joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f9a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14001f9c2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14001fa3c
mov rdi, r14
mov rcx, rbx
call fcn.1400093f0
test rax, rax
jle 0x14001fa14
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.140058cc0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14001fa2c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14001fa34
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14001f9d6
sub r14, rdi
jmp 0x14001fb1f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14001fa53
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001fa55
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001fa87
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140058cc0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14001fb1c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001fac2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14001fafd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140067854
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14001fb1c
cmp rbp, rax
ja 0x14001fad0
test rbp, rbp
je 0x14001fb1c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140067854
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x14001ff60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400b31d8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001ff8d
xor eax, eax
jmp 0x1400200d3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14001ffc7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14001ffc7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400200d3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400200c6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14002000a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140020019
movsx ecx, dil
jmp 0x14002006d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x140020087
sub eax, 1
je 0x140020087
cmp eax, 2
jne 0x1400200c6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1400657f8
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400200cb
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400200b4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.140067064
cmp rsi, rax
jne 0x1400200c6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1400200cb
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140056720
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14002eb20
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14002ec9b
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140024280
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14002ec64
mov qword [rsp + 0x58], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
movzx r9d, byte [rax + 0x10]
mov rcx, qword [rcx]
mov r11d, r9d
xor r11, rdi
imul r11, rbp
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x14002ebe0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14002ec53
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x14002ec19
mov r10, qword [rdx]
cmp r10, rax
je 0x14002ec13
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14002ec53
cmp r8, rdx
je 0x14002ec2f
nop
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x14002ec75
cmp r8, rdx
jne 0x14002ec20
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14002ebb1
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14002ec53
lea rcx, str.invalid_hash_bucket_count
call fcn.140052940
int3
Function at 0x140031280
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x1400b31d8]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 0x10]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14003146d
mov rbx, qword [rcx + 0x18]
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call fcn.1400546e4
test eax, eax
jne 0x14003149a
xor r14d, r14d
mov qword [rsi + 0x28], r14
mov qword [rsi + 0x30], r14
xor edx, edx
mov r8d, 0x120
lea rcx, [rsp + 0x50]
call fcn.140059370
mov qword [rsp + 0x60], r14
lea r15, vtable.fmt::v9::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0xfa
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov rdx, rsi
call qword [rax + 8]
cmp byte [rdi + 0x20], r14b
je 0x140031401
mov rax, qword [rsi + 0x28]
cmp qword [rsi + 0x30], rax
jbe 0x140031401
test rax, rax
je 0x14003135f
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movsxd rax, dword [rsi + 0x10]
movzx ebp, word [rdi + rax*2 + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x140031380
lea ebp, [rax + 7]
jmp 0x14003139b
mov edx, dword [rsp + 0x40]
and edx, 0xfff0
or edx, ebp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx ebp, word [rsp + 0x40]
mov rcx, qword [rsi + 0x30]
mov r8, qword [rsi + 0x28]
cmp rcx, r8
jbe 0x1400313c8
sub ecx, r8d
mov rdx, qword [rsp + 0x58]
add rdx, r8
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, ecx
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movzx edx, bp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rsp + 0x60]
cmp rcx, rdx
jbe 0x140031425
sub ecx, edx
add rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, ecx
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x140031425
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x140031465
mov rdx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003145f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031494
call fcn.140056740
nop
mov rcx, rbx
call fcn.140054708
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140056720
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140065768
nop
mov ecx, eax
call fcn.1400542ec
int3
Function at 0x140041da0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400b31d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x20], rcx
call fcn.1400546e4
test eax, eax
jne 0x140041ff4
mov r8, qword [rbp + 0x1d8]
test r8, r8
je 0x140041eca
add r8, 8
mov r9, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x140041e03
mov rdx, qword [r8]
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
test r9, r9
je 0x140041e33
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r10
inc rcx
cmp rcx, r9
jb 0x140041e20
mov r9, rbx
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0xf0]
call fcn.140031690
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x140041eca
mov rcx, qword [rbp + 0x120]
and rcx, rbx
shl rcx, 4
mov rdx, qword [rbp + 0x108]
add rdx, rcx
mov rax, qword [rdx]
cmp qword [rdx + 8], rdi
jne 0x140041e90
cmp rax, rdi
jne 0x140041e86
mov rax, qword [rbp + 0xf8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140041e9b
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
jmp 0x140041e9b
cmp rax, rdi
jne 0x140041e9b
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
dec qword [rbp + 0x100]
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rcx, [rdi + 0x10]
call fcn.140034790
mov edx, 0x40
mov rcx, rdi
call fcn.140056740
mov r8, qword [rsi]
mov edi, 0xffffffff
test r8, r8
je 0x140041f3d
lea rcx, [rbp + 0xf0]
add r8, 8
lea rdx, [rsp + 0x38]
call fcn.140048a40
mov rdx, qword [rax]
mov rax, qword [rsi + 8]
test rax, rax
je 0x140041efc
lock inc dword [rax + 8]
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rdx + 0x30], rax
mov rbx, qword [rdx + 0x38]
mov qword [rdx + 0x38], rcx
test rbx, rbx
je 0x140041f3d
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140041f3d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140041f3d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov qword [rsi], 0
mov qword [rsi + 8], 0
mov qword [rbp + 0x1d8], rax
mov rbx, qword [rbp + 0x1e0]
mov qword [rbp + 0x1e0], rcx
test rbx, rbx
je 0x140041f97
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140041f97
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140041f97
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0x20]
call fcn.140054708
nop
mov rbx, qword [rsi + 8]
test rbx, rbx
je 0x140041fd2
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140041fd2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140041fd2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140056720
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.1400542ec
int3
Function at 0x140044450
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1400b31d8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rdx
mov rbx, rcx
cmp byte [rcx + 0x68], 0
je 0x14004448e
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140044554
xor edx, edx
mov r8d, 0x120
lea rcx, [rsp + 0x20]
call fcn.140059370
mov qword [rsp + 0x30], 0
lea rsi, vtable.fmt::v9::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rsp + 0x20], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 0xfa
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
lea r8, [rsp + 0x20]
mov rdx, rdi
call qword [rax + 8]
mov rcx, qword [rsp + 0x30]
lea rdx, [rcx + 1]
cmp rdx, qword [rsp + 0x38]
jbe 0x1400444fb
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
call qword [rax]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov byte [rax + rcx], 0
inc qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
mov qword [rsp + 0x20], rsi
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
cmp rcx, rax
je 0x140044554
mov rdx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004454f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140044579
call fcn.140056740
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140056720
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140065768
int3
Function at 0x140048360
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x1400b31d8]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x120
lea rcx, [rsp + 0x60]
call fcn.140059370
mov qword [rsp + 0x70], 0
lea rbp, vtable.fmt::v9::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rsp + 0x60], rbp
lea rax, [rsp + 0x80]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], 0xfa
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
mov rdx, rbx
call qword [rax + 8]
mov rsi, qword [rdi + 0x98]
mov rbx, qword [rsp + 0x70]
add rsi, rbx
cmp rsi, qword [rdi + 0x88]
jbe 0x14004842a
mov rcx, qword [rdi + 0xa8]
call fcn.1400664b4
test eax, eax
jne 0x1400484be
lea rcx, [rdi + 0xa0]
call fcn.1400428c0
test rax, rax
je 0x140048425
mov rcx, rdi
call fcn.14004c400
mov rbx, qword [rsp + 0x70]
mov rsi, rbx
jmp 0x14004842a
mov rbx, qword [rsp + 0x70]
mov r9, qword [rdi + 0xa8]
mov r8, rbx
mov edx, 1
mov rcx, qword [rsp + 0x68]
call fcn.140067064
cmp rax, rbx
jne 0x1400484f8
mov qword [rdi + 0x98], rsi
mov qword [rsp + 0x60], rbp
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
cmp rcx, rax
je 0x140048495
mov rdx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048490
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400484b8
call fcn.140056740
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140056720
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x190
pop rdi
pop rsi
pop rbp
ret
call fcn.140065768
nop
call fcn.1400671a0
nop
mov ebx, dword [rax]
lea rdx, [rdi + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.140041040
nop
mov r8, rax
lea rdx, str.Failed_flush_to_file
lea rcx, [rsp + 0x40]
call fcn.140048250
nop
mov edx, ebx
mov rcx, rax
call fcn.1400124b0
nop
call fcn.1400671a0
mov ebx, dword [rax]
lea rdx, [rdi + 0xb0]
lea rcx, [rsp + 0x40]
call fcn.140041040
nop
mov r8, rax
lea rdx, str.Failed_writing_to_file
lea rcx, [rsp + 0x20]
call fcn.140048250
nop
mov edx, ebx
mov rcx, rax
call fcn.1400124b0
int3
Function at 0x14004c400
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1400b31d8]
xor rax, rsp
mov qword [rbp + 8], rax
mov r15, rcx
add rcx, 0xa0
call fcn.140042830
mov rbx, qword [r15 + 0x90]
test rbx, rbx
je 0x14004c5a0
xor r12d, r12d
nop
lea rdi, [rbx - 1]
mov r8, rdi
lea rdx, [r15 + 0x68]
lea rcx, [rbp - 0x18]
call fcn.14004fe70
nop
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14004c55d
mov r8, rbx
lea rdx, [r15 + 0x68]
lea rcx, [rbp - 0x38]
call fcn.14004fe70
nop
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rcx, qword [rbp - 0x38]
call fcn.1400687f4
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rcx, qword [rbp - 0x18]
call fcn.1400696e4
test eax, eax
je 0x14004c512
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rcx, qword [rbp - 0x38]
call fcn.1400687f4
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rcx, qword [rbp - 0x18]
call fcn.1400696e4
test eax, eax
jne 0x14004c607
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14004c54d
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c548
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c685
call fcn.140056740
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x14004c594
inc rdx
mov rcx, qword [rbp - 0x18]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14004c58f
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004c5e8
call fcn.140056740
mov rbx, rdi
test rdi, rdi
jne 0x14004c450
cmp qword [r15 + 0xc0], 0
je 0x14004c5ee
lea rdx, [r15 + 0xb0]
mov r8b, 1
lea rcx, [r15 + 0xa0]
call fcn.140042510
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.140056720
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140065768
int3
lea rdx, str.Failed_re_opening_file___was_not_opened_before
lea rcx, [rbp - 0x18]
call fcn.1400072a0
mov rcx, rax
call fcn.140041000
nop
lea rcx, [r15 + 0xa0]
call fcn.1400427f0
mov qword [r15 + 0x98], r12
call fcn.1400671a0
mov edi, dword [rax]
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x28]
call fcn.140041040
mov rbx, rax
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x48]
call fcn.140041040
nop
mov r8, rax
lea rdx, str.rotating_file_sink:_failed_renaming
lea rcx, [rsp + 0x68]
call fcn.140048250
nop
lea r8, str._to
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140047ef0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140047f60
nop
mov edx, edi
mov rcx, rax
call fcn.1400124b0
nop
call fcn.140065768
int3
Function at 0x140050cf0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400b31d8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rsi, rcx
mov ecx, 0x88
call fcn.1400569e4
mov rdi, rax
mov rax, qword [rbx]
mov qword [rdi], rax
lea rcx, [rdi + 8]
lea rdx, [rbx + 8]
call fcn.140036620
lea rcx, [rdi + 0x48]
lea rdx, [rbx + 0x48]
call fcn.140036620
mov qword [rsp + 0x30], rdi
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x140052420]
xor edx, edx
xor ecx, ecx
call fcn.1400667b4
mov qword [rsi], rax
test rax, rax
je 0x140050d92
mov rax, rsi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140056720
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call fcn.140054328
int3

Function at 0x140053838
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1400b31d8]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14005387c
movzx eax, r14w
jmp 0x1400539b1
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1400538b8
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x1400538b8
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x1400539b1
cmp qword [rcx + 0x80], r14
je 0x1400539ae
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400538f6
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14005391f
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.14006a1cc
cmp ax, di
je 0x1400539ae
movzx edi, si
jmp 0x1400539ae
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x14008b578]
test eax, eax
je 0x140053974
sub eax, 1
je 0x140053974
cmp eax, 2
jne 0x1400539ae
movzx ecx, word [rbp + 7]
jmp 0x140053902
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x14005399e
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.140067064
cmp r14, rax
jne 0x1400539ae
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
cmovne di, si
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140056720
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140057774
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400577be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400577be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400577be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400577be
cmp dword [rcx + 0x84], 0xe
jbe 0x1400577be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400577c0
xor al, al
add rsp, 0x28
ret

Function at 0x140067e18
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140067cab
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140067cab
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140067cab
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140067cab
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140067cab
cmp dword [rcx + 0x84], 0xe
jbe 0x140067cab
cmp dword [rcx + 0xf8], 0
je 0x140067cab
mov ecx, ebx
call fcn.140067d4c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140067b3c
cmp dword [rbp + 0x20], 0
je 0x140067cf8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140067d00
int3
xor r8d, r8d
xor edx, edx
jmp 0x140067c44