
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x1400163a0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x118]
cmp rcx, 0xffffffffffffffff
jne 0x14000d161
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbx + 0x118], rax
cmp rax, 0xffffffffffffffff
jne 0x14000d197
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jmp 0x14000d174
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000d197
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x14000d186
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0
xor eax, eax
jmp 0x14000d1d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000d6c0
xor eax, eax
jmp 0x14000d1d7
lea rax, [rsp + 0x4c]
lea rdx, [rbx + 0x10]
sub rdx, rax
lea rcx, [rsp + 0x4c]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14000d1b0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax + 0x10], 0
jne 0x14000d1c5
mov word [rbx + 0xe], ax
lea rax, [rbx + 8]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14000e240
add rsp, 0x170
pop rbx
ret
Function at 0x140002db0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14003d010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002ddd
xor eax, eax
jmp 0x140002f23
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002e17
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002e17
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002f23
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002f16
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002e5a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002e69
movsx ecx, dil
jmp 0x140002ebd
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x140002f16
cmp eax, 1
jle 0x140002ed7
cmp eax, 3
jne 0x140002f16
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.14000cf0c
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002f1b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002f04
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14000dab4
cmp rsi, rax
jne 0x140002f16
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140002f1b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140005010
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x1400042b0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x14003d010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.140008260
mov eax, 1
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], eax
xor r9d, r9d
mov word [rsp + 0xb0], ax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], SafeArrayLock
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140004355
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140004357
xor al, al
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140005010
add rsp, 0xf0
pop rbx
ret