joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400014c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400016cc
test al, 0x10
jne 0x1400016cc
mov rcx, rbp
call fcn.140013bd0
mov rdi, rax
xor esi, esi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], setsockopt
mov byte [rsp + 0x50], sil
test rax, rax
jne 0x140001547
mov qword [rsp + 0x60], rax
mov byte [rsp + rax + 0x50], sil
jmp 0x140001578
lea rcx, [rsp + 0x50]
cmp rdi, 0xf
ja 0x140001568
mov qword [rsp + 0x60], rdi
mov r8, rdi
xor edx, edx
call fcn.140026cc0
mov byte [rsp + rdi + 0x50], 0
jmp 0x140001578
mov byte [rsp + 0x20], 0
mov r9, rdi
mov rdx, rdi
call fcn.140001dd0
lea r14, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r14, qword [rsp + 0x50]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140001674
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x40]
mov rcx, rax
call fcn.1400013b0
test al, al
je 0x140001674
mov eax, dword [rsp + 0x40]
cmp qword [rsp + 0x60], rax
je 0x140001661
lea rdx, str.File_size_error
lea rcx, [0x140077e88]
call fcn.140004170
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], setsockopt
mov byte [rbx], 0
xor r8d, r8d
lea rdx, [0x14005e508]
mov rcx, rbx
call fcn.140001c10
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400016ef
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001657
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001717
call fcn.140023e64
jmp 0x1400016ef
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbx + 0x10], xmm1
jmp 0x1400016ef
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], setsockopt
mov byte [rbx], 0
xor r8d, r8d
lea rdx, [0x14005e508]
mov rcx, rbx
call fcn.140001c10
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400016ef
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001657
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000171d
jmp 0x140001657
xor esi, esi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], setsockopt
mov byte [rbx], sil
xor r8d, r8d
lea rdx, [0x14005e508]
mov rcx, rbx
call fcn.140001c10
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140023e40
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14002d7d0
int3
call fcn.14002d7d0
int3
Function at 0x140001730
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x4050
call fcn.140024c20
sub rsp, rax
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x4040], rax
mov r14, qword [rsp + 0x40a0]
lea rcx, [rsp + 0x40]
xor r15d, r15d
mov rbp, r8
mov rsi, rdx
mov dword [rsp + 0x30], r15d
xor edx, edx
mov dword [rsp + 0x34], r15d
mov r8d, 0x4000
mov edi, r9d
mov ebx, r9d
call fcn.140026cc0
nop
mov r8d, 0x4000
test edi, edi
je 0x1400017a1
cmp ebx, r8d
cmovb r8d, ebx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000181d
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x1400017fb
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140001814
mov r8d, dword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
cmp r8d, r9d
jne 0x1400017ff
test edi, edi
je 0x140001790
sub ebx, r8d
jne 0x140001790
mov al, 1
jmp 0x140001835
lea rdx, str.read__size__lu___write_size__lu_is_in_consist
lea rcx, [0x140077e88]
call fcn.140004170
jmp 0x140001833
lea r8, str.mergeFile_WriteFile_fail
jmp 0x140001824
lea r8, str.mergeFile_ReadFile_fail
mov rdx, r14
lea rcx, [0x140077e88]
call fcn.1400049f0
xor al, al
mov rcx, qword [rsp + 0x4040]
xor rcx, rsp
call fcn.140023e40
mov rbx, qword [rsp + 0x4080]
add rsp, 0x4050
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001860
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x48], rcx
cmp qword [rcx + 0x18], 0x10
jb 0x14000189f
mov rcx, qword [rcx]
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140001926
lea rdx, str.CreateFile_fail
lea rcx, [0x140077e88]
call fcn.140004ef0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000191f
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000191a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400019e8
mov rcx, r8
call fcn.140023e64
xor al, al
jmp 0x1400019bd
mov dword [rsp + 0x48], r12d
mov r14d, edi
mov esi, r12d
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x48]
mov r8d, edi
mov rdx, rbp
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140001976
mov eax, dword [rsp + 0x48]
sub edi, eax
add esi, eax
cmp esi, r14d
ja 0x140001971
add rbp, rax
test edi, edi
jne 0x140001940
mov dil, 1
jmp 0x140001979
xor dil, dil
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400019b9
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400019b4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400019ee
mov rcx, r8
call fcn.140023e64
movzx eax, dil
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], setsockopt
mov byte [rbx], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14002d7d0
int3
call fcn.14002d7d0
int3
Function at 0x140003e80
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push r15
sub rsp, 0xab8
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rbp, rcx
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x208
call fcn.140026cc0
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.140026cc0
xor edx, edx
lea rcx, [rsp + 0x470]
mov r8d, 0x208
call fcn.140026cc0
mov edx, 0x104
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rsp + 0x50]
call fcn.140013550
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x260]
lea rdx, str._s_s.log
lea rcx, [rsp + 0x470]
call fcn.140001d70
mov rax, qword [rbp + 8]
xor r15d, r15d
cmp rax, 0xffffffffffffffff
jne 0x140003f72
mov qword [rsp + 0x30], r15
lea r8d, [rax + 8]
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x470]
xor r9d, r9d
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 8], rax
cmp rax, 0xffffffffffffffff
je 0x14000408a
mov qword [rsp + 0xab0], rbx
lea rcx, [rsp + 0x680]
mov qword [rsp + 0xaa8], rsi
lea rbx, [rsp + 0xae0]
mov qword [rsp + 0xaa0], rdi
xor edx, edx
mov r8d, 0x400
mov qword [rsp + 0xa98], r14
call fcn.140026cc0
call fcn.1400012a0
mov r9, qword [rsp + 0xad8]
lea rdx, [rsp + 0x680]
mov qword [rsp + 0x28], rbx
mov r8d, 0x400
mov qword [rsp + 0x20], r15
mov rcx, qword [rax]
call fcn.14002d3d8
lea r8, [0x14005eb70]
mov edx, 0x400
lea rcx, [rsp + 0x680]
call fcn.14002f0e4
lea rax, [rsp + 0x680]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140004004
mov rbp, qword [rbp + 8]
lea rsi, [rsp + 0x680]
mov dword [rsp + 0x40], r15d
mov r14d, ebx
mov edi, r15d
nop dword [rax]
nop dword [rax + rax]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r15
mov r8d, ebx
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000406a
mov eax, dword [rsp + 0x40]
sub ebx, eax
add edi, eax
cmp edi, r14d
ja 0x140004061
add rsi, rax
test ebx, ebx
jne 0x140004030
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rdi, qword [rsp + 0xaa0]
mov rsi, qword [rsp + 0xaa8]
mov rbx, qword [rsp + 0xab0]
mov r14, qword [rsp + 0xa98]
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.140023e40
add rsp, 0xab8
pop r15
pop rbp
ret
Function at 0x1400040b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rcx
test r9, r9
jne 0x1400040ec
lea rcx, str.error_argument_is_null
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.1400012a0
mov qword [rsp + 0x28], rbx
mov r9, rdi
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
mov rcx, qword [rax]
or rcx, 2
call fcn.14002d3d0
test eax, eax
mov ecx, 0xffffffff
cmovs eax, ecx
inc eax
cmp eax, 0x800
jb 0x140004145
lea rcx, str.error_argument_is_too_big
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r9, rbx
mov r8, rdi
mov edx, 0x800
mov rcx, rsi
call fcn.140002250
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140004170
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
mov eax, 0x1048
call fcn.140024c20
sub rsp, rax
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov eax, dword [rcx + 0x14]
mov rdi, rdx
mov rbx, rcx
test eax, eax
je 0x140004298
cmp eax, 2
jl 0x1400041c0
cmp qword [rcx], 0xffffffffffffffff
je 0x140004298
mov qword [rsp + 0x1040], rsi
lea rcx, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x20], 0
mov r8d, 0x800
lea rsi, [rsp + 0x1070]
call fcn.140026cc0
mov r9, rsi
lea rcx, [rsp + 0x30]
mov r8, rdi
call fcn.1400040b0
mov rsi, qword [rsp + 0x1040]
test al, al
je 0x140004298
mov ecx, dword [rbx + 0x14]
sub ecx, 1
je 0x14000421d
sub ecx, 1
je 0x14000425f
cmp ecx, 1
jne 0x140004298
xor edx, edx
lea rcx, [rsp + 0x830]
mov r8d, 0x800
call fcn.140026cc0
lea r8, [rsp + 0x30]
lea rdx, str._s_r_n
lea rcx, [rsp + 0x830]
call fcn.140005500
lea rcx, [rsp + 0x830]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [rbx + 0x14], 3
jne 0x140004298
lea r8, [0x14005eb70]
mov edx, 0x800
lea rcx, [rsp + 0x30]
call fcn.14002f0e4
lea rax, [rsp + 0x30]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], 0
jne 0x140004281
mov rdx, qword [rbx]
lea r8, [rsp + 0x30]
call fcn.1400044a0
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x1048
pop rdi
pop rbx
ret
Function at 0x1400042c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rdi
lea rbp, [rsp - 0xfa0]
mov eax, 0x10a0
call fcn.140024c20
sub rsp, rax
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rbp + 0xf80], rax
mov eax, dword [rcx + 0x14]
mov rdi, rdx
mov rbx, rcx
test eax, eax
je 0x140004477
cmp eax, 2
jl 0x140004318
cmp qword [rcx], 0xffffffffffffffff
je 0x140004477
mov qword [rsp + 0x1098], rsi
lea rcx, [rbp + 0x780]
xor edx, edx
mov qword [rsp + 0x50], 0
mov r8d, 0x800
lea rsi, [rbp + 0xfd0]
call fcn.140026cc0
mov r9, rsi
lea rcx, [rbp + 0x780]
mov r8, rdi
call fcn.1400040b0
mov rsi, qword [rsp + 0x1098]
test al, al
je 0x140004477
lea rcx, [rsp + 0x50]
call fcn.14002e648
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.14002e24c
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x800
call fcn.140026cc0
mov ecx, dword [rbx + 0x14]
sub ecx, 1
je 0x1400043a6
sub ecx, 1
je 0x140004406
cmp ecx, 1
jne 0x140004477
mov r9d, dword [rsp + 0x68]
lea rax, [rbp + 0x780]
mov r8d, dword [rsp + 0x6c]
lea rdx, str._04d__02d__02d__02d:_02d:_02d__s_r_n
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x80]
mov eax, dword [rsp + 0x58]
inc r9d
mov dword [rsp + 0x38], eax
add r8d, 0x76c
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x20], eax
call fcn.140005500
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [rbx + 0x14], 3
jne 0x140004477
mov r9d, dword [rsp + 0x68]
lea rax, [rbp + 0x780]
mov r8d, dword [rsp + 0x6c]
lea rdx, str._04d__02d__02d__02d:_02d:_02d___s_r_n
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x80]
mov eax, dword [rsp + 0x58]
inc r9d
mov dword [rsp + 0x38], eax
add r8d, 0x76c
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x20], eax
call fcn.140005500
lea rax, [rbp - 0x80]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], 0
jne 0x140004461
mov rdx, qword [rbx]
lea r8, [rbp - 0x80]
call fcn.1400044a0
mov rcx, qword [rbp + 0xf80]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x10a0
pop rdi
pop rbx
pop rbp
ret

Function at 0x1400044a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r15d, r15d
mov ebx, r9d
mov dword [rsp + 0x30], r15d
mov edi, r15d
mov rsi, r8
mov r14, rdx
mov ebp, r9d
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
mov r8d, ebx
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140004519
mov eax, dword [rsp + 0x30]
sub ebx, eax
add edi, eax
cmp edi, ebp
ja 0x140004510
add rsi, rax
test ebx, ebx
jne 0x1400044e0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140023e40
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004540
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rcx
test r9, r9
jne 0x14000457c
lea rcx, str.error_argument_is_null
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], r14
call fcn.1400012a0
mov qword [rsp + 0x28], rbx
mov r9, rdi
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
mov r14, rax
mov rcx, qword [rax]
or rcx, 2
call fcn.14002d43c
test eax, eax
mov ecx, 0xffffffff
cmovs eax, ecx
inc eax
cmp eax, 0x800
jb 0x1400045cf
lea rcx, str.error_argument_is_too_big
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
jmp 0x1400045f3
mov rcx, qword [r14]
mov r9, rdi
mov qword [rsp + 0x28], rbx
mov r8d, 0x800
mov rdx, rsi
mov qword [rsp + 0x20], 0
call fcn.14002d444
mov al, 1
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140004610
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
mov eax, 0x2068
call fcn.140024c20
sub rsp, rax
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov eax, dword [rcx + 0x14]
mov rbx, rdx
mov rsi, rcx
test eax, eax
je 0x140004795
cmp eax, 2
jl 0x140004660
cmp qword [rcx], 0xffffffffffffffff
je 0x140004795
mov qword [rsp + 0x2058], rdi
lea rcx, [rsp + 0x40]
xor edx, edx
lea rdi, [rsp + 0x2090]
mov r8d, 0x1000
call fcn.140026cc0
mov r9, rdi
lea rcx, [rsp + 0x40]
mov r8, rbx
call fcn.140004540
test al, al
je 0x14000478d
mov ecx, dword [rsi + 0x14]
sub ecx, 1
je 0x1400046b0
sub ecx, 1
je 0x1400046f6
cmp ecx, 1
jne 0x14000478d
xor edx, edx
lea rcx, [rsp + 0x1040]
mov r8d, 0x1000
call fcn.140026cc0
lea r8, [rsp + 0x40]
lea rdx, str._s__r_n
lea rcx, [rsp + 0x1040]
call fcn.140005560
lea rcx, [rsp + 0x1040]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rsi + 0x14], 3
jne 0x14000478d
lea r8, [0x14005ec14]
mov qword [rsp + 0x2060], rbp
mov edx, 0x800
lea rcx, [rsp + 0x40]
call fcn.14002d51c
xor ebp, ebp
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x30], rbp
xor ecx, ecx
mov dword [rsp + 0x28], ebp
lea r9d, [rbp - 1]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov ebx, eax
call fcn.140024144
mov qword [rsp + 0x38], rbp
lea r9d, [rbp - 1]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rsi]
lea r9d, [rbx - 1]
mov r8, rdi
call fcn.1400044a0
mov rcx, rdi
call fcn.140023e64
mov rbp, qword [rsp + 0x2060]
mov rdi, qword [rsp + 0x2058]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140023e40
add rsp, 0x2068
pop rsi
pop rbx
ret
Function at 0x140004880
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, r8
mov qword [rsp + 0x40], 0
mov edi, edx
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
mov rbp, r9
call fcn.140026cc0
test ebx, ebx
jne 0x1400048d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0
mov r9d, 0x400
mov r8d, edi
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1100
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
jne 0x140004929
mov r9d, edi
lea r8, str.__SYSTEM_ERROR:_lu_
mov edx, 0x104
mov rcx, rsi
call fcn.1400012b0
jmp 0x1400049c1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
lea ecx, [rax + 0x14]
cmp ecx, ebp
jl 0x14000495f
lea rcx, str.getErrorCodeMsg_buffer_size_is_to_small
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov r9d, edi
lea r8, str.__SYSTEM_ERROR:_lu_
mov edx, 0x104
mov rcx, rsi
call fcn.1400012b0
jmp 0x1400049b6
mov rdx, qword [rsp + 0x40]
lea r9d, [rax - 2]
movsxd rax, r9d
cmp word [rdx + rax*2], 0xd
jne 0x14000499a
lea eax, [r8 - 1]
movsxd rcx, eax
cmp word [rdx + rcx*2], 0xa
jne 0x14000499a
mov r8d, r9d
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
jmp 0x14000499f
mov qword [rsp + 0x20], rdx
mov r9d, edi
lea r8, str.__SYSTEM_ERROR:_lu__s_
mov edx, 0x104
mov rcx, rsi
call fcn.1400012b0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140023e40
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400049f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
sub rsp, 0xc88
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0xc60], rax
mov eax, dword [rcx + 0x14]
mov rbx, rdx
mov rsi, rcx
test eax, eax
je 0x140004bfb
cmp eax, 2
jl 0x140004a35
cmp qword [rcx], 0xffffffffffffffff
je 0x140004bfb
mov qword [rsp + 0xc80], rbp
lea rcx, [rsp + 0x250]
xor edx, edx
mov qword [rsp + 0xc78], rdi
mov r8d, 0x208
call fcn.140026cc0
mov r9d, 0x104
lea r8, [rsp + 0x250]
xor edx, edx
xor ecx, ecx
call fcn.140004880
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
lea rbp, [rsp + 0xcb8]
mov edi, eax
call fcn.140026cc0
mov r8, qword [rsp + 0xcb0]
lea rcx, [rsp + 0x40]
mov r9, rbp
call fcn.140004540
test al, al
je 0x140004beb
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, edi
cmp eax, 0x104
jl 0x140004ade
lea rcx, str.buffer_is_too_small
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x140004beb
lea r8, [rsp + 0x250]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14002d51c
test rbx, rbx
je 0x140004b08
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [rsi + 0x14]
sub ecx, 1
je 0x140004b1e
sub ecx, 1
je 0x140004b64
cmp ecx, 1
jne 0x140004beb
xor edx, edx
lea rcx, [rsp + 0x460]
mov r8d, 0x800
call fcn.140026cc0
lea r8, [rsp + 0x40]
lea rdx, str._s__r
lea rcx, [rsp + 0x460]
call fcn.140002430
lea rcx, [rsp + 0x460]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rsi + 0x14], 3
jne 0x140004beb
lea r8, [0x14005ec14]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14002d51c
xor ebp, ebp
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x30], rbp
xor ecx, ecx
mov dword [rsp + 0x28], ebp
lea r9d, [rbp - 1]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, eax
mov ebx, eax
call fcn.140024144
mov qword [rsp + 0x38], rbp
lea r9d, [rbp - 1]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rsi]
lea r9d, [rbx - 1]
mov r8, rdi
call fcn.1400044a0
mov rcx, rdi
call fcn.140023e64
mov rbp, qword [rsp + 0xc80]
mov rdi, qword [rsp + 0xc78]
mov rcx, qword [rsp + 0xc60]
xor rcx, rsp
call fcn.140023e40
add rsp, 0xc88
pop rsi
pop rbx
ret
Function at 0x140004c20
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x830
mov rax, qword [0x140073080]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rbx, qword [rsp + 0x870]
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x800
call fcn.140026cc0
mov r9, rbx
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.1400040b0
test al, al
je 0x140004c97
lea rcx, [rsp + 0x20]
call fcn.140013860
mov rdi, rax
test rax, rax
jne 0x140004c9b
lea rcx, str.dump_output_msg_AnsiToUnicode_fail
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
jmp 0x140004cf8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add ebx, eax
cmp ebx, 0x400
jl 0x140004cd2
lea rcx, str.dump_output_msg_buffer_is_too_small
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rdi
call fcn.140023e64
xor al, al
jmp 0x140004cf8
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rdi
call fcn.140023e64
mov r8, rsi
mov edx, 0x400
mov rcx, rbp
call fcn.14002d51c
mov al, 1
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140023e40
mov rbx, qword [rsp + 0x868]
add rsp, 0x830
pop rdi
pop rsi
pop rbp
ret