joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3b29b1ec0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x3b29b4220]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x3b29b1edf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x3b29b1ee8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x3b29b1edf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x3b29b1f00
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x3b29b4220]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x3b29b1f20
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x3b29b1f28
ret
cmp word [rdx + 0x18], 0x20b
jne 0x3b29b1f20
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x3b29b1f70
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x3b29b1f67
test rcx, rcx
je 0x3b29b1f20
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x3b29b1f58
xor eax, eax
ret

Function at 0x3b29b1f80
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x3b29b4220]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x3b29b1f9f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x3b29b1fa8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x3b29b1fc0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x3b29b4220]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x3b29b1fe0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x3b29b1fe8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3b29b1fe0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x3b29b1fe0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x3b29b2034
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x3b29b2040
add rdx, 0x28
cmp rdx, r9
jne 0x3b29b2020
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x3b29b2050
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x3b29b4220]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x3b29b2072
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x3b29b2080
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x3b29b2072
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x3b29b2072
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x3b29b2072
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x3b29b20d5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x3b29b20e8
add rdx, 0x28
cmp r10, rdx
jne 0x3b29b20c0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x3b29b20f7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x3b29b2107
mov edx, dword [rax + 0xc]
test edx, edx
je 0x3b29b20de
test ecx, ecx
jg 0x3b29b20f0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x14000a250
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x14000a272
xor eax, eax
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x14000a2fe
lfence
mov rdi, rbp
nop dword [rax]
mov rcx, rbx
call fcn.140005990
test rax, rax
jle 0x14000a2ce
cmp rdi, rax
mov rsi, rdi
mov rcx, r14
cmovge rsi, rax
mov rax, qword [rbx + 0x38]
mov r8, rsi
mov rdx, qword [rax]
call fcn.14006d860
mov rax, qword [rbx + 0x50]
sub rdi, rsi
sub dword [rax], esi
mov rcx, qword [rbx + 0x38]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14000a2ee
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x14000765d.0]
cmp eax, 0xffffffff
je 0x14000a2f6
mov byte [r14], al
dec rdi
mov esi, 1
add r14, rsi
test rdi, rdi
jg 0x14000a290
sub rbp, rdi
jmp 0x14000a3e8
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000a315
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000a317
xor ecx, ecx
movsxd rax, ecx
mov rdi, rbp
test ecx, ecx
je 0x14000a34c
cmp rax, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.14006d860
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
mov rdi, rsi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000a3e2
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000a387
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x14000a3c0
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.14007862c
sub rsi, rax
add r14, rax
mov rdi, rsi
cmp rax, 0xfff
jne 0x14000a3e2
cmp rsi, rax
ja 0x14000a390
test rdi, rdi
je 0x14000a3e2
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14007862c
mov rsi, rdi
sub rsi, rax
sub rbp, rsi
lfence
mov rsi, qword [rsp + 0x28]
mov rax, rbp
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
Function at 0x14000e820
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x1400ca010]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
cmp qword [rcx + 0x18], 8
jb 0x14000e852
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000ea6e
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0x60]
call fcn.14006d5d0
lea rcx, [rsp + 0x60]
call fcn.1400106d0
nop
lea rcx, [rsp + 0x28]
call fcn.14001f780
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14000e897
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140016960
lea rdx, [0x1400b1ffc]
mov rcx, rax
call fcn.140014050
lea rdx, str.installer_lib::Filesystem::is_directory
mov rcx, rax
call fcn.140014050
lea rdx, [0x1400b1fd0]
mov rcx, rax
call fcn.140013db0
lea rdx, str.Failed_to_determine_if
mov rcx, rax
call fcn.140013db0
mov rdx, rbx
mov rcx, rax
call fcn.1400143d0
lea rdx, [0x1400b2000]
mov rcx, rax
call fcn.140013db0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140010890
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000e951
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e94b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ea9a
call fcn.1400476c0
nop
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], di
mov dword [rsp + 0x20], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov rcx, qword [rsp + 0xe8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14000e9bd
mov rax, qword [rsp + 0xb8]
mov r8, qword [rax]
test r8, r8
je 0x14000e9bd
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0xe0]
cmovb r8, qword [rsp + 0xe0]
sub r8, rdx
sar r8, 1
jmp 0x14000ea00
test cl, 4
jne 0x14000e9f6
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000e9f6
mov rax, qword [rsp + 0x90]
mov rdx, qword [rax]
mov rax, qword [rsp + 0xc8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x14000ea00
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14000ea10
lea rcx, [rsp + 0x28]
call fcn.140012750
nop
mov edx, 0x28
lea rcx, [rsp + 0x28]
call fcn.14001fc60
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14000ea5f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ea59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eaa0
call fcn.1400476c0
nop
lea rcx, [rsp + 0x60]
call fcn.14000e3e0
nop
xor al, al
jmp 0x14000ea79
and eax, 0x410
cmp eax, 0x10
sete al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400476a0
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rdi
ret
call fcn.140076f90
int3
call fcn.140076f90
int3
Function at 0x14002f790
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1400ca010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x14002f8f2
cmp byte [rdx + 4], 0
je 0x14002f7ce
mov eax, dword [rcx]
cmp dword [rdx], eax
jl 0x14002f8f2
mov r9, r8
mov r8, rdx
lea rdx, str._H:_M:_S
lea rcx, [rbp + 0xf]
call fcn.14002f070
nop
mov dword [rbp + 7], 0
cmp byte [rbx + 0x10], 0
je 0x14002f891
lea rax, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rax, qword [rbp + 0xf]
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x1f]
mov qword [rbp - 1], rax
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x2f]
call fcn.140037a20
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rdx, qword [rbp + 0x2f]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0x3f]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rdx, qword [rbp + 0x47]
cmp rdx, 8
jb 0x14002f8bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f88a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f915
call fcn.1400476c0
jmp 0x14002f8bb
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rdx, qword [rbp + 0xf]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0x1f]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14002f8f2
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f8ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f90f
call fcn.1400476c0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400476a0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rbp
ret
call fcn.140076f90
nop
call fcn.140076f90
nop
int3
Function at 0x140030040
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1400ca010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, qword [r8]
mov r14, r9
mov rbp, qword [rsp + 0xe0]
mov rsi, rdx
mov r15, qword [rsp + 0xe8]
mov rbx, rcx
mov r12, qword [rsp + 0xf0]
test rdi, rdi
je 0x140030146
cmp qword [rdi + 8], 0xffffffffffffffff
je 0x140030146
cmp byte [rcx + 4], 0
je 0x1400300a9
mov eax, dword [rdi]
cmp dword [rcx], eax
jl 0x140030146
mov r9, rsi
lea rdx, str._FT_T
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.14002f070
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x68], 0xffffffffffffffff
cmp qword [rsp + 0x50], 0x10
mov dword [rsp + 0x30], eax
cmovae rdx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140030146
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030141
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003018e
call fcn.1400476c0
mov rcx, qword [r14]
test rcx, rcx
je 0x140030159
mov r8, rsi
mov rdx, rbx
call fcn.14002f510
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.140030f90
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400476a0
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140076f90
int3
Function at 0x140031cd0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1400ca010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r15, r8
mov rdi, rdx
mov rbp, rcx
mov qword [rsp + 0xb8], rcx
xor ebx, ebx
mov dword [rsp + 0xb8], ebx
mov rcx, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x140031d1c
mov rcx, qword [rdx]
lea rdx, [rsp + 0xb8]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov r14d, eax
test eax, eax
je 0x140031e5f
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
cmp r14, 0x1000
jb 0x140031d81
lea rcx, [r14 + 0x27]
cmp rcx, r14
jbe 0x140031e90
lfence
call fcn.140047968
mov rcx, rax
test rax, rax
je 0x140031e59
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140031d8c
lfence
mov rcx, r14
call fcn.140047968
mov qword [rsp + 0xa0], rax
lea rbx, [rax + r14]
mov qword [rsp + 0xb0], rbx
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.14006d5d0
mov qword [rsp + 0xa8], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x140031dbf
mov rdi, qword [rdi]
mov r9, qword [rsp + 0xa0]
mov r8d, r14d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x140031e96
mov r8, r15
mov rdx, qword [rsp + 0xa0]
mov rcx, rbp
call fcn.1400317c0
nop
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140031e2f
mov rdx, qword [rsp + 0xb0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031e2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031e59
call fcn.1400476c0
mov rax, rbp
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400476a0
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140076f90
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.1400314c0
nop
mov r8, rax
lea rdx, str.Failed_to_get_Version_resource_size:
lea rcx, [rsp + 0x40]
call fcn.14002a170
nop
mov rcx, rax
call fcn.140031790
nop
call fcn.140002c40
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1400314c0
nop
mov r8, rax
lea rdx, str.Failed_to_get_Version_resource_content:
lea rcx, [rsp + 0x80]
call fcn.14002a170
nop
mov rcx, rax
call fcn.140031790
int3
Function at 0x140031ed0
Capabilities:
Get file version info

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1400ca010]
xor rax, rsp
mov qword [rbp], rax
mov r12, r8
mov rdi, rdx
mov r14, rcx
mov qword [rbp - 8], rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140031f0f
mov rcx, qword [rdx]
lea rdx, [rbp - 8]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov r15d, eax
test eax, eax
je 0x1400320aa
xorps xmm0, xmm0
xor eax, eax
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
cmp r15, 0x1000
jb 0x140031f6a
lea rcx, [r15 + 0x27]
cmp rcx, r15
jbe 0x1400320da
lfence
call fcn.140047968
mov rcx, rax
test rax, rax
je 0x1400320e0
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140031f75
lfence
mov rcx, r15
call fcn.140047968
mov qword [rbp - 0x20], rax
lea rbx, [rax + r15]
mov qword [rbp - 0x10], rbx
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.14006d5d0
mov qword [rbp - 0x18], rbx
cmp qword [rdi + 0x18], 8
jb 0x140031f9c
mov rdi, qword [rdi]
mov r9, qword [rbp - 0x20]
mov r8d, r15d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1400320e6
mov r8, r12
mov rdx, qword [rbp - 0x20]
lea rcx, [rsp + 0x30]
call fcn.1400317c0
nop
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140031fd6
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.140037a20
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140032036
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032031
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032115
call fcn.1400476c0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140032083
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003207e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400320a4
call fcn.1400476c0
mov rax, r14
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400476a0
add rsp, 0x110
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140076f90
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1400314c0
nop
mov r8, rax
lea rdx, str.Failed_to_get_Version_resource_size:
lea rcx, [rbp - 0x80]
call fcn.14002a170
nop
mov rcx, rax
call fcn.140031790
nop
call fcn.140002c40
int3
call fcn.140076f90
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x60]
call fcn.1400314c0
nop
mov r8, rax
lea rdx, str.Failed_to_get_Version_resource_content:
lea rcx, [rbp - 0x40]
call fcn.14002a170
nop
mov rcx, rax
call fcn.140031790
nop
call fcn.140076f90
int3
Function at 0x140078c94
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400d06a0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140078ceb
cmp word [rdx], r13w
jne 0x140078ceb
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140078cf0
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140078e15
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x140078e36
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140078d29
mov rdx, r9
mov word [rbx], cx
jmp 0x140078d50
cmp r9, r8
jae 0x140078d60
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140078d0a
jmp 0x140078e15
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140078e0a
cmp dword [rsp + 0x80], esi
je 0x140078e0a
lea r8, [0x1400d06a0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140078de2
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140078db2
mov word [rbx], r13w
jmp 0x140078e12
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140078dbf
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140078e12
cmp word [rsp + 0x70], r13w
jne 0x140078def
cmp rbx, r14
je 0x140078dac
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14007aa98
cmp word [rsp + 0x70], r13w
je 0x140078e15
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400d06a0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140078e0f
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140078e15
Function at 0x14008bb70
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14008bb86
mov al, 1
jmp 0x14008bbe6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14008bb97
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14008bbe4
mov ecx, dword [rcx + 0x18]
nop
call fcn.14008ec24
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14008bbe4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14008bbe4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14008bbe4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14008bbe6
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14008dfd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140099930
sub rsp, rax
mov rax, qword [0x1400ca010]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14008a20c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14008e01f
mov rax, rbp
jmp 0x14008e127
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xd06a0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14007aa90
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0xd06a0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14008e123
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14008e123
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14007aa90
test rax, rax
js 0x14008e123
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14008e123
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14008e115
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14008e115
cmp byte [rcx], 0xd
jne 0x14008e0fb
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14008e10a
cmp byte [rcx + 1], 0xa
jne 0x14008e10a
inc rcx
jmp 0x14008e10a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0xca3f0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14008e0dd
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14008e127
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400476a0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008ed34
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14007aa98
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14007aa98
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14008ee84
cmp rax, 0xffffffffffffffff
je 0x14008ee84
xor edi, edi
test rbp, rbp
jle 0x14008ee2f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140088dc4
mov rbx, rax
test rax, rax
jne 0x14008edbc
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14008ee25
mov edx, 0x8000
mov ecx, r14d
call fcn.140081404
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14008c864
cmp eax, 0xffffffff
je 0x14008ee05
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14008edcc
mov edx, r15d
mov ecx, r14d
call fcn.140081404
jmp 0x14008ee25
cmp byte [rsi + 0x38], dil
je 0x14008ee1c
cmp dword [rsi + 0x34], 5
jne 0x14008ee1c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14008ee25
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140088e3c
jmp 0x14008ee98
jns 0x14008ee98
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14007aa98
cmp rax, 0xffffffffffffffff
jne 0x14008ee50
cmp byte [rsi + 0x30], dil
je 0x14008ee98
mov edi, dword [rsi + 0x2c]
jmp 0x14008ee98
mov ecx, r14d
call fcn.14008ec24
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14008ee98
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14008ee98
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14008ee91
mov eax, dword [rsi + 0x2c]
jmp 0x14008ee96
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14007aa98
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret