joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e1100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov eax, dword [rdx + 0x10]
lea ecx, [r9 + 2]
movaps xmmword [rsp + 0x20], xmm6
mov esi, r9d
mov r14, r8
mov rbx, rdx
lea ecx, [rax + rcx*4]
cmp ecx, dword [rdx + 8]
jle 0x1401e114e
mov eax, ecx
cdq
sub eax, edx
lea edx, [rcx + 8]
sar eax, 1
mov rcx, rbx
add edx, eax
and edx, 0xfffffff8
call fcn.140030ab0
mov ebp, dword [rsp + 0x60]
xor edi, edi
movss xmm6, dword [0x140437d70]
test esi, esi
jle 0x1401e1196
lea eax, [rdi + rbp]
mov rcx, rbx
cdq
idiv esi
movsxd rax, edx
movss xmm2, dword [r14 + rax*8 + 4]
xorps xmm2, xmm6
test edi, edi
jne 0x1401e1184
xorps xmm1, xmm1
call fcn.1401dc1c0
jmp 0x1401e1190
movd xmm1, edi
cvtdq2ps xmm1, xmm1
call fcn.1401dc060
inc edi
cmp edi, esi
jl 0x1401e1160
lea edi, [rsi - 1]
test edi, edi
js 0x1401e11c7
add ebp, edi
nop
mov eax, ebp
movd xmm1, edi
cdq
mov rcx, rbx
idiv esi
cvtdq2ps xmm1, xmm1
movsxd rax, edx
movss xmm2, dword [r14 + rax*8]
xorps xmm2, xmm6
call fcn.1401dc060
dec ebp
sub edi, 1
jns 0x1401e11a0
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1401e1264
mov r8, qword [rbx]
movss xmm0, dword [r8 + rax*4 - 4]
ucomiss xmm0, dword [0x140437758]
jp 0x1401e11e9
je 0x1401e1264
mov r9d, dword [rbx + 8]
lea ecx, [rax + 1]
cmp ecx, r9d
jle 0x1401e124e
mov eax, ecx
lea edi, [rcx + 8]
cdq
sub eax, edx
sar eax, 1
add edi, eax
and edi, 0xfffffff8
cmp r9d, edi
je 0x1401e124e
test edi, edi
jle 0x1401e123c
movsxd rdx, edi
test r8, r8
jne 0x1401e1227
lea rcx, [rdx*4]
call fcn.1400c1e7c
mov qword [rbx], rax
jmp 0x1401e124b
lea rdx, [rdx*4]
mov rcx, r8
call fcn.1400c1bc8
mov qword [rbx], rax
jmp 0x1401e124b
mov rcx, r8
call fcn.1400c1bd0
mov qword [rbx], 0
mov dword [rbx + 8], edi
mov rcx, qword [rbx + 0x10]
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, qword [rbx]
mov dword [rax + rcx*4], 0x47c35280
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r14
ret
Function at 0x1401e4400
Capabilities:
Enumerate gui resources

Disassembly:
mov r11, rsp
push rbx
push rbp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov rbx, qword [rcx]
mov qword [r11 + 8], rbx
lea rcx, [rbx - 0x10]
lea rbp, [0x1402901c8]
cmp rcx, rbp
je 0x1401e4439
mov eax, 1
lock xadd dword [rcx], eax
mov rbx, qword [r11 + 8]
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
lea rdx, [rsp + 0x48]
lea rcx, [0x1401e4820]
call qword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [rsp + 0x58]
sub eax, 1
movsxd rdi, eax
js 0x1401e4536
nop dword [rax]
nop dword [rax + rax]
mov qword [rsp + 0x60], 0xc403
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx]
inc rbx
test al, al
jns 0x1401e44b1
movzx eax, byte [rbx]
and al, 0xc0
cmp al, 0x80
jne 0x1401e44b5
inc rbx
movzx eax, byte [rbx]
and al, 0xc0
cmp al, 0x80
je 0x1401e44a3
jmp 0x1401e44b5
test eax, eax
je 0x1401e44ba
inc rcx
jmp 0x1401e4490
lea eax, [rcx*4 + 4]
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xa8]
call fcn.140040c10
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x48]
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x1f40
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0x60]
mov r8, qword [0x1404be410]
mov edx, 0x4a
mov rcx, qword [rax + rdi*8]
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
sub rdi, 1
mov rbx, qword [rsp + 0xa0]
jns 0x1401e4480
mov rcx, qword [rsp + 0x48]
call fcn.1400c1bd0
nop
lea rcx, [rbx - 0x10]
cmp rcx, rbp
je 0x1401e455a
or eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x1401e455a
call fcn.1400bd658
add rsp, 0x80
pop rdi
pop rbp
pop rbx
ret

Function at 0x1401e52f0
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
lea rdi, [rcx + 8]
mov qword [rsp + 0x40], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x1401e535b
cmp byte [rax + 0x11], 0
jne 0x1401e5356
cmp byte [rax + 0x10], 0
je 0x1401e5356
movsxd rcx, dword [rax + 0xc]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
jmp 0x1401e5379
or ebx, 0xffffffff
jmp 0x1401e5379
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x1401e5377
mov r9d, dword [rbx + 0x50]
mov r8d, esi
mov rdx, rbp
call fcn.140164c50
mov ebx, eax
jmp 0x1401e5379
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1401e69e0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
lea rax, [0x1402940d4]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x40], rax
mov rbx, rcx
lea rax, [0x1402940fc]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.14007dfd0
lea rdx, [rsp + 0x40]
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x48]
call fcn.14007df30
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov qword [rsp + 0x40], rax
call fcn.140046380
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1401f1940
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
add rcx, 0xf8
xor edx, edx
call fcn.140103a10
mov rdx, qword [rbx + 0xe8]
cmp eax, dword [rdx + 0x48]
jae 0x1401f19de
movsxd rcx, eax
mov rax, qword [rdx + 0x38]
mov rdx, qword [rax + rcx*8]
test rdx, rdx
je 0x1401f19de
add rdx, 0x30
lea rcx, [rsp + 0x40]
call fcn.140181660
mov rcx, qword [rax]
cmp byte [rcx], 0
je 0x1401f19b2
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140040d80
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x1401f19b2
mov bl, 1
jmp 0x1401f19b4
xor bl, bl
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff0
lea rax, [0x1402901c8]
cmp rcx, rax
je 0x1401f19d9
or edx, 0xffffffff
lock xadd dword [rcx], edx
test edx, edx
jne 0x1401f19d9
call fcn.1400bd658
movzx eax, bl
jmp 0x1401f19e0
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x140206c70
Capabilities:
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x80], ebx
add rcx, 0x48
mov qword [rsp + 0x30], rcx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rdi + 0xb0]
call fcn.1401e6f50
cmp byte [rdi + 0xfa], bl
jne 0x140206d73
lea rcx, [0x1402901d8]
mov qword [rsp + 0x28], rcx
mov ebx, 1
mov dword [rsp + 0x80], ebx
mov rax, qword [rdi + 0xd0]
cmp rax, rcx
je 0x140206d73
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x90]
call fcn.1400458d0
test eax, eax
je 0x140206d73
lea rdx, [rdi + 0xd0]
lea rcx, [rsp + 0x40]
call fcn.140040d80
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x140206d2d
cmp eax, 0xffffffff
jne 0x140206d73
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0xd0]
call fcn.140183520
nop
mov dword [rsp + 0x80], 3
lea rdx, [rsp + 0x98]
mov rcx, rax
call fcn.140183190
mov ebx, 7
mov dword [rsp + 0x80], ebx
mov rax, qword [rax]
cmp byte [rax], 0
jne 0x140206d73
xor bpl, bpl
jmp 0x140206d76
mov bpl, 1
or esi, 0xffffffff
lea r14, [0x1402901c8]
test bl, 4
je 0x140206db6
and ebx, 0xfffffffb
mov dword [rsp + 0x80], ebx
mov rcx, qword [rsp + 0x98]
add rcx, 0xfffffffffffffff0
cmp rcx, r14
je 0x140206db6
mov eax, esi
lock xadd dword [rcx], eax
test eax, eax
jne 0x140206daf
call fcn.1400bd658
mov ebx, dword [rsp + 0x80]
test bl, 2
je 0x140206de9
and ebx, 0xfffffffd
mov dword [rsp + 0x80], ebx
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff0
cmp rcx, r14
je 0x140206de9
mov eax, esi
lock xadd dword [rcx], eax
test eax, eax
jne 0x140206de2
call fcn.1400bd658
mov ebx, dword [rsp + 0x80]
test bl, 1
je 0x140206e09
mov rcx, qword [rsp + 0x28]
add rcx, 0xfffffffffffffff0
cmp rcx, r14
je 0x140206e09
lock xadd dword [rcx], esi
test esi, esi
jne 0x140206e09
call fcn.1400bd658
test bpl, bpl
je 0x140206e12
xor bl, bl
jmp 0x140206e2d
mov rcx, rdi
cmp dword [rdi + 0x100], 2
jne 0x140206e25
call fcn.140206410
jmp 0x140206e2a
call fcn.140205ae0
movzx ebx, al
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bl
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140207020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rcx
xor edi, edi
cmp qword [rcx + 0x108], rdi
je 0x14020706e
lea ecx, [rdi + 0x10]
call fcn.1400bd614
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rcx, qword [rsi + 0x108]
mov qword [rax], rcx
or edx, 0xffffffff
call fcn.140164520
mov byte [rbx + 8], al
jmp 0x140207071
mov rbx, rdi
mov qword [rsp + 0x40], rbx
test rbx, rbx
je 0x140207086
cmp byte [rbx + 8], 0
jne 0x140207086
xor dil, dil
jmp 0x1402070d2
lea rdx, [rsi + 0xd0]
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x1402070c6
lea rcx, [rsp + 0x48]
call fcn.140040d80
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x1402070c6
mov rcx, rsi
call fcn.140206100
test al, al
jne 0x1402070c6
mov rcx, rsi
call fcn.140206830
test al, al
je 0x1402070cb
mov edi, 1
mov byte [rsi + 0x110], dil
test rbx, rbx
je 0x1402070ec
mov rcx, qword [rbx]
call fcn.140164490
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rbx
call fcn.1400bd658
movzx eax, dil
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14022d680
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov rdx, qword [rcx]
lea rdi, [0x14034e4a0]
xor r8d, r8d
mov r9, rcx
mov eax, r8d
mov r10d, r8d
mov byte [rdx + 0x16], al
mov rdx, qword [rcx]
mov byte [rdx + 0x17], al
mov rdx, qword [rcx]
mov byte [rdx + 0x18], al
mov rdx, qword [rcx]
mov byte [rdx + 0x19], al
movsxd r11, dword [rcx + 8]
test r11, r11
jle 0x14022d6e5
mov qword [rsp + 0x10], rbx
mov rbx, qword [rcx]
nop
movzx edx, byte [rbx + r10]
inc r10
mov ecx, eax
shr rcx, 0x18
xor rdx, rcx
mov ecx, eax
shl ecx, 8
mov eax, dword [rdi + rdx*4]
xor eax, ecx
cmp r10, r11
jl 0x14022d6c0
mov rbx, qword [rsp + 0x10]
movsxd r10, dword [r9 + 0x18]
test r10, r10
jle 0x14022d712
mov r11, qword [r9 + 0x10]
movzx edx, byte [r11 + r8]
inc r8
mov ecx, eax
shr rcx, 0x18
xor rdx, rcx
mov ecx, eax
shl ecx, 8
mov eax, dword [rdi + rdx*4]
xor eax, ecx
cmp r8, r10
jl 0x14022d6f2
mov rcx, qword [r9]
mov edx, eax
shr edx, 8
mov byte [rcx + 0x16], al
mov rcx, qword [r9]
mov byte [rcx + 0x17], dl
mov edx, eax
mov rcx, qword [r9]
shr edx, 0x10
shr eax, 0x18
mov byte [rcx + 0x18], dl
mov rcx, qword [r9]
mov byte [rcx + 0x19], al
pop rdi
ret
Function at 0x14023b450
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 8]
xor esi, esi
mov rbx, rcx
mov qword [rax + 0x1c0], rsi
mov rax, qword [rcx + 8]
mov dword [rax + 0xfe8], esi
mov rax, qword [rcx + 8]
mov rdx, qword [rax + 0x68]
mov qword [rdx + 0xc], rsi
mov qword [rdx + 0x14], rsi
mov rax, qword [rcx]
mov dword [rax], 2
mov rax, qword [rcx + 8]
cmp dword [rax + 0xfec], esi
jne 0x14023b4d9
xor ecx, ecx
mov rdi, rax
call fcn.1400cd270
cmp qword [rdi + 0x60], rax
je 0x14023b4c7
mov rax, qword [rdi + 8]
test rax, rax
je 0x14023b4df
mov r8, qword [rdi + 0x58]
xor edx, edx
mov rcx, rbx
call rax
cmp eax, 1
jne 0x14023b4df
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rax + 0xfec], esi
mov rax, qword [rbx]
mov dword [rax], esi
mov rax, qword [rbx + 8]
mov dword [rax + 0x1c8], esi
mov rax, qword [rbx + 8]
cmp dword [rax + 0x1cc], esi
je 0x14023b520
mov rcx, qword [rax + 0x298]
test rcx, rcx
je 0x14023b520
call fcn.1400c1bd0
mov rax, qword [rbx + 8]
mov qword [rax + 0x298], rsi
mov rax, qword [rbx + 8]
mov dword [rax + 0x1cc], esi
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
mov eax, dword [rax + 0x1c]
mov dword [rcx + 0xfe8], eax
mov rax, qword [rbx + 8]
mov dword [rax + 0x1bc], esi
mov rax, qword [rbx + 8]
mov dword [rax + 0x1b8], esi
mov rax, qword [rbx + 8]
add rax, 0xff8
mov dword [rax + 0x54], esi
mov qword [rax + 0x58], rsi
mov qword [rax + 0x60], rsi
mov dword [rax + 0x40], 0x67452301
mov dword [rax + 0x44], 0xefcdab89
mov dword [rax + 0x48], 0x98badcfe
mov qword [rax + 0x4c], 0x10325476
mov rax, qword [rbx + 8]
mov qword [rax + 0x1aa0], rsi
mov rax, qword [rbx + 8]
mov rbx, qword [rsp + 0x30]
mov dword [rax + 0x1ab0], esi
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140244e40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11d, dword [rcx + 0x18]
mov rax, rcx
test r11d, r11d
je 0x140244ed6
mov r9d, dword [rax + 0x20]
mov edx, dword [rcx + 0x14]
mov rcx, qword [rcx]
cmp r9d, r11d
jae 0x140244ecd
mov r10d, dword [rax + 0x1c]
mov qword [rsp + 0x10], rbx
mov ebx, dword [rcx + rdx*4]
mov qword [rsp], rdi
lea rdi, [0x14040a440]
nop word [rax + rax]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, rbx
sub ecx, r9d
add r9d, 8
shr rdx, cl
mov ecx, r10d
shr rcx, 8
movzx r8d, dl
xor r8, rcx
movzx ecx, r10b
shl ecx, 8
mov r10d, dword [rdi + r8*4]
xor r10d, ecx
cmp r9d, r11d
jb 0x140244e80
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
mov dword [rax + 0x20], r9d
mov dword [rax + 0x1c], r10d
movzx eax, r10w
add rsp, 8
ret
movzx eax, word [rax + 0x1c]
add rsp, 8
ret
movzx eax, word [rcx + 0x1c]
add rsp, 8
ret

Function at 0x140251920
Capabilities:
Open clipboard

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0xe0]
lea rax, [0x1402901d8]
mov rbx, rcx
lea rsi, [0x1402901c8]
or edi, 0xffffffff
mov byte [rdx + 0xb0], 1
xchg qword [rdx + 0x98], rax
lea rcx, [rax - 0x10]
cmp rcx, rsi
je 0x140251970
mov eax, edi
lock xadd dword [rcx], eax
test eax, eax
jne 0x140251970
call fcn.1400bd658
mov rcx, qword [rbx + 0x468]
mov edx, 0x258
call fcn.1401e6ff0
mov rcx, qword [rbx + 0xe0]
lea r9, [rbx + 0x150]
lea r8, [rbx + 0x138]
lea rdx, [rsp + 0x30]
call fcn.140256110
mov rbx, qword [rsp + 0x30]
cmp byte [rbx], 0
je 0x1402519c0
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1402519c0
lea rcx, [rsp + 0x30]
call fcn.1400e7200
lea rcx, [rbx - 0x10]
cmp rcx, rsi
je 0x1402519d6
lock xadd dword [rcx], edi
test edi, edi
jne 0x1402519d6
call fcn.1400bd658
mov rbx, qword [rsp + 0x38]
mov al, 1
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800812a4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1800812d2
xor eax, eax
jmp 0x1800813b8
cmp qword [rcx + 0x68], 0
je 0x1800812e3
call fcn.1800809a8
jmp 0x1800813b8
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1800812fa
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800812fc
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18008132e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.180084700
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x1800813b2
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x180081365
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x18008138e
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.180087d30
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x1800813b2
cmp rsi, rbx
ja 0x18008136c
test rsi, rsi
je 0x1800813b2
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.180087d30
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1800813d4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180081403
call fcn.180080a6c
jmp 0x18008147a
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x18008141a
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18008141c
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180081474
test ecx, ecx
jle 0x180081455
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call fcn.180084700
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180081474
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180081474
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.180087ffc
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x18008b3e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18008b408
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18008b408
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140009780
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x140009820
jmp 0x14000980f
jae 0x1400098e0
cmp r8, 0x201
jae 0x140009820
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140009878
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x14000984f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14002c810
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400098a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140009948
mov r8d, r14d
cmp r15, r8
jne 0x140009800
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140009975
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000980f
jmp 0x140009820
cmp rsi, r8
jb 0x14000998f
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14000c440
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x140009931
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.1400029b0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x140009919
jmp 0x140009931
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.14002d370
jmp 0x1400099a4
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14002d7c0
ud2
Function at 0x14000fc90
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.14002bd10
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r12, rcx
lea r13, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0xfe8]
xorps xmm6, xmm6
lea rbx, [rbp + 0xffc]
lea rsi, [0x140015ab0]
lea r15, [rbp + 0xfb0]
mov r14, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1010], r12
mov r9d, 0x1000
mov rdx, r12
mov r8, r13
call fcn.140015530
cmp qword [rbp + 0xfe8], 0
jne 0x14000fe67
mov r12, qword [rbp + 0xff0]
test r12, r12
je 0x14000fe33
cmp r12, 0x1000
ja 0x14000fe89
xor r13d, r13d
nop word cs:[rax + rax]
mov r8d, r12d
sub r8d, r13d
lea rdx, [r13 - 0x50]
add rdx, rbp
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], rbx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp + 0x1008]
mov r9, r15
call r14
test eax, eax
je 0x14000fe07
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x14000fdb0
movsxd rax, dword [rbp + 0x1000]
test rax, rax
jne 0x14000fe0d
mov eax, dword [rbp + 0x1004]
add r13, rax
cmp r13, r12
je 0x14000fdf0
jbe 0x14000fd60
jmp 0x14000fe75
mov r12, qword [rbp + 0x1010]
lea r13, [rbp - 0x50]
lea rcx, [rbp + 0xfe8]
jmp 0x14000fd15
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe0], rax
mov qword [rbp + 0xfd8], 1
lea rcx, [rbp + 0xfe0]
call fcn.140003d80
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xff0]
call fcn.140003d80
jmp 0x14000fe33
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, r13
mov rdx, r12
call fcn.14002d840
jmp 0x14000fe9d
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r12
call fcn.14002d7c0
ud2
Function at 0x1400130e0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140030fd8]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140013124
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140013183
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x140013192
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x1400131ca
cmp eax, 0x103
je 0x1400131d4
test eax, eax
js 0x1400131af
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400131ca
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14000bf50
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140004380
mov ecx, 7
int 0x29
ud2