joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ed210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa8
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rdi, [rcx + 8]
mov qword [r11 - 0x50], 0xf
mov r14, r8
mov qword [r11 - 0x58], 0
mov rsi, rdx
mov byte [rsp + 0x70], 0
mov rbp, rcx
lea rdx, [r11 - 0x68]
or rbx, 0xffffffffffffffff
mov rcx, rdi
mov r8, rbx
mov r15, r9
call fcn.14004bf90
test al, al
jne 0x1400ed380
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x20]
cmp ecx, 1
jbe 0x1400ed2b3
cmp eax, 5
jne 0x1400ed28e
mov ecx, 0x3e8
jmp 0x1400ed2b8
cmp qword [rdi + 0x18], 8
jb 0x1400ed298
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, 0x3e9
mov edx, 0x3eb
cmp eax, 0xffffffff
cmove ecx, edx
jmp 0x1400ed2b8
mov ecx, 0x3ea
test r14, r14
je 0x1400ed2c0
mov dword [r14], ecx
test r15, r15
je 0x1400ed321
test ecx, ecx
je 0x1400ed30d
sub ecx, 0x3e8
je 0x1400ed2fb
sub ecx, 1
je 0x1400ed2f2
sub ecx, 1
je 0x1400ed2e9
cmp ecx, 1
jne 0x1400ed30d
lea rdx, str.File_doesnt_exist.
jmp 0x1400ed302
lea rdx, str.File_locked.
jmp 0x1400ed302
lea rdx, str.Cant_read_file.
jmp 0x1400ed302
lea rdx, str.Access_denied.
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400ed302
jmp 0x1400ed316
lea rdx, [0x14014a2ed]
xor ebx, ebx
mov r8, rbx
mov rcx, r15
call fcn.14002a1a4
mov rax, qword [rsp + 0x88]
mov qword [rsi], 0
cmp rax, 0x10
jb 0x1400ed421
mov rcx, qword [rsp + 0x70]
inc rax
cmp rax, 0x1000
jb 0x1400ed41c
test cl, 0x1f
jne 0x1400ed444
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400ed44a
sub rcx, rax
cmp rcx, 8
jb 0x1400ed450
cmp rcx, 0x27
jbe 0x1400ed419
jmp 0x1400ed456
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
lea rdx, [rsp + 0x58]
mov r8d, dword [rbp + 0x28]
mov r9, r14
cmovae rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [0x1401629f0]
mov qword [rsp + 0x48], rcx
movups xmm0, xmmword [rsp + 0x40]
mov qword [rbp + 0x30], rcx
mov rcx, rsi
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], r8d
mov qword [rsp + 0x20], r15
call fcn.14008d2c0
mov rax, qword [rsp + 0x88]
cmp rax, 0x10
jb 0x1400ed421
mov rcx, qword [rsp + 0x70]
inc rax
cmp rax, 0x1000
jb 0x1400ed41c
test cl, 0x1f
jne 0x1400ed45c
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400ed462
sub rcx, rax
cmp rcx, 8
jb 0x1400ed468
cmp rcx, 0x27
ja 0x1400ed46e
mov rcx, rax
call fcn.140111e78
mov rax, rsi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140111850
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
Function at 0x1400f8ecc
Capabilities:
Check os version
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov dil, dl
mov rbx, rcx
test dl, dl
je 0x1400f8f1e
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x1400f8f1e
xor eax, eax
lea rsi, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rax
lea rax, [0x14015e2e0]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0x18
mov dword [rsp + 0x50], 1
cmp qword [rbx + 0x18], 8
jb 0x1400f8f28
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rsi
mov eax, 0x200
neg dil
mov r9d, 2
mov rcx, rbx
sbb edx, edx
and dword [rsp + 0x30], 0
and edx, 0x80000
mov dword [rsp + 0x28], eax
add edx, 3
mov dword [rsp + 0x20], eax
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400f9edc
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword gs:[0x58]
xor ebx, ebx
mov dword [rbp + 0x90], ebx
mov rdi, rcx
mov qword [rcx + 8], rdx
mov rsi, rdx
mov ecx, 0x18
mov r8, qword [rax]
mov eax, dword [rcx + r8]
cmp dword [0x14017c650], eax
jg 0x1400fa121
mov rax, qword [0x14017c638]
mov r12d, 2
test rax, rax
jne 0x1400f9f45
xor al, al
jmp 0x1400f9fb4
lea rdx, [rbp + 0x90]
mov rcx, rsi
call rax
test eax, eax
jne 0x1400f9fab
cmp dword [0x14017c080], r12d
jg 0x1400f9f97
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, r12d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r8d, 0x4b
call fcn.140068d00
lea rdx, [0x140150f10]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov ebx, 8
test bl, 8
je 0x1400f9f41
and ebx, 0xfffffff7
lea rcx, [rsp + 0x60]
call fcn.140068d80
jmp 0x1400f9f41
cmp dword [rbp + 0x90], ebx
setne al
mov byte [rdi + 0x89], al
test al, al
je 0x1400f9fc7
mov byte [rdi + 0x88], 0
jmp 0x1400f9fe1
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rsp + 0x30], 9
sete al
mov byte [rdi + 0x88], al
mov dl, byte [rdi + 0x89]
lea rax, [rdi + 0x38]
lea r14, [rdi + 0x30]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, rdi
mov rcx, rsi
call fcn.1400faf6c
test al, al
jne 0x1400fa052
cmp dword [0x14017c080], r12d
jg 0x1400fa03c
mov r9d, r12d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
mov r8d, 0x22d
lea rcx, [rsp + 0x60]
or ebx, 1
call fcn.1400681c0
lea rdx, str.GetProcessBasicInformation_failed
lea rcx, [rax + 8]
call fcn.14002bcb4
test bl, 1
je 0x1400fa04b
lea rcx, [rsp + 0x60]
call fcn.140068220
xor al, al
jmp 0x1400fa104
cmp byte [rdi + 0x88], 0
mov r8, rdi
mov rdx, qword [r14]
mov rcx, rsi
je 0x1400fa06b
call fcn.1400fb184
jmp 0x1400fa070
call fcn.1400fb32c
test al, al
jne 0x1400fa0af
cmp dword [0x14017c080], r12d
jg 0x1400fa0aa
mov r9d, r12d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
mov r8d, 0x236
lea rcx, [rsp + 0x60]
or ebx, r12d
call fcn.1400681c0
lea rdx, str.ReadProcessData_failed
lea rcx, [rax + 8]
call fcn.14002bcb4
test r12b, bl
jmp 0x1400fa03f
mov dl, byte [rdi + 0x88]
mov r8, rdi
mov rcx, rsi
call fcn.1400f9698
test al, al
jne 0x1400fa102
cmp dword [0x14017c080], r12d
jg 0x1400fa0fa
mov r9d, r12d
lea rdx, str..._.._third_party_crashpad_crashpad_util_win_process_info.cc
mov r8d, 0x23b
lea rcx, [rsp + 0x60]
or ebx, 4
call fcn.1400681c0
lea rdx, str.ReadMemoryInfo_failed
lea rcx, [rax + 8]
call fcn.14002bcb4
test bl, 4
jmp 0x1400fa03f
mov al, 1
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rbp
ret
lea rcx, [0x14017c650]
call fcn.140111a38
cmp dword [0x14017c650], 0xffffffff
jne 0x1400f9f2f
lea rdx, str.::IsWow64Process
lea rcx, str.kernel32.dll
call fcn.1400b64b4
lea rcx, [0x14017c650]
mov qword [0x14017c638], rax
call fcn.1401119d8
jmp 0x1400f9f2f
Function at 0x1400fc850
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140175e00]
mov rdi, r8
cmp rax, r8
mov rsi, rdx
mov rbx, rcx
cmovb edi, eax
jmp 0x1400fc899
mov eax, dword [rsp + 0x50]
cmp eax, 0xffffffff
jne 0x1400fc881
int3
test eax, eax
jne 0x1400fc8bf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x1400fc8cf
mov rdx, rsi
mov rcx, rbx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400fc877
call qword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x6d
neg eax
sbb rax, rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x50]
jmp 0x1400fc8bf

Function at 0x1400fd28c
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x140
xor ebx, ebx
lea rdx, [rax + 0x10]
mov dword [rsp + 0x158], ebx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1400fd306
cmp dword [0x14017c080], 2
jg 0x1400fd2f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9d, [rbx + 2]
mov r8d, 0x102
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_file_io_win.cc
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.140068d00
lea rdx, [0x14015f270]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov ebx, 1
test bl, 1
je 0x1400fd300
lea rcx, [rsp + 0x30]
call fcn.140068d80
or rbx, 0xffffffffffffffff
jmp 0x1400fd30e
mov rbx, qword [rsp + 0x158]
mov rax, qword [0x14017c430]
test rax, rax
jne 0x1400fd339
xor edx, edx
lea r9d, [rax + 0x32]
mov r8d, 0x1400000
lea rcx, str.Crashpad.CrashReportSize
call fcn.140051900
mov qword [0x14017c430], rax
mov r8, qword [rax]
mov edx, ebx
mov rcx, rax
add rsp, 0x140
pop rbx
jmp qword [r8 + 0x20]
Function at 0x140103a3c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
xor edi, edi
lea r8, [0x140103b40]
mov rbx, rcx
mov qword [rsp + 0x28], rdi
mov r9, rcx
mov dword [rsp + 0x20], edi
xor edx, edx
mov dword [rsp + 0x150], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x140103aa3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9d, [rdi + 3]
mov dword [rsp + 0x20], eax
lea r8d, [rdi + 0x19]
lea rdx, str..._.._third_party_crashpad_crashpad_util_thread_thread_win.cc
lea rcx, [rsp + 0x30]
call fcn.140068d00
mov edi, 1
test dil, 1
je 0x140103ab3
lea rcx, [rsp + 0x30]
call fcn.140068d80
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret
Function at 0x14010d5a0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
xor edi, edi
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x178], edi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x40]
mov ebx, 0xff
cmp edx, ebx
seta al
test al, al
je 0x14010d624
lea ecx, [rdi + 1]
call fcn.140067fc0
test al, al
je 0x14010d610
mov r9d, ecx
lea r8d, [rbx - 0x5e]
lea rcx, [rsp + 0x50]
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
call fcn.1400681c0
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
lea rcx, [rax + 8]
call fcn.14002bcb4
mov edx, dword [rsp + 0x40]
mov edi, 1
test dil, 1
je 0x14010d624
lea rcx, [rsp + 0x50]
call fcn.140068220
mov edx, dword [rsp + 0x40]
cmp edx, ebx
seta cl
test cl, cl
movzx ecx, dl
cmove ebx, ecx
mov al, bl
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x14010f2e0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlInitUnicodeString
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreateKey
mov rcx, rdi
mov qword [0x140176400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtDeleteKey
mov rcx, rdi
mov qword [0x140176408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenKeyEx
mov rcx, rdi
mov qword [0x140176410], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtClose
mov rcx, rdi
mov qword [0x140176418], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryValueKey
mov rcx, rdi
mov qword [0x140176420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSetValueKey
mov rcx, rdi
mov qword [0x140176428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov qword [0x140176430], rax
cmp qword [0x140176400], rbx
je 0x14010f50c
cmp qword [0x140176408], rbx
je 0x14010f50c
cmp qword [0x140176418], rbx
je 0x14010f50c
cmp qword [0x140176410], rbx
je 0x14010f50c
cmp qword [0x140176420], rbx
je 0x14010f50c
cmp qword [0x140176428], rbx
je 0x14010f50c
test rax, rax
je 0x14010f50c
lea rdx, str.RtlFormatCurrentUserKeyPath
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlFreeUnicodeString
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rsi, rsi
je 0x14010f50c
test rax, rax
je 0x14010f50c
lea rcx, [rsp + 0x20]
call rsi
test eax, eax
js 0x14010f50c
mov rdx, qword [rsp + 0x28]
lea rsi, [0x140176440]
mov ebp, 0xff
mov rcx, rsi
mov r8d, ebp
call fcn.140120600
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bx
jne 0x14010f465
mov r8, rbp
lea rdx, [0x14014ba54]
sub r8, rax
mov rcx, rsi
call fcn.140120600
mov rcx, qword [rsp + 0x28]
mov edx, 0x5c
call fcn.140113340
mov r8, rbp
lea rcx, [0x140176640]
lea rdx, [rax + 2]
call fcn.140120680
lea rcx, [rsp + 0x20]
call rdi
call fcn.14010f530
lea rcx, str.kernel32.dll
mov byte [0x140176439], al
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x140150f10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14010f4fb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x40]
call rdi
test eax, eax
je 0x14010f4fb
cmp dword [rsp + 0x40], ebx
setne bl
mov byte [0x14017643a], bl
mov al, 1
mov byte [0x140176438], 1
jmp 0x14010f50e
xor al, al
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14010f530
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.140113400
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, str.PROGRAMFILES
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14010f5a1
mov r8d, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140120650
test eax, eax
jne 0x14010f5a1
mov al, 1
jmp 0x14010f5da
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, str.PROGRAMFILES_X86_
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14010f5d8
mov r8d, eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140120650
test eax, eax
je 0x14010f59d
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140111850
add rsp, 0x240
pop rbx
ret
Function at 0x14010f7b0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor ebx, ebx
mov rdi, r8
mov esi, edx
mov ebp, ecx
cmp qword [r8 + 0x10], rbx
je 0x14010f97e
mov ecx, 0x300
mov eax, edx
and eax, ecx
cmp eax, ecx
je 0x14010f97e
movzx eax, word [0x140176840]
cmp ebp, 2
cmove ax, word [0x140176a40]
test ax, ax
jne 0x14010f97e
xor edx, edx
lea r8d, [rbx + 0x30]
lea rcx, [rsp + 0x28]
call fcn.140113400
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x28], bx
je 0x14010f97e
movzx eax, byte [0x14017643a]
lea edx, [rbx + 1]
bt esi, 9
mov ecx, ebx
cmovb eax, edx
bt esi, 8
cmovae ecx, eax
test cl, cl
je 0x14010f97e
cmp ebp, 2
mov qword [rsp + 0xb8], rdx
lea rax, str.SOFTWAREClasses
lea r14, str.SOFTWARE
cmove r14, rax
cmp qword [rdi + 0x18], 8
jb 0x14010f874
mov rsi, qword [rdi]
jmp 0x14010f877
mov rsi, rdi
mov r13, qword [rdi + 0x10]
mov ecx, ebx
mov dword [rsp + 0xb0], ebx
mov rbp, rbx
mov r15, rbx
mov r12, rbx
mov rax, qword [r14 + 8]
mov qword [rsp + 0x20], rax
cmp r13, rax
jb 0x14010f92d
mov rdx, qword [r14]
mov r8, rax
mov rcx, rsi
call fcn.140128720
test eax, eax
jne 0x14010f91e
mov rax, qword [rsp + 0x20]
lea rdx, [rsi + rax*2]
cmp word [rdx], 0x5c
je 0x14010f8c5
cmp word [rdx], bx
jne 0x14010f91e
mov ecx, dword [r14 + 0x10]
mov dword [rsp + 0xb0], ecx
cmp ecx, 1
jne 0x14010f8e1
mov rbp, rsi
lea r15, str.WOW6432Node_
jmp 0x14010f8f0
cmp ecx, 2
jne 0x14010f8f0
mov rbp, rdx
lea r15, str.WOW6432Node
sub r13, rax
mov rsi, rdx
cmp word [rdx], 0x5c
jne 0x14010f909
add rsi, 2
dec r13
cmp word [rsi], 0x5c
je 0x14010f8fc
mov rdx, qword [r14 + 0x20]
mov r12, rbx
mov r14, qword [r14 + 0x18]
mov qword [rsp + 0xb8], rdx
jmp 0x14010f934
mov rdx, qword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
add r14, 0x28
inc r12
cmp r12, rdx
jb 0x14010f88d
test ecx, ecx
je 0x14010f97e
cmp qword [rdi + 0x18], 8
jb 0x14010f94d
mov rcx, qword [rdi]
jmp 0x14010f950
mov rcx, rdi
cmp word [r15], bx
je 0x14010f967
or rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], bx
jne 0x14010f95a
mov rbx, rax
sub rbp, rcx
mov r9, rbx
sar rbp, 1
mov r8, r15
mov rdx, rbp
mov rcx, rdi
call fcn.140030e50
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14011c5c4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140112490
sub rsp, rax
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r14, rdx
mov rbx, rcx
call fcn.14011cee0
xor esi, esi
movsxd r12, eax
cmp dword [rbx + 0x10], esi
jne 0x14011c618
mov rax, r14
jmp 0x14011c732
mov rax, qword [rbx]
mov rdi, r12
sub rax, qword [rbx + 8]
xor r8d, r8d
cqo
sar rdi, 6
sub rax, rdx
mov rbx, r12
sar rax, 1
and ebx, 0x3f
mov r15, rax
shl rbx, 6
lea rax, [0x140000000]
mov ecx, r12d
mov rdx, qword [rax + rdi*8 + 0x177fc0]
mov rbp, r12
mov rdx, qword [rbx + rdx + 0x30]
call fcn.14012be10
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rdi*8 + 0x177fc0]
cmp r13, qword [rbx + rcx + 0x30]
je 0x14011c67f
or rax, 0xffffffffffffffff
jmp 0x14011c732
mov rcx, rbp
mov qword [rsp + 0x20], rsi
sar rcx, 6
lea r9, [rsp + 0x30]
and ebp, 0x3f
lea rdx, [rsp + 0x40]
shl rbp, 6
mov r8d, 0x1000
mov rcx, qword [rax + rcx*8 + 0x177fc0]
mov rcx, qword [rcx + rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14011c676
xor r8d, r8d
mov rdx, r14
mov ecx, r12d
call fcn.14012be10
test rax, rax
js 0x14011c676
mov eax, dword [rsp + 0x30]
cmp r15, rax
jg 0x14011c676
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test r15, r15
je 0x14011c726
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14011c726
cmp byte [rcx], 0xd
jne 0x14011c70c
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14011c71b
cmp byte [rcx + 1], 0xa
jne 0x14011c71b
inc rcx
jmp 0x14011c71b
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x1752f0]
add rcx, rax
inc rsi
inc rcx
cmp rsi, r15
jne 0x14011c6ee
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14011e040
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14011decb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14011decb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14011decb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14011decb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14011decb
cmp dword [rcx + 0x84], 0xe
jbe 0x14011decb
cmp dword [rcx + 0xf8], 0
je 0x14011decb
mov ecx, ebx
call fcn.14011df6c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14011dd48
cmp dword [rbp + 0x20], 0
je 0x14011df18
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14011df20
int3
xor r8d, r8d
xor edx, edx
jmp 0x14011de64
Function at 0x140127a34
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r10, [0x140177fc0]
mov r14, rdx
mov rax, r15
sar rax, 6
mov rdx, r15
and edx, 0x3f
mov rdi, r15
shl rdx, 6
mov r9, qword [r10 + rax*8]
mov r12, qword [r9 + rdx + 0x28]
test r8, r8
je 0x140127a99
cmp byte [r14], 0xa
jne 0x140127a99
mov rcx, r15
mov rax, r15
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
or byte [rax + rcx + 0x38], 4
jmp 0x140127aba
mov dl, byte [r9 + rdx + 0x38]
mov rcx, rdi
and dl, 0xfb
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x38], dl
lea rbp, [r14 + r8]
mov rsi, r14
mov rbx, r14
cmp r14, rbp
jae 0x140127c14
mov r13d, 1
mov al, byte [rsi]
cmp al, 0x1a
je 0x140127bd4
cmp al, 0xd
je 0x140127aee
mov byte [rbx], al
add rbx, r13
add rsi, r13
jmp 0x140127bc9
lea rax, [rsi + 1]
cmp rax, rbp
jae 0x140127b14
cmp byte [rax], 0xa
jne 0x140127b06
mov byte [rbx], 0xa
mov eax, 2
jmp 0x140127b0c
mov byte [rbx], ntohl
mov rax, r13
add rsi, rax
jmp 0x140127bc6
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, r13d
lea rdx, [rsp + 0x70]
mov rcx, r12
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140127bbc
cmp dword [rsp + 0x78], 0
je 0x140127bbc
mov rcx, rdi
lea r10, [0x140177fc0]
and ecx, 0x3f
mov rax, rdi
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
test byte [rax + rcx + 0x38], 0x48
je 0x140127b8c
mov dl, byte [rsp + 0x70]
cmp dl, 0xa
je 0x140127b98
mov rcx, rdi
mov byte [rbx], ntohl
mov rax, rdi
and ecx, 0x3f
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x3a], dl
jmp 0x140127bc6
cmp byte [rsp + 0x70], 0xa
jne 0x140127b9d
cmp rbx, r14
jne 0x140127b9d
mov byte [rbx], 0xa
jmp 0x140127bc6
mov r8d, r13d
or rdx, 0xffffffffffffffff
mov ecx, r15d
call fcn.14012be18
cmp byte [rsp + 0x70], 0xa
lea r10, [0x140177fc0]
je 0x140127bc9
jmp 0x140127bc3
lea r10, [0x140177fc0]
mov byte [rbx], ntohl
add rbx, r13
cmp rsi, rbp
jb 0x140127ad3
jmp 0x140127c14
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov dl, byte [rax + rcx + 0x38]
test dl, 0x40
jne 0x140127c0d
mov rax, rdi
or dl, 2
sar rax, 6
and edi, 0x3f
shl rdi, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rdi + 0x38], dl
jmp 0x140127c14
mov cl, byte [rsi]
mov byte [rbx], cl
add rbx, r13
sub rbx, r14
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret