joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007a220
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x30], 0
jne 0x14007a2c5
lea rsi, [0x1402e0728]
mov qword [rsp + 0x20], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x28], 1
cmp qword [0x1402e0720], 0
jne 0x14007a278
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [0x1402e0770]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
call qword [case.0x140047d56.0]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
mov rcx, qword [0x1402e0720]
mov rbx, qword [rcx + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rbx, rdi
je 0x14007a2c5
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14007d4c0
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1402d7d18]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
mov rcx, qword [0x1402e0770]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x140047d56.0]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x58], rcx
lea r14, vtable.SqliteStatement.0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x30], ecx
add rax, 0x10
mov qword [rsp + 0x38], rax
lea rdx, str.SELECT_PIN_ACTION_FROM_PINNED_APPLICATIONS_WHERE_FILE_ID___file_id
mov qword [rsp + 0x40], rdx
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x58], cl
lea r8d, [rcx + 6]
lea rcx, [0x14028bee0]
call fcn.1400e3d60
movzx ecx, byte [rsp + 0x58]
mov edx, 1
test eax, eax
cmove ecx, edx
mov byte [rsp + 0x58], cl
lea rax, vtable.TransactionSafeStatement.0
mov qword [rsp + 0x28], rax
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.14002ab40
mov ebx, eax
test eax, eax
jne 0x14007d594
lea rcx, [rsp + 0x28]
call fcn.14002afd0
mov ebx, eax
lea rsi, [0x1402daa50]
cmp ebx, 0x64
jne 0x14007d5e2
lea r8, [rsp + 0x20]
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.14002ae60
mov edi, eax
test eax, eax
je 0x14007d5de
mov ebx, eax
mov rcx, qword [0x1402daa50]
cmp rcx, rsi
je 0x14007d61c
test dword [rcx + 0x44], 0x20000
je 0x14007d61c
cmp byte [rcx + 0x41], 2
jb 0x14007d61c
mov edx, 0x12
mov r9d, eax
jmp 0x14007d605
xor ebx, ebx
jmp 0x14007d615
mov rcx, qword [0x1402daa50]
cmp rcx, rsi
je 0x14007d61c
test dword [rcx + 0x44], 0x20000
je 0x14007d61c
cmp byte [rcx + 0x41], 2
jb 0x14007d61c
mov edx, 0x13
mov r9d, ebx
lea r8, [0x14025f878]
mov rcx, qword [rcx + 0x38]
call fcn.140038540
mov rcx, qword [0x1402daa50]
mov edi, dword [rsp + 0x20]
cmp edi, 3
jbe 0x14007d657
cmp rcx, rsi
je 0x14007d651
test dword [rcx + 0x44], 0x20000
je 0x14007d651
cmp byte [rcx + 0x41], 2
jb 0x14007d651
mov edx, 0x14
mov r9d, ebx
lea r8, [0x14025f878]
mov rcx, qword [rcx + 0x38]
call fcn.140038540
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.14002b150
nop
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140154660
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14007fe60
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 0x410]
xorps xmm0, xmm0
mov qword [rsp + 0x38], rbp
mov rsi, rcx
mov qword [rsp + 0x40], rdi
mov rbp, rdx
mov qword [rsp + 0x48], r14
xor r14d, r14d
mov rdi, qword [rcx + rax*8 + 0x418]
mov qword [rdi], r14
mov dword [rdi + 8], r14d
mov qword [rdi + 0x28], r14
movups xmmword [rdi + 0x18], xmm0
mov rcx, qword [rdi + 0x2c0]
mov dword [rdi + 0x248], 4
mov word [rdi + 0x48], r14w
mov qword [rdi + 0x2c0], r14
test rcx, rcx
je 0x14007fedc
mov qword [rsp + 0x30], rbx
mov rbx, qword [rcx + 0x40]
call fcn.1400e4e18
mov rcx, rbx
test rbx, rbx
jne 0x14007fec6
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + 0x280]
mov qword [rdi + 0x268], r14
mov qword [rdi + 0x2e0], rax
mov rdx, rbp
mov qword [rax + 0x40], r14
mov dword [rax + 0x48], r14d
mov dword [rax + 0x4c], 1
mov dword [rdi + 0x270], r14d
mov qword [rax], 0xffffffffffffffff
mov qword [rax + 8], 0xffffffffffffffff
mov qword [rax + 0x10], 0xffffffffffffffff
mov qword [rax + 0x18], 0xffffffffffffffff
mov qword [rax + 0x20], 0xffffffffffffffff
mov qword [rax + 0x28], 0xffffffffffffffff
mov qword [rax + 0x30], 0xffffffffffffffff
mov qword [rax + 0x38], 0xffffffffffffffff
mov r8, qword [rsi + 0x410]
mov rcx, qword [rsi + 8]
mov r8, qword [rsi + r8*8 + 0x418]
call fcn.1400c1b90
mov r14, qword [rsp + 0x48]
test eax, eax
mov rax, qword [rsi + 0x410]
mov rdi, qword [rsp + 0x40]
sete cl
mov byte [rsi + rax + 0x818], cl
mov rax, qword [rsi + 0x410]
mov qword [rsi + rax*8 + 0x10], rbp
inc qword [rsi + 0x410]
mov rcx, qword [rsi + 0x410]
mov rax, qword [section..data]
mov rbp, qword [rsp + 0x38]
cmp rcx, rax
jb 0x14007ffb6
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14007f450
add rsp, 0x20
pop rsi
ret

Function at 0x140082070
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + 8]
mov rdi, rdx
test rsi, rsi
je 0x1400820db
lea rbx, [rdx + 8]
test rbx, rbx
je 0x1400820db
cmp byte [rcx + 0x4c], 0
je 0x1400820db
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1400820db
cmp byte [rdi + 0x4c], 0
je 0x1400820db
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1400820db
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140085860
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov esi, r9d
mov rbp, r8
mov rbx, rcx
mov qword [rcx], rdx
mov byte [rcx + 8], 0
movzx eax, byte [rsp + 0x60]
mov byte [rcx + 9], al
mov qword [rcx + 0x10], 0
movzx eax, byte [rsp + 0x68]
mov byte [rcx + 0x20], al
mov qword [rcx + 0x28], r8
mov dword [rcx + 0x30], r9d
lea r9, [0x14025f970]
mov r8d, esi
mov rdx, rbp
call fcn.1400bfee0
mov rcx, qword [0x1402e0770]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
call qword [case.0x140047d56.0]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x1400858fb
xor r8d, r8d
lea rdx, str.Retrieving_thread_context_failed._Queuing
mov rcx, rbx
call fcn.1400bfe70
jmp 0x1400859ff
mov edi, 0x65
lea r14, [0x1402e0728]
mov qword [rsp + 0x20], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x28], 1
cmp byte [rbx + 9], 0
je 0x140085949
mov rax, qword [0x1402e0718]
test rax, rax
jne 0x14008593c
mov qword [0x1402e0710], rbx
mov qword [0x1402e0718], rbx
jmp 0x140085969
mov qword [rax + 0x10], rbx
mov qword [0x1402e0718], rbx
jmp 0x140085969
mov rax, qword [0x1402e0708]
test rax, rax
jne 0x14008595e
mov qword [0x1402e0700], rbx
jmp 0x140085962
mov qword [rax + 0x10], rbx
mov qword [0x1402e0708], rbx
mov rax, qword [0x1402e06e0]
inc rax
mov qword [0x1402e06e0], rax
cmp byte [0x1402e06f8], 0
jne 0x14008598d
mov rcx, rbx
call fcn.14007fd90
mov edi, eax
mov byte [rsp + 0x28], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, 0x65
je 0x1400859b2
mov r8d, edi
lea rdx, str.Begin
mov rcx, rbx
call fcn.1400bfe70
lea r9, str.WAITTING
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1400bfee0
mov rcx, qword [rbx + 0x18]
mov edx, 0xffffffff
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r9, str.ENTERED
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call fcn.1400bfee0
mov rax, qword [0x1402e06f0]
inc rax
mov qword [0x1402e06f0], rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140089780
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rsp + 0x28], rcx
lea rax, vtable.Component.0
mov qword [rcx], rax
mov dword [rcx + 8], 0xffffffff
xor esi, esi
mov dword [rcx + 0xc], esi
mov qword [rcx + 0x18], rdx
lea rax, [r8 + 0x98]
test r8, r8
cmove rax, rsi
mov qword [rcx + 0x20], rax
lea rax, vtable.PinningController.0
mov qword [rcx], rax
lea rax, vtable.PinningController.1.0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x28], r8
mov qword [rcx + 0x30], rsi
mov qword [rcx + 0x38], rdx
lea rbx, [rcx + 0x40]
mov qword [rsp + 0x20], rbx
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
lfence
lea ecx, [rsi + 0x50]
call fcn.14015450c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rcx, [rbx + 0x10]
mov edx, 0x80000400
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
lea rax, str.pinning_sequence_number
mov qword [rdi + 0x78], rax
mov qword [rdi + 0x80], rsi
mov rax, qword [rdi + 0x38]
add rax, 0x10
lea rcx, vtable.SqliteStatement.0
mov qword [rdi + 0x88], rcx
mov dword [rdi + 0x90], esi
mov qword [rdi + 0x98], rax
lea rdx, str._SELECT_SUM_VALUE_________SELECT_VALUE_FROM_STATISTICS_WHERE_ID__1_________SELECT_SUM_CLUSTERS__FROM_SEGMENTS_WHERE______________FILE_ID__0xFFFFFF___32__OR_______________FILE_ID_IN__SELECT_FILE_ID_FROM_SYSTEM_FILES____AND___________SEGMENT_ID__0_____FROM_STATISTICS__WHERE_ID__6_OR_ID__7
mov qword [rdi + 0xa0], rdx
mov qword [rdi + 0xa8], rsi
mov qword [rdi + 0xb0], rsi
mov byte [rdi + 0xb8], sil
lea r8d, [rsi + 6]
lea rcx, [0x14028bee0]
call fcn.1400e3d60
test eax, eax
jne 0x140089895
mov byte [rdi + 0xb8], 1
lea rax, vtable.TransactionSafeStatement.0
mov qword [rdi + 0x88], rax
mov edx, 0x80000400
lea rcx, [rdi + 0xc0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov qword [rdi + 0xe8], rsi
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400925a0
Capabilities:
Listen for remote procedure calls

Disassembly:
sub rsp, 0x28
mov r8d, 1
mov edx, 0x4d2
mov ecx, r8d
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
test eax, eax
jne 0x1400925c1
add rsp, 0x28
ret
mov rcx, qword [0x1402daa50]
lea rdx, [0x1402daa50]
cmp rcx, rdx
je 0x1400925fb
test dword [rcx + 0x44], 0x400000
je 0x1400925fb
cmp byte [rcx + 0x41], 2
jb 0x1400925fb
mov rcx, qword [rcx + 0x38]
lea r8, [0x140261900]
mov edx, 0x1a
mov r9d, eax
call fcn.140026620
mov eax, 0x1f
add rsp, 0x28
ret
Function at 0x1400a1c50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1402d7d18]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov qword [rsp + 0x30], 0
mov rdx, qword [rcx]
lea rax, [rsp + 0x30]
mov rsi, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400a1ce5
mov rdx, qword [rsi + 8]
xor r9d, r9d
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x3c], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a1ce5
mov eax, dword [rsp + 0x38]
mov dword [rdi], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140154660
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400a1fd0
Capabilities:
Set registry value

Disassembly:
jmp 0x1400a1fe0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402d7d18]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
lea rax, [rsp + 0x30]
mov rdx, qword [rcx]
mov rdi, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], 0
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400a205c
mov rdx, qword [rdi + 8]
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 4]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140154660
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400a1fe0
Capabilities:
Set registry value

Disassembly:
jmp 0x1400a1fe0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402d7d18]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], edx
lea rax, [rsp + 0x30]
mov rdx, qword [rcx]
mov rdi, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], 0
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400a205c
mov rdx, qword [rdi + 8]
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 4]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140154660
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400a3c30
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov rsi, rdx
mov rbp, rcx
xor edi, edi
mov dword [rsp + 0x78], edi
cmp qword [rdx + 8], rdi
jne 0x1400a3db8
lea r15, [0x1402daa50]
mov rcx, qword [0x1402daa50]
cmp rcx, r15
je 0x1400a3c8b
test byte [rcx + 0x44], 8
je 0x1400a3c8b
cmp byte [rcx + 0x41], 4
jb 0x1400a3c8b
lea edx, [rdi + 0x2e]
lea r8, [0x1402628d8]
mov rcx, qword [rcx + 0x38]
call fcn.140024250
rdtsc
shl rdx, 0x20
or rax, rdx
mov rbx, rax
lea rcx, [rbp + 0x6f0]
mov r8, r14
lea rdx, [rsp + 0x30]
call fcn.1400a0440
nop
mov rdx, rax
mov rcx, rsi
call fcn.1400341c0
nop
lea rcx, [rsp + 0x30]
call fcn.140034640
rdtsc
shl rdx, 0x20
or rax, rdx
lea rcx, [rbp + 0x568]
mov rdx, qword [rcx]
mov r9, qword [rdx + 0x38]
mov r8, rax
mov rdx, rbx
mov rax, r9
call qword [case.0x140047d56.0]
mov rcx, qword [0x1402daa50]
cmp rcx, r15
je 0x1400a3d3d
test byte [rcx + 0x44], 8
je 0x1400a3d3d
cmp byte [rcx + 0x41], 3
jb 0x1400a3d3d
mov rax, qword [rsi + 8]
mov qword [rsp + 0x88], rax
mov r9, qword [rsi]
mov qword [rsp + 0x78], r9
mov edi, 3
lea edx, [rdi + 0x2c]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea r8, [0x1402628d8]
mov rcx, qword [rcx + 0x38]
call fcn.140025d90
mov rcx, qword [0x1402daa50]
test dil, 2
je 0x1400a3d57
and edi, 0xfffffffd
lea rcx, [rsp + 0x78]
call fcn.140034180
mov rcx, qword [0x1402daa50]
test dil, 1
je 0x1400a3d71
lea rcx, [rsp + 0x88]
call fcn.140034180
mov rcx, qword [0x1402daa50]
cmp qword [rsi + 8], 0
jne 0x1400a3db8
cmp rcx, r15
je 0x1400a3da2
test byte [rcx + 0x44], 8
je 0x1400a3da2
cmp byte [rcx + 0x41], 3
jb 0x1400a3da2
lea r9, [rbp + 0x10]
mov edx, 0x30
lea r8, [0x1402628d8]
mov rcx, qword [rcx + 0x38]
call fcn.14002a6f0
mov eax, 0x70
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a6410
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x60
mov rax, qword [0x1402d7d18]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
mov rsi, r8
mov rbp, rdx
mov r14, rcx
mov rax, qword [rax + 0x28]
call qword [case.0x140047d56.0]
test eax, eax
jne 0x1400a6546
mov ecx, dword [rsi]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r15
test ecx, ecx
je 0x1400a6524
xor r15d, r15d
cmp ecx, 6
jb 0x1400a657e
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], r15d
mov r8d, 6
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a64a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jne 0x1400a6583
jmp 0x1400a64ad
mov eax, dword [rsp + 0x38]
sub dword [rsi], eax
mov edx, dword [rsi]
mov r8d, dword [rsp + 0x32]
lea rcx, [rdx + 6]
cmp r8, rcx
ja 0x1400a6575
movzx ecx, word [rsp + 0x30]
lea eax, [r8 - 6]
sub edx, eax
mov dword [rsp + 0x3c], eax
mov dword [rsi], edx
call fcn.1400a88f0
mov rbx, rax
test rax, rax
je 0x1400a6575
mov rax, qword [rax]
lea r8, [rsp + 0x3c]
mov rdx, rbp
mov rcx, rbx
mov rax, qword [rax + 0x30]
call qword [case.0x140047d56.0]
mov edi, eax
test eax, eax
jne 0x1400a655c
mov rax, qword [r14 + 0x28]
test rax, rax
je 0x1400a6510
mov qword [rax + 0x18], rbx
jmp 0x1400a6514
mov qword [r14 + 0x20], rbx
mov qword [r14 + 0x28], rbx
mov eax, dword [rsi]
mov ecx, eax
test eax, eax
jne 0x1400a6465
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 8]
call qword [case.0x140047d56.0]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x98]
mov r15, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140154660
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x140047d56.0]
mov eax, edi
jmp 0x1400a6534
mov edi, 0xd
mov eax, edi
jmp 0x1400a6534
mov edi, 0x452
mov eax, edi
jmp 0x1400a6534

Function at 0x1400a6bb0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1402d7d18]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx + 0x30], 0
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
je 0x1400a6bde
mov eax, 0x4df
jmp 0x1400a6c47
mov ecx, dword [r8]
mov eax, 2
shr ecx, 1
inc ecx
mul rcx
mov qword [rdi + 0x38], rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400e59c0
mov qword [rdi + 0x30], rax
test rax, rax
jne 0x1400a6c14
mov eax, 0xe
jmp 0x1400a6c47
mov r8d, dword [rbx]
lea r9, [rsp + 0x30]
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a6c3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400a6c47
mov eax, dword [rsp + 0x30]
sub dword [rbx], eax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140154660
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a6c60
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov r9, r8
mov qword [rsp + 0x20], 0
mov r8d, dword [rcx + 0x38]
mov rax, rdx
mov rdx, qword [rcx + 0x30]
mov rcx, rax
lea r8d, [r8*2 + 2]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400a6c9b
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400a7370
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1402d7d18]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rax, rdx
mov dword [rsp + 0x30], r8d
lea rdx, [rcx + 0x30]
mov qword [rsp + 0x20], r8
mov rcx, rax
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a73cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140154660
add rsp, 0x40
pop rbx
ret
mov eax, dword [rsp + 0x30]
sub dword [rbx], eax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140154660
add rsp, 0x40
pop rbx
ret

Function at 0x1400a73f0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rax, rdx
mov qword [rsp + 0x20], 0
lea rdx, [rcx + 0x30]
mov r9, r8
mov rcx, rax
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400a7425
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add rsp, 0x38
ret
Function at 0x1400a7bd0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1402d7d18]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp dword [r8], 6
mov rsi, r8
mov rbp, rdx
mov r14, rcx
jae 0x1400a7c06
mov ebx, 0x452
mov eax, ebx
jmp 0x1400a7dcb
xor r15d, r15d
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x3c]
mov dword [rsp + 0x38], r15d
mov rcx, rbp
mov qword [rsp + 0x20], r15
lea r8d, [r15 + 6]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a7c3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
je 0x1400a7c45
jmp 0x1400a7dcb
mov eax, dword [rsp + 0x38]
sub dword [rsi], eax
mov edx, dword [rsp + 0x3c]
cmp dx, 0xc
jne 0x1400a7dc6
mov ecx, dword [rsi]
mov eax, dword [rsp + 0x3e]
add rcx, 6
cmp rax, rcx
ja 0x1400a7dc6
movzx eax, word [rsp + 0x40]
mov r8, rsi
mov dword [r14 + 0x12], edx
mov rcx, r14
mov word [r14 + 0x16], ax
mov rdx, rbp
mov rax, qword [r14]
mov rax, qword [rax + 0x28]
call qword [case.0x140047d56.0]
mov ebx, eax
test eax, eax
jne 0x1400a7d7f
mov ecx, dword [rsi]
mov qword [rsp + 0x98], rdi
test ecx, ecx
je 0x1400a7d65
cmp ecx, 6
jb 0x1400a7db5
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], r15d
mov r8d, 6
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a7ce8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x1400a7d77
jmp 0x1400a7cee
mov eax, dword [rsp + 0x38]
sub dword [rsi], eax
mov edx, dword [rsi]
mov r8d, dword [rsp + 0x32]
lea rcx, [rdx + 6]
cmp r8, rcx
ja 0x1400a7da4
movzx ecx, word [rsp + 0x30]
lea eax, [r8 - 6]
sub edx, eax
mov dword [rsp + 0x44], eax
mov dword [rsi], edx
call fcn.1400a88f0
mov rdi, rax
test rax, rax
je 0x1400a7da4
mov rcx, qword [rax]
lea r8, [rsp + 0x44]
mov rdx, rbp
mov rax, qword [rcx + 0x30]
mov rcx, rdi
call qword [case.0x140047d56.0]
mov ebx, eax
test eax, eax
jne 0x1400a7d83
mov rax, qword [r14 + 0x28]
test rax, rax
je 0x1400a7d51
mov qword [rax + 0x18], rdi
jmp 0x1400a7d55
mov qword [r14 + 0x20], rdi
mov qword [r14 + 0x28], rdi
mov eax, dword [rsi]
mov ecx, eax
test eax, eax
jne 0x1400a7ca6
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 8]
call qword [case.0x140047d56.0]
mov ebx, eax
mov rdi, qword [rsp + 0x98]
mov eax, ebx
jmp 0x1400a7dcb
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x140047d56.0]
mov rdi, qword [rsp + 0x98]
mov eax, ebx
jmp 0x1400a7dcb
mov rdi, qword [rsp + 0x98]
mov ebx, 0xd
mov eax, ebx
jmp 0x1400a7dcb
mov rdi, qword [rsp + 0x98]
mov ebx, 0x452
mov eax, ebx
jmp 0x1400a7dcb
mov eax, 0xd
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140154660
add rsp, 0x50
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400a8120
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rax, rdx
mov qword [rsp + 0x20], 0
lea rdx, [rcx + 0x30]
mov r9, r8
mov rcx, rax
mov r8d, 0x10
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400a8155
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add rsp, 0x38
ret