joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004720
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [0x1400404e0]
mov rbx, rdx
xor r8d, r8d
mov rcx, rbx
xor edx, edx
call fcn.14002ad10
mov rcx, qword [rbx]
xor esi, esi
lea r8d, [rsi + 0x10]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400047ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140004790
lea rcx, [0x1400310a0]
mov eax, eax
mov ecx, dword [rcx + rax*4]
jmp 0x140004795
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], sil
cmp word [rsp + 0x30], 0x10
jne 0x14000483e
cmp byte [rsp + 0x38], 0xff
mov qword [0x1400401c8], rbx
jne 0x14000483e
cmp byte [rsp + 0x39], 0x57
jne 0x14000483e
cmp byte [rsp + 0x3a], 0x50
jne 0x14000483e
cmp byte [rsp + 0x3b], 0x43
jne 0x14000483e
cmp byte [rsp + 0x40], 1
jne 0x14000483e
cmp byte [rsp + 0x41], 0xb
jne 0x14000483e
cmp byte [rsp + 0x42], 3
jne 0x14000483e
cmp byte [rsp + 0x43], sil
jne 0x14000483e
mov rcx, rdi
mov qword [0x140040f00], rsi
mov byte [0x14003dee7], sil
call fcn.140004c90
movzx ebx, ax
test ax, ax
je 0x140004839
mov rcx, qword [0x1400401c8]
call fcn.14002a9e0
call fcn.1400049e0
mov qword [0x140040f00], rsi
mov byte [0x14003dee7], sil
movzx eax, bx
jmp 0x140004843
movzx eax, si
jmp 0x140004843
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002c960
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400063d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
xor edi, edi
mov rbx, rdx
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea r8d, [rdi + 2]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140006434
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140006418
lea rcx, [0x1400310a0]
mov eax, eax
mov ecx, dword [rcx + rax*4]
jmp 0x14000641d
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], dil
cmp dword [rsp + 0x50], 2
je 0x14000644b
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
movzx ecx, word [rsp + 0x40]
movzx eax, di
mov word [rbx], cx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140006470
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
movzx esi, r9w
mov rdi, rcx
mov r14, r8
mov ecx, esi
mov ebx, edx
call qword [sym.imp.MSVCR120.dll_malloc]
mov qword [r14], rax
test rax, rax
jne 0x1400064a8
mov eax, 4
jmp 0x140006520
test ebx, ebx
je 0x1400064b9
xor r8d, r8d
mov edx, ebx
mov rcx, rdi
call fcn.14002ad10
mov rdx, qword [r14]
mov rcx, qword [rdi]
movzx ebx, si
lea r9, [rsp + 0x58]
xor esi, esi
mov r8d, ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140006510
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x1400064f4
lea rcx, [0x1400310a0]
mov eax, eax
mov ecx, dword [rcx + rax*4]
jmp 0x1400064f9
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], sil
cmp dword [rsp + 0x58], ebx
je 0x14000651d
mov eax, 1
jmp 0x140006520
movzx eax, si
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret

Function at 0x140006e60
Capabilities:
Read file on windows

Disassembly:
mov word [rsp + 0x10], dx
sub rsp, 0x38
movzx eax, word [0x1400401b8]
mov rdx, rcx
cmp ax, word [rcx + 0x4e]
jae 0x140006eb8
movzx ecx, ax
mov rax, qword [0x140041710]
lea rdx, [rax + rcx*8]
movzx eax, word [rax + rcx*8]
mov word [0x1400402f0], ax
movzx eax, word [rdx + 2]
mov word [0x1400402f2], ax
movzx eax, word [rdx + 4]
mov word [0x1400402f4], ax
movzx eax, word [rdx + 6]
mov word [0x1400402f6], ax
jmp 0x140006f54
cmp ax, word [rcx + 0x4c]
jae 0x140006f54
movzx ecx, ax
mov eax, dword [rdx + 0x48]
xor r8d, r8d
lea edx, [rax + rcx*8]
mov rcx, qword [0x1400401c8]
call fcn.14002ad10
cmp eax, 0xffffffff
jne 0x140006ee9
mov eax, 3
add rsp, 0x38
ret
mov rcx, qword [0x1400401c8]
lea r9, [rsp + 0x48]
lea rdx, [0x1400402f0]
mov rcx, qword [rcx]
mov r8d, 8
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140006f4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140006f31
lea rcx, [0x1400310a0]
mov eax, eax
mov ecx, dword [rcx + rax*4]
jmp 0x140006f36
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], 0
cmp dword [rsp + 0x48], 8
jne 0x140006edf
movzx eax, word [0x1400401bc]
mov word [0x1400402f8], ax
mov eax, 1
add rsp, 0x38
ret
Function at 0x140017500
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
movzx edi, dx
mov rsi, rcx
test r9, r9
je 0x14001761c
mov edx, 1
mov rcx, r9
call fcn.14002ab70
mov rbx, rax
test rax, rax
jne 0x14001754d
lea eax, [rbx + 9]
jmp 0x140017646
mov rcx, qword [rax]
lea r9, [rsp + 0x34]
lea rdx, [rsp + 0x38]
mov r8d, 0x12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, 2
test eax, eax
jne 0x1400175a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140017591
lea rcx, [0x1400310a0]
mov eax, eax
mov ecx, dword [rcx + rax*4]
jmp 0x140017596
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], ebp
mov byte [0x1400433c0], 0
mov rcx, rbx
call fcn.14002a9e0
cmp dword [rsp + 0x34], 0x12
je 0x1400175c0
movzx eax, bp
jmp 0x140017646
cmp byte [rsp + 0x40], 1
jne 0x140017669
cmp byte [rsp + 0x41], 0xb
jne 0x140017669
movzx eax, word [rsp + 0x48]
mov ecx, 0x534d
cmp ax, cx
je 0x14001761c
lea r8, [rsp + 0x30]
lea rdx, str.WTsp_s.dll
lea rcx, [rsp + 0x50]
mov word [rsp + 0x30], ax
mov byte [rsp + 0x32], 0
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x50]
movzx r8d, di
mov rcx, rsi
call fcn.1400178a0
test ax, ax
je 0x140017646
lea r8, str.WTLI.dll
lea rdx, [0x1400314b4]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x50]
movzx r8d, di
mov rcx, rsi
call fcn.1400178a0
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14002c960
mov rbx, qword [rsp + 0x198]
add rsp, 0x170
pop rdi
pop rsi
pop rbp
ret
mov eax, 0x14
jmp 0x140017646
Function at 0x140017670
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x1a0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbp, rcx
xor r14d, r14d
test r8, r8
je 0x1400176b2
mov rdx, qword [r8 + 8]
jmp 0x1400176b5
mov rdx, r14
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x10
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001770e
mov word [rax], r14w
mov qword [rax + 8], r14
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x140017711
inc eax
movsxd rcx, eax
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov qword [rbx + 8], rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x140017711
mov rbx, r14
mov edx, 1
mov rcx, rbx
call fcn.14002ab70
mov rdi, rax
test rax, rax
jne 0x140017737
mov eax, 9
mov word [rbp + 0x150], ax
jmp 0x140017877
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov r8d, 0x12
lea rdx, [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, 2
test eax, eax
jne 0x14001778f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140017777
mov eax, eax
lea rcx, [0x1400310a0]
mov ecx, dword [rcx + rax*4]
jmp 0x14001777c
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], esi
mov byte [0x1400433c0], 0
cmp dword [rsp + 0x30], 0x12
je 0x1400177a5
mov word [rbp + 0x150], si
movzx eax, si
jmp 0x140017877
mov rcx, rdi
call fcn.14002a9e0
test rbx, rbx
je 0x1400177ca
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400177c1
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
cmp byte [rsp + 0x50], 0x57
jne 0x1400177dc
cmp byte [rsp + 0x51], 0x50
je 0x140017867
mov edi, r14d
lea rax, [rsp + 0x60]
cmp byte [rsp + 0x60], dil
je 0x1400177fb
nop dword [rax + rax]
lea rax, [rax + 1]
inc edi
cmp byte [rax], 0
jne 0x1400177f0
movzx eax, di
lea rsi, [rsp + 0x60]
add rsi, rax
lea rbx, [rsi - 0xa]
cmp rbx, rsi
jae 0x140017828
nop
movzx ecx, byte [rbx]
call qword [sym.imp.MSVCR120.dll_islower]
test eax, eax
je 0x140017820
add byte [rbx], 0xe0
inc rbx
cmp rbx, rsi
jb 0x140017810
movzx eax, di
sub eax, 0xa
movsxd rcx, eax
lea rax, [rsp + 0x60]
add rcx, rax
mov r8d, 4
lea rdx, [0x1400314b8]
call qword [sym.imp.MSVCR120.dll__strnicmp]
mov edx, 0x5053
xor r9d, r9d
mov rcx, rbp
call fcn.140017500
test ax, ax
jne 0x140017867
movzx eax, r14w
jmp 0x140017877
xor r9d, r9d
mov edx, 0x5053
mov rcx, rbp
call fcn.140017500
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14002c960
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14001bc00
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x30]
lea rax, [rsp + 0x30]
sub rcx, rax
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14001bc40
mov ecx, 0x10
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov rbx, rax
mov qword [rsp + 0x20], rax
xor edi, edi
test rax, rax
je 0x14001bc9d
mov word [rax], di
mov qword [rax + 8], rdi
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x14001bca0
inc eax
movsxd rcx, eax
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov qword [rbx + 8], rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x14001bca0
mov rbx, rdi
mov edx, 1
mov rcx, rbx
call fcn.14002ab70
mov rsi, rax
test rax, rax
jne 0x14001bccb
mov dword [0x14003e1a8], edi
mov word [0x14003ee44], di
mov word [0x14003ee5c], di
jmp 0x14001bd0f
test rbx, rbx
je 0x14001bce8
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001bcdf
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x14003e1a8], eax
mov word [0x14003ee44], di
mov word [0x14003ee5c], di
mov rcx, rsi
call fcn.14002a9e0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002c960
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140024430
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x458
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
xor ecx, ecx
mov rsi, rdx
lea r8d, [rcx + 0x32]
lea rdx, [0x140033b50]
call qword [0x140041aa8]
test ax, ax
je 0x140024474
mov eax, 6
jmp 0x14002456a
mov qword [rsp + Ordinal_1154], rbx
mov qword [rsp + 0x488], rbp
mov qword [rsp + Ordinal_1108], r14
lea r14, [0x1400310a0]
xor ebp, ebp
nop word [rax + rax]
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x400
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400244f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x1400244d5
mov eax, eax
mov ecx, dword [r14 + rax*4]
jmp 0x1400244da
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], bpl
mov ebx, dword [rsp + 0x30]
mov rcx, qword [rsi]
lea r9, [rsp + 0x34]
lea rdx, [rsp + 0x40]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140024543
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140024527
mov eax, eax
mov ecx, dword [r14 + rax*4]
jmp 0x14002452c
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], bpl
cmp ebx, 0x400
je 0x1400244a0
mov r14, qword [rsp + 0x450]
mov rbx, qword [rsp + 0x480]
movzx eax, bp
mov rbp, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14002c960
add rsp, 0x458
pop rdi
pop rsi
ret
Function at 0x140025180
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x470
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r14, r8
movzx esi, dx
mov rbp, rcx
call fcn.140025310
test ax, ax
je 0x1400251bb
mov eax, 0x64
jmp 0x1400252ec
mov qword [rsp + 0x468], rbx
mov qword [rsp + Ordinal_1118], r12
mov qword [rsp + Ordinal_1108], r15
xor r15d, r15d
mov qword [rsp + 0x460], rdi
mov ebx, 0xa
lea r12, [0x1400310a0]
nop word [rax + rax]
inc bx
cmp bx, 0x64
jbe 0x1400251fd
movzx ebx, r15w
lea rdx, [0x140033b50]
xor ecx, ecx
movzx r8d, bx
call qword [0x140041aa8]
test ax, ax
jne 0x1400252c7
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x400
call sub.MSVCR120.dll_memset
lea r8, [rsp + 0x40]
movzx edx, si
mov rcx, rbp
call fcn.1400255e0
mov edi, eax
test sil, 0x10
jne 0x140025260
lea rcx, [rsp + 0x40]
cmp word [rsp + 0x40], r15w
je 0x140025260
not byte [rcx]
not byte [rcx + 1]
cmp word [rcx + 2], r15w
lea rcx, [rcx + 2]
jne 0x140025250
mov rcx, qword [r14]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400252ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140025292
mov eax, eax
mov ecx, dword [r12 + rax*4]
jmp 0x140025297
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], r15b
cmp edi, 4
jg 0x1400251f0
cmp edi, 0xffffffff
jne 0x1400252c1
lea eax, [rdi + 0x65]
jmp 0x1400252cc
movzx eax, r15w
jmp 0x1400252cc
mov eax, 6
mov rdi, qword [rsp + 0x460]
mov r12, qword [rsp + 0x458]
mov rbx, qword [rsp + 0x468]
mov r15, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14002c960
add rsp, 0x470
pop r14
pop rsi
pop rbp
ret
Function at 0x140025bd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
mov ebx, 1
lea r9, [rsp + 0x40]
xor edi, edi
mov r8d, ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140025c30
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140025c14
lea rcx, [0x1400310a0]
mov eax, eax
mov ecx, dword [rcx + rax*4]
jmp 0x140025c19
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], dil
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x140025c58
dec ecx
je 0x140025c4a
or eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
movzx eax, di
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
movzx eax, bx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140025d10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov eax, 0xf0
xor r15d, r15d
mov rsi, rcx
cmp dx, ax
jae 0x140025e55
mov ebx, 1
mov r8d, ebx
mov edx, ebx
call fcn.14002ad10
mov rcx, qword [rsi]
lea r9, [rsp + 0x70]
lea rdx, [rsp + 0x68]
mov r8d, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rdi, [0x140000000]
mov ebp, 0x106
test eax, eax
jne 0x140025d9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140025d84
mov eax, eax
mov ecx, dword [rdi + rax*4 + 0x310a0]
jmp 0x140025d86
mov ecx, ebp
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], r15b
mov ecx, dword [rsp + 0x70]
test ecx, ecx
je 0x140025e3e
dec ecx
je 0x140025dc4
or ecx, 0xffffffff
movzx eax, cx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsi]
movzx r14d, byte [rsp + 0x68]
lea r9, [rsp + 0x70]
lea rdx, [rsp + 0x68]
mov r8d, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140025e14
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140025dfd
mov eax, eax
mov ebp, dword [rdi + rax*4 + 0x310a0]
mov dword [0x1400430b8], ebp
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], r15b
mov ecx, dword [rsp + 0x70]
test ecx, ecx
je 0x140025e3e
dec ecx
jne 0x140025dad
movzx eax, byte [rsp + 0x68]
mov ecx, 0x100
mov r8d, ebx
imul ax, cx
sub ax, 4
add ax, r14w
movzx edx, ax
jmp 0x140025e8e
movzx ecx, bx
movzx eax, cx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov eax, 0xf5
or ecx, 0xffffffff
cmp dx, ax
ja 0x140025e76
lea rdi, [0x140000000]
movzx eax, dx
movzx edx, byte [rax + rdi + 0x3046a]
jmp 0x140025e78
mov edx, ecx
movsx eax, dx
cmp eax, 0xffff
je 0x140025e41
dec dx
mov r8d, 1
movzx edx, dx
mov rcx, rsi
call fcn.14002ad10
mov rbx, qword [rsp + 0x60]
movzx eax, r15w
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140025eb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov word [rsp + 0x10], dx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rcx
xor edi, edi
mov esi, 1
lea r14, [0x1400310a0]
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x58]
mov r8d, esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140025f2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140025f12
mov eax, eax
mov ecx, dword [r14 + rax*4]
jmp 0x140025f17
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], dil
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x140025f87
dec ecx
jne 0x140025f76
movzx eax, byte [rsp + 0x58]
cmp al, 0xf1
je 0x140025f65
cmp al, 0xd0
jb 0x140025ee0
movzx edx, al
mov rcx, rbx
call fcn.140025d10
test ax, ax
je 0x140025ee0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
movzx eax, di
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
movzx eax, si
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140027680
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x200
call sub.MSVCR120.dll_memset
mov rcx, qword [rbx]
xor eax, eax
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x200
mov dword [rsp + 0x40], 0x435057ff
mov dword [rsp + 0x44], 0x200
mov word [rsp + 0x48], 0xa01
mov dword [rsp + 0x4a], 2
mov word [rsp + 0x4e], ax
mov qword [rsp + 0x50], 0x20002
lea edi, [rax + 2]
mov word [rsp + 0x58], ax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14002773e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140027726
lea rcx, [0x1400310a0]
mov eax, eax
mov ecx, dword [rcx + rax*4]
jmp 0x14002772b
mov ecx, 0x106
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], edi
mov byte [0x1400433c0], 0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002c960
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x140027770
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r8d, r8d
xor edx, edx
mov rdi, rcx
call fcn.14002ad10
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x200
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rsi, [0x1400310a0]
mov ebx, 0x106
test eax, eax
jne 0x1400277fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x1400277e5
mov eax, eax
mov ecx, dword [rsi + rax*4]
jmp 0x1400277e7
mov ecx, ebx
mov dword [0x1400430b8], ecx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], 0
cmp dword [rsp + 0x30], 0x200
je 0x14002780f
mov eax, 0x6a
jmp 0x14002788d
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.14002ad10
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call fcn.14002ad10
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x54], eax
call fcn.14002ad10
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x200
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140027889
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140027872
mov eax, eax
mov ebx, dword [rsi + rax*4]
mov dword [0x1400430b8], ebx
mov dword [0x1400434c8], 2
mov byte [0x1400433c0], 0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002c960
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140029e30
Capabilities:
Get file size

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov r15, r9
mov rsi, rdx
mov r14, qword [rsp + 0x70]
mov dword [r14], 1
xor edi, edi
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], rdi
lea rbp, [0x140042670]
mov r8, rbp
sub rcx, rbp
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
mov byte [r8], al
lea r8, [r8 + 1]
test al, al
jne 0x140029e80
mov ecx, 0x10
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140029ed9
mov word [rax], di
mov qword [rax + 8], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x140029edc
inc eax
movsxd rcx, eax
call qword [sym.imp.mfc120u.dll_Ordinal_1484]
mov qword [rbx + 8], rax
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x140029edc
mov rbx, rdi
mov edx, 1
mov rcx, rbx
call fcn.14002ab70
mov qword [r14 + 8], rax
test rax, rax
je 0x140029f5f
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [r15], eax
cmp eax, 0xffffffff
je 0x140029f5f
test rbx, rbx
je 0x140029f22
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140029f19
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
mov rdx, rbp
sub rsi, rbp
nop dword [rax + rax]
movzx eax, byte [rsi + rdx]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140029f30
mov rcx, rbp
call fcn.14002ae90
mov rbx, rax
mov edx, 0xa
mov rcx, rax
call fcn.14002ab70
mov qword [r14 + 0x10], rax
test rax, rax
jne 0x140029f64
mov edi, 2
test rbx, rbx
je 0x140029f81
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140029f78
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
mov rcx, rbx
call qword [sym.imp.mfc120u.dll_Ordinal_1486]
test edi, edi
je 0x140029fa3
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x140029f93
call fcn.14002a9e0
mov rcx, qword [r14 + 0x10]
test rcx, rcx
je 0x140029fde
call fcn.14002a9e0
jmp 0x140029fde
lea rcx, [0x140029770]
mov rax, qword [rsp + 0x78]
mov qword [rax], rcx
lea rcx, [0x140029860]
mov qword [rax + 8], rcx
lea rcx, [0x140029b20]
mov qword [rax + 0x10], rcx
lea rcx, [0x1400299e0]
mov qword [rax + 0x18], rcx
lea rcx, [0x140029aa0]
mov qword [rax + 0x20], rcx
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret