joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180066780
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rcx
lea rbx, [rcx + 1]
mov edi, 0xa
xor ebp, ebp
nop word [rax + rax]
mov rax, qword [0x1800ce8b0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
mov qword [rcx], rax
mov rax, qword [0x1800ce8b8]
mov qword [rcx + 8], rax
mov rax, qword [0x1800ce8c0]
lea r8, [rsp + 0x20]
mov qword [rcx + 0x10], rax
mov rax, qword [0x1800ce8c8]
mov edx, 0x280
mov qword [rcx + 0x18], rax
mov rax, qword [0x1800ce8d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1800ce8d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1800ce8e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1800ce8e8]
mov qword [rcx + 0x38], rax
mov rcx, rsi
call fcn.180067d70
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xf0]
mov r8d, 0x40
call fcn.180067e80
mov r11, rbp
movzx eax, byte [rsp + r11 + 0xf0]
add r11, 4
xor byte [rbx + r11 - 5], al
movzx eax, byte [rsp + r11 + 0xed]
xor byte [rbx + r11 - 4], al
movzx eax, byte [rsp + r11 + 0xee]
xor byte [rbx + r11 - 3], al
movzx eax, byte [rsp + r11 + 0xef]
xor byte [rbx + r11 - 2], al
cmp r11, 0x40
jl 0x180066853
add rbx, 0x40
sub rdi, 1
jne 0x1800667c0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18006a4f0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180066f30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x150
mov rax, qword [0x1800ff050]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, qword [rsp + 0x1a8]
xor eax, eax
mov rdi, r8
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + 0x1b0]
mov rbp, rcx
mov r12d, edx
mov esi, 0x40
lea rcx, [rsp + 0xc0]
mov r8, rsi
mov rdx, rdi
mov byte [rsp + 0x33], al
call fcn.18006c2d0
mov edx, dword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x100], edx
lea r9d, [rsi + 4]
lea r8, [rsp + 0xc0]
mov edx, r12d
mov rcx, rbp
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call fcn.1800668d0
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov r8, rsi
call fcn.18006c2d0
lea rdx, [rsp + 0x80]
mov edi, 0x3e7
sub rbx, rdx
nop dword [rax + rax]
lea rax, [rsp + 0x80]
lea r8, [rsp + 0x40]
mov r9d, esi
mov edx, r12d
mov rcx, rbp
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call fcn.1800668d0
xor edx, edx
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x80]
lea rcx, [rsp + rdx + 0x80]
inc rdx
xor byte [rbx + rcx], al
cmp rdx, rsi
mov byte [rsp + rdx + 0x3f], al
jl 0x180067010
sub rdi, 1
jne 0x180066fe0
lea rdi, [rsp + 0x40]
xor eax, eax
mov rcx, rsi
lea rdx, [rsp + 0x40]
mov r8d, esi
rep stosb byte [rdi], al
nop dword [rax]
mov byte [rdx], al
inc rdx
sub r8d, 1
jne 0x180067050
lea rdi, [rsp + 0x80]
mov rcx, rsi
lea rdx, [rsp + 0x80]
rep stosb byte [rdi], al
mov byte [rdx], al
inc rdx
sub esi, 1
jne 0x180067070
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.18006a4f0
add rsp, 0x150
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18006ccab
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800ff050]
jne 0x18006a50a
rol rcx, 0x10
test cx, 0xffff
jne 0x18006a506
repz ret
ror rcx, 0x10
jmp 0x18006cc04
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180107010]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180107108]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18006cc89
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180107010]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18006ccab
mov rax, qword [rsp + 0x88]
mov qword [0x180107108], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1801070a8], rax
mov rax, qword [0x180107108]
mov qword [0x180106f80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180107090], rax
mov dword [0x180106f70], 0xc0000409
mov dword [0x180106f74], 1
mov rax, qword [0x1800ff050]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1800ff058]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180107008], eax
mov ecx, 1
call fcn.18006d1ec
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800c1808]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180107008], 0
jne 0x18006cd32
mov ecx, 1
call fcn.18006d1ec
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180071e88
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180071cfc
Function at 0x180077334
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18006d1fc
xor ebx, ebx
mov rdi, rax
cmp qword [0x180107cb8], rbx
jne 0x18007743a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18007750f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18007750f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1800c2a90]
mov rcx, rsi
mov qword [0x180107cb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180107cc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x180107cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x180107cd8], rax
test rax, rax
je 0x180077431
lea rdx, [0x1800c2a40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180107cd0], rax
jmp 0x180077441
mov rax, qword [0x180107cd0]
jmp 0x180077448
mov rax, qword [0x180107cd0]
mov r11, qword [0x180107cd8]
cmp rax, rdi
je 0x1800774b0
cmp r11, rdi
je 0x1800774b0
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x180107cd8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1800774b0
test rax, rax
je 0x1800774b0
call rsi
test rax, rax
je 0x1800774aa
lea rcx, [rsp + 0x88]
mov r9d, recv
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800774aa
test byte [rsp + 0x38], 1
jne 0x1800774b0
bts ebp, 0x15
jmp 0x1800774ee
mov rcx, qword [0x180107cc0]
cmp rcx, rdi
je 0x1800774ee
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800774ee
call rax
mov rbx, rax
test rax, rax
je 0x1800774ee
mov rcx, qword [0x180107cc8]
cmp rcx, rdi
je 0x1800774ee
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800774ee
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180107cb8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18007750f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180077511
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180082f10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
movsxd rbx, dword [rsp + 0x40]
xor r10d, r10d
mov rsi, r8
mov r11, rdx
cmp r9d, 2
jne 0x180083012
cmp rbx, 2
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], r12
mov r12d, r10d
mov ebp, r10d
mov r9, r10
jl 0x180082fcd
mov qword [rsp + 0x30], r13
mov rdi, rdx
mov qword [rsp + 0x38], r14
lea r14, [rbx - 1]
lea r13, [r8 + 4]
sub rdi, r8
mov ecx, dword [r13 - 4]
mov r8d, dword [r11 + r9*4]
add r9, 2
mov eax, ecx
add r13, 8
cdq
sub eax, edx
sar eax, 1
sub r8d, eax
lea eax, [rcx + r8]
cdq
mov ecx, eax
mov eax, r8d
mov r8d, dword [rdi + r13 - 8]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
add ebp, ecx
mov ecx, dword [r13 - 8]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
sub r8d, eax
lea eax, [rcx + r8]
cdq
mov ecx, eax
mov eax, r8d
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
add r12d, eax
add r12d, ecx
cmp r9, r14
jl 0x180082f61
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
cmp r9, rbx
jge 0x180082ffd
mov ecx, dword [rsi + r9*4]
mov r8d, dword [r11 + r9*4]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
sub r8d, eax
lea eax, [rcx + r8]
cdq
mov r10d, eax
mov eax, r8d
xor r10d, edx
sub r10d, edx
cdq
xor eax, edx
sub eax, edx
add r10d, eax
lea eax, [r12 + rbp]
mov r12, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
add eax, r10d
pop rdi
pop rsi
pop rbx
ret
cmp r9d, 1
jne 0x18008306e
cmp rbx, 2
mov r8d, r10d
mov r9d, r10d
mov rcx, r10
jl 0x180083052
lea rdi, [rbx - 1]
nop dword [rax + rax]
mov eax, dword [r11 + rcx*4]
add rcx, 2
cdq
xor eax, edx
sub eax, edx
add r8d, eax
mov eax, dword [r11 + rcx*4 - 4]
cdq
xor eax, edx
sub eax, edx
add r9d, eax
cmp rcx, rdi
jl 0x180083030
cmp rcx, rbx
jge 0x180083063
mov eax, dword [r11 + rcx*4]
cdq
xor eax, edx
sub eax, edx
mov r10d, eax
lea eax, [r9 + r8]
add eax, r10d
pop rdi
pop rsi
pop rbx
ret
mov eax, r10d
pop rdi
pop rsi
pop rbx
ret
Function at 0x180085d30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
xor ebp, ebp
mov eax, 1
mov rdi, r9
mov r12d, r8d
mov r13, rdx
mov r14, rcx
mov esi, ebp
mov dword [r9], eax
mov ebx, r8d
test r8d, r8d
jle 0x180085da4
nop
cmp dword [rdi], ebp
jbe 0x180085da4
test eax, eax
je 0x180085da4
mov rcx, qword [r14 + 8]
mov edx, r12d
mov r9, rdi
sub edx, ebx
mov r8d, ebx
mov qword [rsp + 0x20], rbp
add rdx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x180085da0
mov ecx, dword [rdi]
sub ebx, ecx
add esi, ecx
test ebx, ebx
jg 0x180085d70
mov rbx, qword [rsp + 0x50]
test eax, eax
mov dword [rdi], esi
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov ecx, 0x3e8
cmove ebp, ecx
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r13
pop r12
ret

Function at 0x180085de0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx + 8]
mov rbx, r9
mov edi, r8d
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180085e18
cmp dword [rbx], edi
jne 0x180085e18
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, 0x3e9
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180085e50
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x180086090
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + reloc.WS2_32.dll_recv]
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800ac6a0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, rcx
test rcx, rcx
je 0x1800ac760
mov rax, qword [rcx]
xor r8d, r8d
lea r11, [0x1800cb650]
mov byte [rax + 0x16], r8b
mov rax, qword [rcx]
mov byte [rax + 0x17], r8b
mov rax, qword [rcx]
mov byte [rax + 0x18], r8b
mov rax, qword [rcx]
mov byte [rax + 0x19], r8b
mov eax, dword [rcx + 8]
test eax, eax
jle 0x1800ac704
mov r9, qword [rcx]
mov r10, rax
nop
movzx eax, byte [r9]
mov ecx, r8d
inc r9
shr rcx, 0x18
xor rcx, rax
mov eax, r8d
mov r8d, dword [r11 + rcx*4]
shl eax, 8
xor r8d, eax
sub r10, 1
jne 0x1800ac6e0
mov eax, dword [rdx + 0x18]
test eax, eax
jle 0x1800ac736
mov r9, qword [rdx + 0x10]
mov r10, rax
movzx eax, byte [r9]
mov ecx, r8d
inc r9
shr rcx, 0x18
xor rcx, rax
mov eax, r8d
mov r8d, dword [r11 + rcx*4]
shl eax, 8
xor r8d, eax
sub r10, 1
jne 0x1800ac712
mov rax, qword [rdx]
mov ecx, r8d
mov byte [rax + 0x16], r8b
mov rax, qword [rdx]
shr ecx, 8
mov byte [rax + 0x17], cl
mov rax, qword [rdx]
mov ecx, r8d
shr ecx, 0x10
shr r8d, 0x18
mov byte [rax + 0x18], cl
mov rax, qword [rdx]
mov byte [rax + 0x19], r8b
repz ret
Function at 0x100411cb0
Capabilities:
Encode data using xor

Disassembly:
xor edi, dword [rcx + rax*8 - 0x80]
pop rax
sbb al, 0x4e
adc al, 0x33
xor esi, dword [rbp - 0x3f]
Function at 0x140044370
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
cmp byte [0x1400ab65d], 0
je 0x140044388
mov eax, dword [0x1400ab690]
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx r8d, ax
mov edx, r8d
and edx, 0x3ff
sub edx, 7
je 0x1400443f1
sub edx, 2
je 0x1400443ea
sub edx, 1
je 0x1400443c6
sub edx, 0xb
je 0x1400443bc
cmp edx, 1
jne 0x1400443ea
lea eax, [rdx + 1]
add rsp, 0x28
ret
mov eax, 5
add rsp, 0x28
ret
mov eax, 0xfc00
mov ecx, 0x800
and r8w, ax
mov edx, 1
cmp r8w, cx
mov eax, 3
cmovne eax, edx
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
mov eax, 4
add rsp, 0x28
ret

Function at 0x1400473c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x14009e038]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r10, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rdi, [rbp + 0x30]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
mov rcx, r10
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x140047535
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], si
mov rdx, qword [rsp + 0x20]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rdx + r8*2], si
jne 0x140047450
lea rcx, [rsp + 0x50]
call fcn.14001ef00
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
lea rax, [rbp + 0x30]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400474a2
mov r8, rdi
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.14001ef00
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.14001fa60
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140047510
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004750b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004750b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052fec
mov rax, rbx
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140052d40
mov rbx, qword [rsp + 0x380]
add rsp, 0x350
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [rbp - 0x30]
call fcn.14001f810
nop
mov rcx, rax
call fcn.140047ab0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001f900
lea rdx, [0x14009a430]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140049390
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14009e038]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rdi, rcx
lea rax, vtable.LogItem.0
mov qword [rbp - 0x80], rax
call fcn.14001fe00
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140025330
nop
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x38]
call fcn.140025330
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14001fbe0
nop
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x58]
call fcn.140025330
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.14001fbe0
mov dword [rbp - 0x18], 1
mov dword [rbp - 0x14], 2
lea rdx, str.Executing_scheduled_commands:
lea rcx, [rbp - 0x80]
call fcn.140020870
mov rdx, qword [rdi + 0x78]
sub rdx, qword [rdi + 0x70]
sar rdx, 2
mov rcx, rax
call fcn.140027b60
nop
lea rcx, [rbp - 0x80]
call fcn.140020370
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rdi + 0x2c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x140032a70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 8], rax
test rax, rax
je 0x1400494a7
mov rcx, rdi
call fcn.140032cf0
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140052d40
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea rdx, str.Thread::Start
lea rcx, [rsp + 0x58]
call fcn.14001eec0
nop
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call fcn.14001f880
nop
lea rdx, str.CreateThreadfailed__error
mov rcx, rax
call fcn.140025d80
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140031ae0
mov rcx, rax
call fcn.1400331b0
mov rcx, rax
call fcn.140030c70
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140032f80
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.14001f900
lea rdx, [0x14009a430]
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14004b750
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x14009e038]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rdi, [rcx + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x1400838f0]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14004b78d
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14004b7b8
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140052d40
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret
lea rcx, [rsp + 0xd0]
call fcn.14001f810
nop
lea rdx, str.Error_when_deleting_file:
mov rcx, rax
call fcn.140025d80
mov rbx, rax
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1400251b0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14001fa60
nop
mov rdx, rax
mov rcx, rbx
call fcn.14003d6d0
lea rdx, str.Last_error:
mov rcx, rax
call fcn.140025d80
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140031ae0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14001f900
lea rdx, [0x14009a430]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14004b850
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x14009e038]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [0x1400838f0]
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14004b894
mov rdx, qword [rsi]
lea rcx, [rdi + 8]
cmp qword [rdi + 0x20], 8
jb 0x14004b8a3
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14004b8d2
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140052d40
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, [rsp + 0x110]
call fcn.14001f810
nop
mov rcx, rax
call fcn.14004c400
mov rbx, rax
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x28]
call fcn.1400251b0
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14001fa60
nop
mov rdx, rax
mov rcx, rbx
call fcn.14003d6d0
mov rcx, rax
call fcn.14004c630
mov rbx, rax
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.1400251b0
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.14001fa60
nop
mov rdx, rax
mov rcx, rbx
call fcn.14003d6d0
lea rdx, str.Last_error:
mov rcx, rax
call fcn.140025d80
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140031ae0
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.14001f900
lea rdx, [0x14009a430]
lea rcx, [rsp + 0xb0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14004ba20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x14009e038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x40], 0
test rdx, rdx
je 0x14004baad
mov edx, 0xc0000004
mov r9d, 2
call fcn.14004b490
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8d, esi
mov rdx, rbx
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14004bae8
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.Invalid_data_passed
lea rcx, [rsp + 0x48]
call fcn.14001eec0
nop
mov dword [rsp + 0x40], 1
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.140033f30
lea rdx, [0x14009a788]
lea rcx, [rsp + 0x68]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [rsp + 0x100]
call fcn.14001f810
nop
mov rcx, rax
call fcn.14004c860
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.14004bfa0
lea rdx, str._bytes_to_file
mov rcx, rax
call fcn.140025d80
mov rbx, rax
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x48]
call fcn.1400251b0
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14001fa60
nop
mov rdx, rax
mov rcx, rbx
call fcn.14003d6d0
lea rdx, str.Last_error:
mov rcx, rax
call fcn.140025d80
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140031ae0
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14001f900
lea rdx, [0x14009a430]
lea rcx, [rsp + 0xa0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14004bba0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x14009e038]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x30], 0
test rdx, rdx
je 0x14004bc5e
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400838f0]
cmp eax, ebx
jb 0x14004bd2e
mov rax, qword [rdi + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14004bc09
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [0x1400838f0]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rdi
call fcn.14004b490
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8d, ebx
mov rdx, rsi
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004bc99
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140052d40
add rsp, 0x170
pop rdi
pop rsi
pop rbx
ret
lea rdx, str.Invalid_data_passed
lea rcx, [rsp + 0x40]
call fcn.14001eec0
nop
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140033f30
lea rdx, [0x14009a788]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [rsp + 0x100]
call fcn.14001f810
nop
lea rdx, str.Error_when_reading_file
mov rcx, rax
call fcn.140025d80
mov rbx, rax
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x40]
call fcn.1400251b0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14001fa60
nop
mov rdx, rax
mov rcx, rbx
call fcn.14003d6d0
lea rdx, str.Last_error:
mov rcx, rax
call fcn.140025d80
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140031ae0
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14001f900
lea rdx, [0x14009a430]
lea rcx, [rsp + 0xa0]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rdx, str.Invalid_size_passed
lea rcx, [rsp + 0x40]
call fcn.14001eec0
nop
mov dword [rsp + 0x30], 2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140033f30
lea rdx, [0x14009a788]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3