joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call fcn.14012c000
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14000caf0
add rsp, 0x28
jmp 0x14000c43c
Function at 0x14000aa08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000aa52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000aa52
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000aa52
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000aa52
cmp dword [rcx + 0x84], 0xe
jbe 0x14000aa52
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000aa54
xor al, al
add rsp, 0x28
ret
Function at 0x140005860
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
xor eax, eax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
xor ebx, ebx
mov dword [rbp - 0x20], ebx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x38], rbx
lea rax, [rbp - 0x38]
mov qword [r11 - 0x68], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesMBVpnTunnelServiceParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005a29
mov r14, qword [rbp - 0x38]
mov qword [rbp - 0x28], r14
mov dword [rbp - 0x20], ebx
mov dword [rbp - 0x30], ebx
mov dword [rbp - 0x2c], 4
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
xor r8d, r8d
lea rdx, str.DriverType
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000592a
cmp dword [rbp - 0x38], 4
jne 0x14000592a
mov eax, dword [rbp - 0x30]
mov dword [rdi], eax
mov r15b, 1
jmp 0x14000592d
xor r15b, r15b
mov dword [rbp - 0x30], ebx
mov dword [rbp - 0x38], 4
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
lea rdx, str.LogCount
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005976
cmp dword [rbp - 0x2c], 4
jne 0x140005976
movzx eax, byte [rbp - 0x30]
mov byte [rdi + 8], al
mov sil, 1
jmp 0x140005979
xor sil, sil
and sil, r15b
mov dword [rbp - 0x30], ebx
mov dword [rbp - 0x38], 4
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
lea rdx, str.LogLevel
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400059c1
cmp dword [rbp - 0x2c], 4
jne 0x1400059c1
mov eax, dword [rbp - 0x30]
mov dword [rdi + 4], eax
jmp 0x1400059c4
xor sil, sil
mov dword [rbp - 0x30], ebx
mov dword [rbp - 0x38], 4
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
lea rdx, str.LogSize
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005a0b
cmp dword [rbp - 0x2c], 4
jne 0x140005a0b
mov eax, dword [rbp - 0x30]
mov dword [rdi + 0xc], eax
mov al, 1
jmp 0x140005a0d
xor al, al
and sil, al
lea r9, [rdi + 0x10]
lea rdx, [rbp - 0x28]
call fcn.140005a70
movzx edi, al
and dil, sil
mov rbx, qword [rbp - 0x28]
jmp 0x140005a2c
xor dil, dil
test rbx, rbx
je 0x140005a3a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14018e2d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140005a70
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbp, r9
mov rsi, rdx
xor r14d, r14d
mov dword [r11 - 0x40], r14d
lea rax, [r11 - 0x40]
mov qword [r11 - 0x70], rax
mov qword [r11 - 0x78], r14
lea r9, [r11 - 0x3c]
xor r8d, r8d
lea rdx, str.LogPath
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005c2e
mov eax, dword [rsp + 0x5c]
dec eax
cmp eax, 1
ja 0x140005c2e
mov ebx, dword [rsp + 0x58]
shr ebx, 1
je 0x140005c2e
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov word [rsp + 0x58], r14w
mov edx, ebx
lea r8, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140007f00
nop
mov rdi, qword [rsp + 0x60]
lea eax, [rbx + rbx]
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, str.LogPath
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005b7a
mov eax, dword [rsp + 0x5c]
dec eax
cmp eax, 1
ja 0x140005b7a
mov ecx, dword [rsp + 0x58]
test rdi, rdi
je 0x140005bc7
test ecx, ecx
je 0x140005bc3
test cl, 1
jne 0x140005b7a
mov eax, ecx
shr rax, 1
cmp word [rdi + rax*2 - 2], r14w
je 0x140005bc7
xor bl, bl
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140005bbe
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c5b
call fcn.14018e2f4
movzx eax, bl
jmp 0x140005c30
mov word [rdi], r14w
shr ecx, 1
je 0x140005b7a
lea r8d, [rcx - 1]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.14000e750
mov rdx, rax
mov rcx, rbp
call fcn.140004de0
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140005c27
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c55
call fcn.14018e2f4
mov bl, 1
jmp 0x140005b7c
xor al, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14018e2d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1401997dc
nop
call fcn.1401997dc
int3
Function at 0x140012e10
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r9
mov r9, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rcx
movzx edx, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [r8 + 1]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8 + 2]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8 + 3]
xor rdx, rax
imul rdx, rcx
mov r8, qword [rsi + 0x30]
and r8, rdx
mov rbx, qword [rsi + 8]
mov rax, r8
add rax, rax
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rdx + rax*8]
cmp rbx, rcx
je 0x140012ef9
mov rbx, qword [rdx + rax*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rcx
je 0x140012ef9
mov rbx, qword [rbx + 8]
mov eax, dword [rbx + 0x10]
cmp dword [r9], eax
jne 0x140012eb2
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi]
mov qword [rdx], rcx
mov rdx, qword [rdi]
mov rcx, qword [rdi + 8]
mov qword [rdx + 8], rcx
dec qword [rsi + 0x10]
mov edx, 0x18
mov rcx, rdi
call fcn.14018e2f4
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14001302b
mov qword [rsp + 0x40], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140012f33
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
add r8, r8
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140012f53
mov qword [rdx + r8*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140012f82
cmp rax, rbx
jne 0x140012f5e
mov qword [rdx + r8*8], rdi
jmp 0x140012f82
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140012f82
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140288fa0]
test rax, rax
jns 0x140012fa3
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x140012fb4
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140013020
cmp rdx, 0x200
jae 0x140012fd0
lea rdx, [rdx*8]
jmp 0x140012fe2
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140012fe2
add rdx, rdx
mov rcx, rsi
call fcn.140011e10
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140013020
mov r15, qword [rax + 8]
nop word [rax + rax]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140012e10
cmp rbx, r15
jne 0x140013000
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14018e2d0
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400131b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov r9, rcx
movzx edx, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [r8 + 0x11]
mov r10, qword [r9 + 0x30]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x12]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0x13]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r9 + 0x18]
and r10, rdx
shl r10, 4
add rcx, r10
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x140013244
cmp rax, r8
jne 0x14001323a
mov rax, qword [r9 + 8]
mov qword [rcx], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
mov qword [r10 + rcx + 8], rax
jmp 0x14001324f
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x14001324f
cmp rax, r8
jne 0x14001324f
mov rax, qword [r8]
mov qword [rcx], rax
mov rcx, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rcx], rbx
mov rdx, qword [r8]
mov rcx, qword [r8 + 8]
mov qword [rdx + 8], rcx
mov edx, 0x18
dec qword [r9 + 0x10]
mov rcx, r8
call fcn.14018e2f4
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140018510
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r9, r8
mov r10, qword [rdx]
mov qword [rsp + 0x20], r9
mov rcx, r10
xor r9d, r9d
mov rdx, qword [rax]
mov r8, qword [rax + 8]
sub r8, rdx
call qword [sym.imp.KERNEL32.dll_ReadFile]
add rsp, 0x38
ret

Function at 0x140018540
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [rdx]
mov rdx, qword [rcx + 8]
cmp qword [rdx + 0x18], 0x10
mov rcx, qword [rdx + 0x10]
jb 0x140018559
mov rdx, qword [rdx]
mov qword [rsp + 0x20], r8
xor r9d, r9d
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x38
ret

Function at 0x140018580
Capabilities:
Connect pipe

Disassembly:
sub rsp, 0x28
mov rcx, qword [rdx]
mov rdx, r8
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1400185a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x1400185a8
xor eax, eax
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
Function at 0x14003fa70
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x100
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rbp - 1], rax
mov r12d, r9d
movzx r9d, r8w
mov r8, rdx
mov r15d, dword [rbp + 0x67]
mov r14d, dword [rbp + 0x6f]
mov rsi, qword [rbp + 0x77]
mov rbx, qword [rbp + 0x7f]
mov r11d, dword [rbp + 0x87]
mov r10d, dword [rbp + 0x8f]
mov rdx, qword [rbp + 0x97]
mov rax, qword [rbp + 0x9f]
mov rdi, qword [rcx]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rdx
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r12d
lea rdx, [rbp - 0x41]
call qword [rdi + 0x50]
nop
movdqa xmm0, xmmword [0x140288fb0]
movdqu xmmword [rbp - 0x59], xmm0
xor ebx, ebx
mov word [rbp - 0x69], bx
lea rdx, [0x14027c380]
lea rcx, [rbp - 0x69]
call fcn.140003570
nop
movdqa xmm0, xmmword [0x140288fb0]
movdqu xmmword [rbp - 0x79], xmm0
mov word [rsp + 0x70], bx
lea rdx, [0x14027705c]
lea rcx, [rsp + 0x70]
call fcn.140003570
nop
movdqa xmm0, xmmword [0x140288fb0]
movdqu xmmword [rbp - 0x11], xmm0
mov word [rbp - 0x21], bx
lea r9, [rbp - 0x69]
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x41]
call fcn.14001a2b0
lea rcx, [rbp - 0x41]
call fcn.140003950
movups xmm0, xmmword [rbp - 0x21]
movups xmmword [rbp - 0x41], xmm0
movups xmm1, xmmword [rbp - 0x11]
movups xmmword [rbp - 0x31], xmm1
mov rdx, qword [rbp - 0x71]
cmp rdx, 8
jb 0x14003fbd4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003fbcf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fc9b
call fcn.14018e2f4
movdqa xmm0, xmmword [0x140288fb0]
movdqu xmmword [rbp - 0x79], xmm0
mov word [rsp + 0x70], bx
mov rdx, qword [rbp - 0x51]
cmp rdx, 8
jb 0x14003fc26
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003fc21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fca1
call fcn.14018e2f4
lea rcx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14003fc77
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003fc72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fc95
call fcn.14018e2f4
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.14018e2d0
add rsp, 0x100
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401997dc
nop
call fcn.1401997dc
nop
call fcn.1401997dc
int3
Function at 0x1400423d0
Capabilities:
Get process image filename

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, rcx
mov qword [rbp + 7], rcx
xor r12d, r12d
mov dword [rbp - 0x45], r12d
lea rax, vtable.ExecutablePathSingleton.0
mov qword [rcx], rax
lea rsi, [rcx + 8]
mov qword [rsi + 0x10], r12
mov r14d, 7
mov qword [rsi + 0x18], r14
mov word [rsi], r12w
xor eax, eax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov word [rbp - 0x49], r12w
lea r8, [rbp - 0x49]
mov edx, 0x9c40
lea rcx, [rbp + 0xf]
call fcn.140007f00
nop
mov rbx, qword [rbp + 0x17]
mov rdi, qword [rbp + 0xf]
sub rbx, rdi
sar rbx, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
movdqa xmm0, xmmword [0x140288fb0]
movdqu xmmword [rbp - 0x31], xmm0
mov word [rbp - 0x41], r12w
mov dword [rbp - 0x45], 1
movdqu xmmword [rbp - 0x11], xmm0
mov word [rbp - 0x21], r12w
mov rdx, qword [rbp + 0xf]
lea rcx, [rbp - 0x21]
call fcn.140003570
nop
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x21]
call fcn.1400461b0
nop
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x1400424fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400424f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400425e2
call fcn.14018e2f4
movdqa xmm0, xmmword [0x140288fb0]
movdqu xmmword [rbp - 0x11], xmm0
mov word [rbp - 0x21], r12w
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x14004254d
mov rax, qword [rbp + 0x1f]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042548
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400425e8
call fcn.14018e2f4
lea rax, [rbp - 0x41]
cmp rsi, rax
je 0x140042574
mov rcx, rsi
call fcn.140003950
movups xmm0, xmmword [rbp - 0x41]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x31]
movups xmmword [rsi + 0x10], xmm1
mov word [rbp - 0x41], r12w
jmp 0x140042578
mov r14, qword [rbp - 0x29]
cmp r14, 8
jb 0x1400425b1
lea rdx, [r14*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400425ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400425dc
call fcn.14018e2f4
nop
mov rax, r15
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14018e2d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1401997dc
nop
call fcn.1401997dc
nop
call fcn.1401997dc
int3
Function at 0x140045880
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r8
mov rdi, rdx
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140045968
test rbx, rbx
je 0x140045964
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140052fb0
nop
cmp qword [rax + 0x18], 8
jb 0x1400458e2
mov rax, qword [rax]
mov r10, qword [rbx]
mov qword [rsp + 0x38], rax
lea rax, str.Error_getting_file_size_:__s
mov qword [rsp + 0x30], rax
lea rax, str.FileStreamUtils
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x97
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_filestreamutils_win32.cpp
lea rdx, str.mb::common::io::FileStreamUtils::GetFileSize
mov rcx, rbx
call qword [r10 + 0x20]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140045964
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004595f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140045990
call fcn.14018e2f4
xor al, al
jmp 0x140045972
mov rax, qword [rsp + 0x68]
mov qword [rdi], rax
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14018e2d0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
call fcn.1401997dc
int3
Function at 0x1400459a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x88
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov edi, r8d
test rdx, rdx
je 0x140045aa2
test r8d, r8d
je 0x140045aa2
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400459fc
cmp dword [rsp + 0x68], edi
je 0x140045ae4
test rbx, rbx
je 0x140045a9e
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140052fb0
nop
cmp qword [rax + 0x18], 8
jb 0x140045a1c
mov rax, qword [rax]
mov r10, qword [rbx]
mov qword [rsp + 0x38], rax
lea rax, str.Error_writting_to_file_:__s
mov qword [rsp + 0x30], rax
lea rcx, str.FileStreamUtils
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9d, 0xbb
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_filestreamutils_win32.cpp
lea rdx, str.mb::common::io::FileStreamUtils::Write
mov rcx, rbx
call qword [r10 + 0x20]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140045a9e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045a99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140045afd
call fcn.14018e2f4
xor al, al
jmp 0x140045ae6
test rbx, rbx
je 0x140045ae4
mov rax, qword [r9]
lea rcx, str.Skipping_writting_zero_byte_buffer__this_may_be_an_empty_file_
mov qword [rsp + 0x30], rcx
lea rcx, str.FileStreamUtils
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9d, 0xb3
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_filestreamutils_win32.cpp
lea rdx, str.mb::common::io::FileStreamUtils::Write
mov rcx, rbx
call qword [rax + 0x20]
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14018e2d0
add rsp, 0x88
pop rdi
pop rbx
ret
call fcn.1401997dc
int3