joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046060
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
cmp byte [0x1400b5599], 0
je 0x140046078
mov eax, dword [0x1400b559c]
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx r8d, ax
mov edx, r8d
and edx, 0x3ff
sub edx, 7
je 0x1400460e1
sub edx, 2
je 0x1400460da
sub edx, 1
je 0x1400460b6
sub edx, 0xb
je 0x1400460ac
cmp edx, 1
jne 0x1400460da
lea eax, [rdx + 1]
add rsp, 0x28
ret
mov eax, 5
add rsp, 0x28
ret
mov eax, 0xfc00
mov ecx, 0x800
and r8w, ax
mov edx, 1
cmp r8w, cx
mov eax, 3
cmovne eax, edx
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
mov eax, 4
add rsp, 0x28
ret
Function at 0x14004a730
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1400a7038]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x34], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x14004a80f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, vtable.LogItem.0
mov qword [rbp - 0x50], rax
call fcn.1400201b0
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.1400264e0
nop
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x68]
call fcn.1400264e0
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14001ff90
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x78]
call fcn.1400264e0
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.14001ff90
mov dword [rbp + 0x18], 1
mov dword [rbp + 0x1c], 1
lea rdx, str.Cannot_create_read_event._Error:
lea rcx, [rbp - 0x50]
call fcn.140020c20
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140020a20
nop
jmp 0x14004a8f8
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
mov r8d, r14d
mov rdx, rdi
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x14004a853
cmp eax, 0x3e5
jne 0x14004a901
mov edx, dword [rsi + 0x34]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14004a8a2
lea rcx, [rbp - 0x50]
call fcn.1400204e0
nop
mov dword [rax + 0x6c], 1
lea rdx, str.Timeout_occured_while_reading_from_heci_device.
mov rcx, rax
call fcn.140020c20
nop
lea rcx, [rbp - 0x50]
call fcn.140020720
mov rdx, rbx
mov rcx, rsi
call fcn.140049780
mov edi, 0xffffffff
jmp 0x14004a91c
mov r9d, 1
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x14004a918
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rcx, [rbp - 0x50]
call fcn.1400204e0
nop
mov dword [rax + 0x6c], 1
lea rdx, str.Read_function_fail_to_finish._Error:
mov rcx, rax
call fcn.140020c20
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140020a20
nop
lea rcx, [rbp - 0x50]
call fcn.140020720
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x10]
call qword [0x140089940]
mov edi, 0xffffffff
jmp 0x14004a91c
mov edi, dword [rsp + 0x34]
cmp rbx, 0xffffffffffffffff
je 0x14004a92b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140055f10
add rsp, 0x130
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14004a950
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1400a7038]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x34], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x14004aa2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rax, vtable.LogItem.0
mov qword [rbp - 0x50], rax
call fcn.1400201b0
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.1400264e0
nop
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x68]
call fcn.1400264e0
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14001ff90
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x78]
call fcn.1400264e0
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.14001ff90
mov dword [rbp + 0x18], 1
mov dword [rbp + 0x1c], 1
lea rdx, str.Cannot_create_write_event._Error:
lea rcx, [rbp - 0x50]
call fcn.140020c20
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140020a20
nop
jmp 0x14004ab68
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
mov r8d, r14d
mov rdx, rdi
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
test edi, edi
jne 0x14004aac6
cmp eax, 0x3e5
je 0x14004aac6
lea rcx, [rbp - 0x50]
call fcn.1400204e0
nop
mov dword [rax + 0x6c], 1
lea rdx, str.Write_to_device_failed._Return_code:
mov rcx, rax
call fcn.140020c20
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140020b20
mov rcx, rax
lea rdx, str._Error:
call fcn.140020c20
mov rcx, rax
lea rdx, [rsp + 0x38]
call fcn.140020a20
nop
jmp 0x14004ab68
mov edx, dword [rsi + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14004ab15
lea rcx, [rbp - 0x50]
call fcn.1400204e0
nop
mov dword [rax + 0x6c], 1
lea rdx, str.Timeout_occured_while_writing_to_heci_device.
mov rcx, rax
call fcn.140020c20
nop
lea rcx, [rbp - 0x50]
call fcn.140020720
mov rdx, rbx
mov rcx, rsi
call fcn.140049780
mov edi, 0xffffffff
jmp 0x14004ab8c
xor r9d, r9d
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x14004ab88
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rcx, [rbp - 0x50]
call fcn.1400204e0
nop
mov dword [rax + 0x6c], 1
lea rdx, str.Write_function_fail_to_finish._Error:
mov rcx, rax
call fcn.140020c20
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140020a20
nop
lea rcx, [rbp - 0x50]
call fcn.140020720
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x10]
call qword [0x140089940]
mov edi, 0xffffffff
jmp 0x14004ab8c
mov edi, dword [rsp + 0x34]
cmp rbx, 0xffffffffffffffff
je 0x14004ab9b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140055f10
add rsp, 0x130
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140050140
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1400a7038]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r10, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rdi, [rbp + 0x30]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, r10
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x1400502b5
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], si
mov rdx, qword [rsp + 0x20]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rdx + r8*2], si
jne 0x1400501d0
lea rcx, [rsp + 0x50]
call fcn.140026a20
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
lea rax, [rbp + 0x30]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140050222
mov r8, rdi
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.140026a20
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.14001fe10
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140050290
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005028b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005028b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140055f30
mov rax, rbx
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140055f10
mov rbx, qword [rsp + 0x380]
add rsp, 0x350
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbp - 0x30]
call fcn.14001fbb0
nop
mov rcx, rax
call fcn.140050830
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001fcb0
lea rdx, [0x1400a2b30]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140051520
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1400a7038]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140089940]
lea rcx, [rbx + 8]
cmp qword [rbx + 0x20], 8
jb 0x14005155a
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14005157d
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140055f10
add rsp, 0x140
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x30]
call fcn.1400262c0
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14001fe10
mov rbx, rax
lea rcx, [rsp + 0xd0]
call fcn.14001fbb0
nop
lea rdx, str.Error_when_deleting_file:
mov rcx, rax
call fcn.140027a10
mov rcx, rax
mov rdx, rbx
call fcn.140033060
mov rcx, rax
lea rdx, str.Last_error:
call fcn.140027a10
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140035bb0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001fcb0
lea rdx, [0x1400a2b30]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x140051610
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1400a7038]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x140089940]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14005164f
mov rdx, qword [rdi]
lea rcx, [rbx + 8]
cmp qword [rbx + 0x20], 8
jb 0x14005165e
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x140051689
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140055f10
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x180
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400262c0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001fe10
mov rdi, rax
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x50]
call fcn.1400262c0
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.14001fe10
mov rbx, rax
lea rcx, [rsp + 0x110]
call fcn.14001fbb0
nop
lea rdx, str.Error_when_renaming_file_from
mov rcx, rax
call fcn.140027a10
mov rcx, rax
mov rdx, rbx
call fcn.140033060
mov rcx, rax
call fcn.140051ce0
mov rcx, rax
mov rdx, rdi
call fcn.140033060
mov rcx, rax
lea rdx, str.Last_error:
call fcn.140027a10
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140035bb0
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.14001fcb0
lea rdx, [0x1400a2b30]
lea rcx, [rsp + 0xb0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1400517d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x1400a7038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], 0
test rdx, rdx
je 0x14005185d
mov edx, 0xc0000004
mov r9d, 2
call fcn.140051270
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, esi
mov rdx, rdi
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140051898
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140055f10
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.Invalid_data_passed
lea rcx, [rsp + 0x48]
call fcn.1400264a0
nop
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.140028cb0
lea rdx, [0x1400a2f50]
lea rcx, [rsp + 0x68]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x48]
call fcn.1400262c0
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14001fe10
mov rbx, rax
lea rcx, [rsp + 0x100]
call fcn.14001fbb0
nop
mov rcx, rax
call fcn.140051eb0
mov rcx, rax
lea rdx, [rsp + 0x38]
call fcn.14004b030
mov rcx, rax
lea rdx, str._bytes_to_file
call fcn.140027a10
mov rcx, rax
mov rdx, rbx
call fcn.140033060
mov rcx, rax
lea rdx, str.Last_error:
call fcn.140027a10
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140035bb0
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14001fcb0
lea rdx, [0x1400a2b30]
lea rcx, [rsp + 0xa0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140051940
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x1400a7038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x30], 0
test rdx, rdx
je 0x1400519fe
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140089940]
cmp eax, edi
jb 0x140051aca
mov rax, qword [rbx + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400519a9
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [0x140089940]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
call fcn.140051270
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, edi
mov rdx, rsi
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140051a39
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140055f10
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.Invalid_data_passed
lea rcx, [rsp + 0x40]
call fcn.1400264a0
nop
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140028cb0
lea rdx, [0x1400a2f50]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x40]
call fcn.1400262c0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14001fe10
mov rbx, rax
lea rcx, [rsp + 0x100]
call fcn.14001fbb0
nop
lea rdx, str.Error_when_reading_file
mov rcx, rax
call fcn.140027a10
mov rcx, rax
mov rdx, rbx
call fcn.140033060
mov rcx, rax
lea rdx, str.Last_error:
call fcn.140027a10
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140035bb0
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14001fcb0
lea rdx, [0x1400a2b30]
lea rcx, [rsp + 0xa0]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rdx, str.Invalid_size_passed
lea rcx, [rsp + 0x40]
call fcn.1400264a0
nop
mov dword [rsp + 0x30], 2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140028cb0
lea rdx, [0x1400a2f50]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140054bd0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
push rsi
push r14
sub rsp, 0x58
mov rax, qword [0x1400a7038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, qword [rdx + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov rsi, rdx
sub rax, r14
cmp rax, 2
jb 0x140054d8d
cmp qword [rdx + 0x18], 8
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x18], r15
jb 0x140054c24
mov rsi, qword [rdx]
xor r15d, r15d
lea rbp, [r14 + 2]
mov ebx, 7
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x30], r15
lea rdi, [rsp + 0x20]
mov qword [rsp + 0x38], r15
cmp rbp, rbx
jbe 0x140054cd4
mov rbx, rbp
or rbx, 7
cmp rbx, rcx
jbe 0x140054c62
mov rbx, rcx
lea rcx, [r15 - 2]
jmp 0x140054c91
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x140054d87
add rcx, rcx
cmp rcx, 0x1000
jb 0x140054cbd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140054d87
mov rcx, rax
call fcn.140055f48
test rax, rax
je 0x140054d4c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140054ccf
test rcx, rcx
je 0x140054ccc
call fcn.140055f48
mov rdi, rax
jmp 0x140054ccf
mov rdi, r15
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x38], rbx
mov rdx, rsi
lea rbx, [r14 + r14]
mov qword [rsp + 0x30], rbp
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [rbx + rdi], 0xa000d
lea rcx, [rsp + 0x20]
mov word [rdi + rbp*2], r15w
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140054d58
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054d53
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140054d53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140055f30
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140055f10
add rsp, 0x58
pop r14
pop rsi
ret
call fcn.14001f720
int3
call fcn.14001f7c0
int3
Function at 0x140109be0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140109c2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140109c2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140109c2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140109c2a
cmp dword [rcx + 0x84], 0xe
jbe 0x140109c2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140109c2c
xor al, al
add rsp, 0x28
ret

Function at 0x14010e2b0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14010e0ac
Function at 0x1401113b8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1401113e8
xor eax, eax
jmp 0x1401114ab
mov rbp, rbx
cmp word [rax], si
je 0x14011140d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1401113f4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1401113f0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1401112d8
movsxd r14, eax
test eax, eax
jne 0x14011144b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1401113e1
mov rcx, r14
call fcn.140111e74
mov rdi, rax
test rax, rax
jne 0x140111464
xor ecx, ecx
call fcn.14010f8fc
jmp 0x140111440
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1401112d8
test eax, eax
jne 0x140111495
mov rcx, rdi
call fcn.14010f8fc
jmp 0x14011149f
xor ecx, ecx
call fcn.14010f8fc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140116c60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140116c88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140116c88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
jnp 0x140023288
push rsp
xchg esi, eax
push rdi
invalid
jp 0x1400232da
invalid
loope 0x14002325b
invalid
iretd
stosb byte [rdi], al
mov edx, 0x195aa7ef
ror dword [rdi], 0x61
jle 0x1400232cb
jp 0x140023288
cli
pop rdi
adc ah, byte [rax - 0x10]
invalid
Function at 0x140006bcb
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov eax, dword [rcx + 8]
test eax, eax
jne 0x140006be9
mov rcx, rsi
call fcn.1400066ec
mov eax, dword [rsi + 8]
cmp eax, 2
je 0x140006c10
cmp eax, 1
jne 0x140006c80
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14004bf52
mov r9, qword [rsi]
test r9, r9
jne 0x140006c34
lea rcx, str.ctx__lgfp
lea rdx, str..._logging.c
mov r8d, 0x2f
call fcn.140065764
mov r9, qword [rsi]
mov rcx, qword [rdi]
mov r8, qword [rdi + 8]
mov edx, 1
call fcn.140067d48
cmp rax, qword [rdi + 8]
jae 0x140006c80
mov rcx, qword [rsi]
test rcx, rcx
je 0x140006c5f
call fcn.140066fbc
mov qword [rsi], 0
mov dword [rsi + 8], 3
mov rcx, qword [rsi + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, str.Disabled_writing_session_log_due_to_error_while_writing
add rsp, 0x28
pop rdi
pop rsi
jmp rax
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400092be
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx]
cmp rax, qword [rdx]
je 0x1400092f2
lea rcx, str.x0__nw__x1__nw
lea rdx, str..._mpint.c
mov r8d, 0x9a
call fcn.140065764
mov rax, qword [rdi]
and ebx, 1
neg rbx
mov qword [rsp + 0x28], rbx
test rax, rax
je 0x140009334
xor eax, eax
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
mov rdx, qword [rdx + rax*8]
xor rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x28]
and rcx, rdx
mov rdx, qword [rdi + 8]
xor qword [rdx + rax*8], rcx
mov rdx, qword [rsi + 8]
xor qword [rdx + rax*8], rcx
inc rax
cmp rax, qword [rdi]
jb 0x140009304
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140009600
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov rax, qword [rcx + 8]
mov rcx, rax
shr rcx, 0x3e
je 0x140009636
lea rcx, str.hex.len_____size_t_0____4
lea rdx, str..._mpint.c
mov r8d, 0xfa
call fcn.140065764
mov rax, qword [r14 + 8]
lea rax, [rax*4 + 0x3f]
shr rax, 6
mov ecx, 1
cmovne rcx, rax
call fcn.140009098
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400096de
mov r8, 0xffffffffffffffff
xor r9d, r9d
xor r10d, r10d
add rcx, qword [r14]
movsx ecx, byte [r8 + rcx]
movsxd rcx, ecx
lea rbx, [rcx - 0x61]
mov edx, 0x66
sub rdx, rcx
or rdx, rbx
sar rdx, 0x3f
lea rsi, [rcx - 0x41]
mov ebx, 0x46
sub rbx, rcx
or rbx, rsi
sar rbx, 0x3f
lea esi, [rcx - 0x30]
lea edi, [rcx - 0x57]
xor esi, edi
and edx, esi
add ecx, 0xffffffc9
xor edi, ecx
xor edi, edx
and ebx, edi
xor ebx, ecx
and ebx, 0xf
mov rdx, r10
shr rdx, 4
mov ecx, r9d
and cl, 0x3c
shl rbx, cl
mov rcx, qword [rax + 8]
or qword [rcx + rdx*8], rbx
inc r10
mov rcx, qword [r14 + 8]
dec r8
add r9, 4
cmp r10, rcx
jb 0x14000966a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140009c29
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov r9, rcx
test r8, r8
je 0x140009c5a
lea rax, [r8 - 1]
movzx ecx, byte [r9 + rax]
xor rcx, 0x30
dec rcx
sar rcx, 0x3f
xor r8, rax
and r8, rcx
xor r8, rax
add rax, 0xffffffffffffffff
jb 0x140009c39
jmp 0x140009c5d
xor r8d, r8d
test rdx, rdx
je 0x140009cba
xor ecx, ecx
mov r10, r8
shr r10, cl
mov edi, 1
shl rdi, cl
cmp rdi, rdx
jae 0x140009cac
and r10b, 1
neg r10b
mov r11, rdx
sub r11, rdi
add rdi, r9
xor esi, esi
mov bl, byte [r9 + rsi]
mov bpl, byte [rdi + rsi]
mov eax, ebp
xor al, bl
and al, r10b
xor bl, al
mov byte [r9 + rsi], bl
xor al, bpl
mov byte [rdi + rsi], al
inc rsi
cmp r11, rsi
jne 0x140009c89
inc rcx
mov rax, rdx
shr rax, cl
test rax, rax
jne 0x140009c64
pop rbx
pop rbp
pop rdi
pop rsi
ret