joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400087f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
lea rcx, [0x140007470]
call fcn.140036fc0
call fcn.140037c5c
add rsp, 0x28
jmp 0x140008980
push rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rax, qword [0x140366a58]
xor rax, rsp
mov qword [rbp + 0x970], rax
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMySQL
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140008afc
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov qword [rsp + 0xa90], rbx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov qword [rsp + 0xa98], rdi
xor edi, edi
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
mov ebx, edi
mov dword [rsp + 0x44], 0xff
mov dword [rsp + 0x40], 0x3ff
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x140008ae1
nop dword [rax]
inc ebx
cmp eax, 0xea
je 0x140008a8d
test eax, eax
jne 0x140008ae1
cmp dword [rsp + 0x48], 1
jne 0x140008a8d
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rdi
lea r8, [0x14004ec08]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x460]
call fcn.140017190
lea rcx, [rbp + 0x460]
call fcn.14003dad0
mov rcx, rax
call fcn.14003de94
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov dword [rsp + 0x44], 0xff
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], 0x3ff
mov qword [rsp + 0x28], rax
mov edx, ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x140008a40
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0xa98]
mov rbx, qword [rsp + 0xa90]
mov rcx, qword [rbp + 0x970]
xor rcx, rsp
call fcn.140031980
add rsp, 0xa80
pop rbp
ret

Function at 0x1400088d0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x140366a58]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
call fcn.140008810
test al, al
je 0x140008957
mov qword [rsp + 0x1d0], rbx
lea rdx, [rsp + 0x20]
mov ebx, 0x202
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140008917
cmp word [rsp + 0x20], bx
je 0x14000892e
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, ebx
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140008935
mov byte [0x140b68bd0], 1
mov rbx, qword [rsp + 0x1d0]
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140031980
add rsp, 0x1d8
ret
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140031980
add rsp, 0x1d8
ret
Function at 0x140008980
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x28
lea rcx, [0x140007470]
call fcn.140036fc0
call fcn.140037c5c
add rsp, 0x28
jmp 0x140008980
push rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rax, qword [0x140366a58]
xor rax, rsp
mov qword [rbp + 0x970], rax
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMySQL
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140008afc
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov qword [rsp + 0xa90], rbx
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov qword [rsp + 0xa98], rdi
xor edi, edi
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
mov ebx, edi
mov dword [rsp + 0x44], 0xff
mov dword [rsp + 0x40], 0x3ff
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x140008ae1
nop dword [rax]
inc ebx
cmp eax, 0xea
je 0x140008a8d
test eax, eax
jne 0x140008ae1
cmp dword [rsp + 0x48], 1
jne 0x140008a8d
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rdi
lea r8, [0x14004ec08]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x460]
call fcn.140017190
lea rcx, [rbp + 0x460]
call fcn.14003dad0
mov rcx, rax
call fcn.14003de94
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov dword [rsp + 0x44], 0xff
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], 0x3ff
mov qword [rsp + 0x28], rax
mov edx, ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x140008a40
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0xa98]
mov rbx, qword [rsp + 0xa90]
mov rcx, qword [rbp + 0x970]
xor rcx, rsp
call fcn.140031980
add rsp, 0xa80
pop rbp
ret
Function at 0x140008ec0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x140366a58]
xor rax, rsp
mov qword [rsp + 0x220], rax
xor ebp, ebp
mov rsi, rcx
mov edi, ebp
lea edx, [rbp + 0x40]
call fcn.140010810
mov rbx, rax
test rax, rax
je 0x140009003
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rax], xmm0
mov edx, 0x200
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
call fcn.1400090d0
test rax, rax
je 0x140008f3c
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140008b20
mov edi, eax
mov edx, 0x200
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140008f62
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140008b20
add edi, eax
mov r8, rbx
lea rdx, [0x14004f2c4]
mov rcx, rsi
call fcn.140008b20
mov edx, 0x200
lea rcx, [rsp + 0x20]
add edi, eax
call fcn.140009050
test rax, rax
je 0x140008fc5
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140008b20
mov r8d, 0x200
lea rdx, str._data
lea rcx, [rsp + 0x20]
add edi, eax
call fcn.140037ca0
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140008b20
add edi, eax
lea rcx, str.MYSQL_HOME
call fcn.1400371d8
test rax, rax
je 0x140008fe6
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.140008b20
add edi, eax
mov r8, rbx
lea rdx, [0x14004d3b4]
mov rcx, rsi
call fcn.140008b20
add eax, edi
test eax, eax
cmovg rbx, rbp
mov rax, rbx
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140031980
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400090d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetSystemWindowsDirectoryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, ebx
mov rcx, rdi
test rax, rax
je 0x140009116
call rax
mov eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, eax
cmp rbx, 8
jbe 0x140009142
lea rcx, [rdi - 8]
add rcx, rbx
lea rdx, str.System32
call fcn.14003dedc
test eax, eax
jne 0x140009142
sub rbx, 8
mov byte [rbx + rdi], al
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d6b0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x140366a58]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000d778
test al, 0x10
je 0x14000d6fa
call fcn.140035c28
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x14000d7cc
mov rcx, rbx
bt eax, 0xa
jae 0x14000d712
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x14000d778
jmp 0x14000d7ca
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x4000000
mov edx, 0x10000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14000d745
mov rcx, rax
jmp 0x14000d7c4
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x4000000
mov edx, 0x10000
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d78c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140016a90
mov eax, 0xffffffff
jmp 0x14000d7cc
rdtsc
shl rdx, 0x20
lea r8, str._s._llx.deleted
or rax, rdx
lea rcx, [rsp + 0x40]
mov edx, 0x127
mov qword [rsp + 0x20], rax
mov r9, rbx
call fcn.140017c00
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140031980
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret

Function at 0x14000e610
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsx ebx, cl
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, ebx
mov edi, eax
call fcn.140039b04
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x14000e64f
movsx ecx, al
sub ecx, 0x41
movzx edx, cl
bt edi, edx
jae 0x14000e64f
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x14000e6f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000e714
test al, 1
je 0x14000e70c
test bl, 2
jne 0x14000e714
xor eax, eax
add rsp, 0x20
pop rbx
ret
call fcn.140035c28
mov dword [rax], 0xd
call fcn.140007420
mov dword [rax], 0xd
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
Function at 0x14000f060
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140366a58]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [0x140b71720]
test rax, rax
jne 0x14000f117
movzx eax, word [0x14004fc28]
lea r8, [rsp + 0x22]
mov word [rsp + 0x20], ax
mov edx, 0x1004
movzx eax, byte [0x14004fc2a]
mov ecx, 0x800
mov byte [rsp + 0x22], al
xor eax, eax
mov dword [rsp + 0x23], eax
mov word [rsp + 0x27], ax
mov byte [rsp + 0x29], al
lea r9d, [rax + 7]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor edx, edx
lea r8, [rsp + 0x20]
mov eax, edx
lea r9, str.cp932
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc rax
cmp cl, byte [r9 + rax - 1]
jne 0x14000f0f7
cmp rax, 6
jne 0x14000f0e0
jmp 0x14000f0fc
sbb edx, edx
or edx, 1
test edx, edx
lea rcx, [0x1401dba80]
lea rax, [0x1401b5710]
cmove rax, rcx
mov qword [0x140b71720], rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140031980
add rsp, 0x48
ret
Function at 0x140015160
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov rdi, r9
mov qword [rsp + 0x30], rax
mov rbx, r8
mov qword [rsp + 0x38], rax
mov rsi, rdx
mov qword [rsp + 0x48], rax
test r8, r8
je 0x140015212
call fcn.140014d60
mov ecx, 0xffffffff
mov dword [rsp + 0x40], edi
shr rdi, 0x20
lea rdx, [rsp + 0x30]
cmp rbx, rcx
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
mov dword [rsp + 0x44], edi
cmovbe ecx, ebx
mov rdx, rsi
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400151fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x140015212
cmp eax, 0x6d
je 0x140015212
mov ecx, eax
call fcn.140016a90
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140015230
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov rdi, r9
mov qword [rsp + 0x30], rax
mov rbx, r8
mov qword [rsp + 0x38], rax
mov rsi, rdx
mov qword [rsp + 0x48], rax
test r8, r8
je 0x1400152c4
call fcn.140014d60
mov ecx, 0xffffffff
mov dword [rsp + 0x40], edi
shr rdi, 0x20
lea rdx, [rsp + 0x30]
cmp rbx, rcx
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
mov dword [rsp + 0x44], edi
cmovbe ecx, ebx
mov rdx, rsi
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400152c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140016a90
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1400152e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
test r8, r8
je 0x14001535e
call fcn.140014d60
mov ecx, 0xffffffff
mov qword [rsp + 0x20], 0
cmp rbx, rcx
lea r9, [rsp + 0x50]
mov rdx, rdi
cmovbe ecx, ebx
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14001534f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x14001535e
cmp eax, 0x6d
je 0x14001535e
mov ecx, eax
call fcn.140016a90
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140015600
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
xor ebx, ebx
mov rsi, rdx
mov r9d, ecx
test r8, r8
jne 0x140015624
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdi
cmp r8, rdx
mov edi, edx
cmovbe rdi, r8
call fcn.140014d40
test al, 8
je 0x14001565d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x40], 0xffffffffffffffff
mov ecx, r9d
call fcn.140014d60
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rsp + 0x60]
test eax, eax
jne 0x1400156a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140016a90
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret

Function at 0x140016ca0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x138
mov rax, qword [0x140366a58]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebx, r9d
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x140016ced
lea rdx, [rsp + 0x20]
mov ecx, 0xf6
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
lea rcx, [rsp + 0x20]
cmove rcx, rdi
mov rdi, rcx
mov r9, rsi
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x140016d0a
mov eax, 0xffffffff
jmp 0x140016d49
mov r8d, dword [rsp + 0x180]
btr ebx, 0xa
mov edx, ebx
mov rcx, rsi
call fcn.140007fb0
mov edi, eax
test eax, eax
jns 0x140016d40
call fcn.140007420
xor edx, edx
mov rcx, rsi
mov ebx, dword [rax]
call fcn.14000d610
call fcn.140007420
mov dword [rax], ebx
jmp 0x140016d47
lock inc dword [0x140b69518]
mov eax, edi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140031980
add rsp, 0x138
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140033cb4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140033b47
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140033b47
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140033b47
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140033b47
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140033b47
cmp dword [rcx + 0x84], 0xe
jbe 0x140033b47
cmp dword [rcx + 0xf8], 0
je 0x140033b47
mov ecx, ebx
call fcn.140033be8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400339d8
cmp dword [rbp + 0x20], 0
je 0x140033b94
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140033b9c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140033ae0
Function at 0x140042700
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1400426dd
call fcn.140035c28
mov dword [rax], 0x16
call fcn.140036f58
or eax, 0xffffffff
jmp 0x1400426fa
sub dword [rcx + 0x10], 1
jns 0x1400426ec
add rsp, 0x28
jmp 0x140043e34
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1400426bc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x140043e66
call fcn.140035c28
mov dword [rax], 0x16
call fcn.140036f58
jmp 0x140043f83
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140043f83
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140043f83
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140043e95
lock or dword [rcx + 0x14], 0x10
jmp 0x140043f83
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140043ea9
call fcn.140047124
mov rbx, qword [rdi + 8]
mov rcx, rdi
mov qword [rdi], rbx
call fcn.14003a784
mov r8d, dword [rdi + 0x20]
mov ecx, eax
mov rdx, rbx
call fcn.1400438c0
mov dword [rdi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x140043f71
mov eax, dword [rdi + 0x14]
or esi, 0xffffffff
test al, 6
jne 0x140043f3c
mov rcx, rdi
call fcn.14003a784
cmp eax, esi
je 0x140043f27
mov rcx, rdi
call fcn.14003a784
cmp eax, 0xfffffffe
je 0x140043f27
mov rcx, rdi
call fcn.14003a784
movsxd rbx, eax
lea r14, [0x140b726e0]
mov rcx, rdi
sar rbx, 6
call fcn.14003a784
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x140043f2e
lea rdx, [0x140366be0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140043f3c
lock or dword [rdi + 0x14], 0x20
cmp dword [rdi + 0x20], 0x200
jne 0x140043f60
mov eax, dword [rdi + 0x14]
shr eax, 6
test al, 1
je 0x140043f60
mov eax, dword [rdi + 0x14]
shr eax, 8
test al, 1
jne 0x140043f60
mov dword [rdi + 0x20], 0x1000
add dword [rdi + 0x10], esi
mov rax, qword [rdi]
movzx esi, byte [rax]
inc rax
mov qword [rdi], rax
jmp 0x140043f86
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rdi + 0x14], eax
and dword [rdi + 0x10], 0
or esi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140beb920
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 8], 0xffffffff
mov dword [rsp + 0xc], 0
jmp 0x140beb952
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xc], eax
jae 0x140beb9fa
mov eax, dword [rsp + 0xc]
mov rcx, qword [rsp]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 8]
xor eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 8]
shr eax, 8
mov dword [rsp + 8], eax
mov dword [rsp + 0x14], 0
jmp 0x140beb996
mov eax, dword [rsp + 0x14]
inc eax
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 8
jge 0x140beb9e5
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140beb9b2
mov dword [rsp + 0x1c], 1
jmp 0x140beb9ba
mov dword [rsp + 0x1c], 0
movzx eax, byte [rsp + 0x1c]
mov byte [rsp + 0x18], al
mov eax, dword [rsp + 0x10]
shr eax, 1
mov dword [rsp + 0x10], eax
movzx eax, byte [rsp + 0x18]
test eax, eax
je 0x140beb9e3
mov eax, dword [rsp + 0x10]
xor eax, 0xedb88320
mov dword [rsp + 0x10], eax
jmp 0x140beb98c
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
jmp 0x140beb948
mov eax, dword [rsp + 8]
not eax
add rsp, 0x28
ret
Function at 0x140001f80
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140001fa1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001fce
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001fd0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002029
test ecx, ecx
jle 0x140002009
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002029
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002029
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140002050
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140002072
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140002081
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400020a4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400020a6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400020e2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000217e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000211d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000215e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000217e
cmp rbx, rax
ja 0x140002130
test rbx, rbx
je 0x14000217e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret