joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011113
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001f8a0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400e2100]
call fcn.140011ac3
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001f8f8
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001fa0a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001f9a3
cmp qword [rbp + 0x28], 0
jle 0x14001f9a3
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001f941
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011a2d
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x14001f9f9
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001f9f9
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140011235
Capabilities:
Create thread

Disassembly:
jmp 0x140016cd0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x1400d9d80]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x1400e20fa]
call fcn.140011ac3
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140011361
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.140011596
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.140011271
nop
lea rcx, [rbp + 0x108]
call fcn.140011474
nop
lea rax, [0x140011762]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.140011794
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x140016dd3
lea rcx, [rbp + 8]
call fcn.1400114a1
nop
jmp 0x140016dec
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.140011294
nop
lea rcx, [rbp + 8]
call fcn.140011474
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14002c220]
call fcn.14001191a
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.14001155f
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x140011645
Capabilities:
Terminate process

Disassembly:
jmp 0x1400228f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011799
Capabilities:
Execute command

Disassembly:
jmp 0x14001fa90
push rbp
push rdi
sub rsp, 0x2d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x7e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400d9d80]
xor rax, rbp
mov qword [rbp + 0x2a8], rax
lea rcx, [0x1400e2106]
call fcn.140011ac3
nop
lea rdx, [0x140011b09]
lea rcx, [rbp + 8]
call fcn.1400114ce
nop
lea rcx, [rbp + 8]
call fcn.140011b54
nop
call fcn.140011a50
nop
lea rdx, str.Welcome_to_Exploiters_heaven_free_temp_spoofer
lea rcx, [rbp + 0xf8]
call fcn.1400114e2
nop
mov edx, 0x32
lea rcx, [rbp + 0xf8]
call fcn.140011500
nop
lea rcx, [rbp + 0xf8]
call fcn.140011203
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x14002c858]
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rdx, str.press_any_key_to_spoof
lea rcx, [rbp + 0x138]
call fcn.1400114e2
nop
mov edx, 0x4b
lea rcx, [rbp + 0x138]
call fcn.140011500
nop
lea rcx, [rbp + 0x138]
call fcn.140011203
nop
call qword [sym.imp.ucrtbased.dll__getch]
nop
lea rax, [rbp + 0x174]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x174]
call fcn.140019d20
mov rcx, rax
call fcn.140011569
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
nop
call fcn.1400111cc
nop
lea rax, [rbp + 0x1c4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x1c4]
call fcn.140019ed0
mov rcx, rax
call fcn.140011b90
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rdx, str.Done_spoofing...
lea rcx, [rbp + 0x218]
call fcn.1400114e2
nop
mov edx, 0x32
lea rcx, [rbp + 0x218]
call fcn.140011500
nop
lea rcx, [rbp + 0x218]
call fcn.140011203
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, str.disk_serial_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001113b
nop
lea rax, [rbp + 0x254]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x254]
call fcn.140019fb0
mov rcx, rax
call fcn.140011aeb
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
nop
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp + 8]
call fcn.1400114dd
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002baa0]
call fcn.14001191a
mov eax, edi
mov rcx, qword [rbp + 0x2a8]
xor rcx, rbp
call fcn.14001155f
lea rsp, [rbp + 0x2b8]
pop rdi
pop rbp
ret
Function at 0x1400117bc
Capabilities:
Parse pe header

Disassembly:
jmp 0x140023420
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140023440
xor al, al
jmp 0x1400234c1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140023453
xor al, al
jmp 0x1400234c1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002347d
xor al, al
jmp 0x1400234c1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140023491
xor al, al
jmp 0x1400234c1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400234a3
xor al, al
jmp 0x1400234c1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400234bf
xor al, al
jmp 0x1400234c1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011a50
Capabilities:
Execute command
Terminate process

Disassembly:
jmp 0x14001c4f0
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400d9d80]
xor rax, rbp
mov qword [rbp + 0x1b8], rax
lea rcx, [0x1400e2106]
call fcn.140011ac3
nop
lea rdx, str.FREE_TEMP
lea rcx, [rbp + 8]
call fcn.1400114e2
nop
lea rcx, [rbp + 0x48]
call fcn.140011aaf
nop
lea rdx, str.Enter_the_key:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001113b
nop
lea rdx, [rbp + 0x48]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140011037
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x48]
call fcn.1400112e9
movzx eax, al
test eax, eax
je 0x14001c5d1
lea rdx, str.Correct_key
lea rcx, [rbp + 0x148]
call fcn.1400114e2
nop
mov edx, 0x32
lea rcx, [rbp + 0x148]
call fcn.140011500
nop
lea rcx, [rbp + 0x148]
call fcn.140011203
nop
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [0x14002c858]
call qword [sym.imp.ucrtbased.dll_system]
nop
jmp 0x14001c61c
lea rdx, str.Invalid_key._Access_denied.
lea rcx, [rbp + 0x188]
call fcn.1400114e2
nop
mov edx, 0x32
lea rcx, [rbp + 0x188]
call fcn.140011500
nop
lea rcx, [rbp + 0x188]
call fcn.140011203
nop
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rcx, [rbp + 0x48]
call fcn.140011203
nop
lea rcx, [rbp + 8]
call fcn.140011203
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x14002b910]
call fcn.14001191a
mov rcx, qword [rbp + 0x1b8]
xor rcx, rbp
call fcn.14001155f
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x140011aa5
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001af60
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x1400d9d80]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1400e2100]
call fcn.140011ac3
nop
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x14001afc7
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001afce
mov al, 1
jmp 0x14001b11e
call fcn.140011325
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.140011325
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.1400118bb
movzx eax, al
test eax, eax
je 0x14001b01f
xor al, al
jmp 0x14001b11e
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14001b084
cmp dword [rbp + 0x154], 1
je 0x14001b08f
cmp dword [rbp + 0x154], 3
je 0x14001b10d
jmp 0x14001b11c
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14001b0df
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14001b0df
xor al, al
jmp 0x14001b11e
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001b0fa
mov dword [rbp + 0x154], 1
jmp 0x14001b104
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001b11e
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001b11e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002b840]
call fcn.14001191a
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.14001155f
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140020d10
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011b22
movzx eax, al
test eax, eax
jne 0x140020d30
mov ecx, 7
call fcn.140011933
nop
mov byte [rsp + 0x20], 0
call fcn.14001196f
mov byte [rsp + 0x21], al
cmp dword [0x1400da480], 1
jne 0x140020d54
mov ecx, 7
call fcn.140011933
nop
jmp 0x140020dac
cmp dword [0x1400da480], 0
jne 0x140020da7
mov dword [0x1400da480], 1
lea rdx, [0x14002a770]
lea rcx, [0x14002a440]
call fcn.14001153c
test eax, eax
je 0x140020d88
mov eax, 0xff
jmp 0x140020eb1
lea rdx, [0x14002a330]
lea rcx, [section..rdata]
call fcn.14001195b
mov dword [0x1400da480], 2
jmp 0x140020dac
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011906
call fcn.1400117f8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140020e09
mov rcx, qword [rsp + 0x30]
call fcn.14001141f
movzx eax, al
test eax, eax
je 0x140020e09
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1400e3020]
nop
call fcn.140011884
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140020e3d
mov rcx, qword [rsp + 0x38]
call fcn.14001141f
movzx eax, al
test eax, eax
je 0x140020e3d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011a78
nop
call fcn.140020f60
mov dword [rsp + 0x28], eax
call fcn.1400117bc
movzx eax, al
test eax, eax
jne 0x140020e5c
mov ecx, dword [rsp + 0x28]
call fcn.1400110c8
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140020e6b
call fcn.140011a8c
nop
xor edx, edx
mov cl, 1
call fcn.1400113e3
mov eax, dword [rsp + 0x28]
jmp 0x140020eb1
add rsp, 0x68
ret
Function at 0x140001290
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140001500
lea rcx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x38]
cmp rdi, 0xf
cmova rcx, rbx
mov r8, qword [rsp + 0x30]
cmp r8, 7
jne 0x140001312
lea rdx, str.whyBEME
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
lea rdx, str.true
je 0x140001319
lea rdx, str.false
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400016e0
mov rcx, rax
call fcn.1400018c0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
cmp rdi, 0xf
jbe 0x140001375
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000136d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000136d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140001d6c
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140001d10
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140002690
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400026da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400026da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400026da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400026da
cmp dword [rcx + 0x84], 0xe
jbe 0x1400026da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400026dc
xor al, al
add rsp, 0x28
ret
Function at 0x14003ca00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003ca0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003ca1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003ca05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ca35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003ca22
sub eax, 3
jb 0x14003ca4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ca86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ca76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ca74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ca63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c9c2
jmp 0x14003ca0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003cad2
cmp rsi, rcx
jae 0x14003cada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003cab9
cmp al, 0x8f
ja 0x14003cab9
cmp byte [rsi - 2], 0xf
je 0x14003cabf
sub al, 0xe8
cmp al, 1
ja 0x14003caa3
cmp rsi, rcx
jae 0x14003cada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003caa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003cada
lodsb al, byte [rsi]
jmp 0x14003cab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003cb43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40e24]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003cae7
jns 0x14003cb1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003cb26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003cb3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003cb07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003cb9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac
Function at 0x140011fd0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140280d40]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, r9
mov edi, r8d
mov rsi, qword [rsp + 0xb0]
test rdx, rdx
je 0x1400120d2
test r8d, r8d
je 0x1400120d2
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140012029
cmp dword [rsp + 0x60], edi
je 0x140012114
test rbx, rbx
je 0x1400120ce
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140017080
nop
cmp qword [rax + 0x18], 7
jbe 0x140012051
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
lea rax, str.Error_writting_to_file_:__s
mov qword [rsp + 0x30], rax
lea rcx, str.FileStreamUtils
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9d, 0xbb
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonFileStreamUtils_Win32.cpp
lea rdx, str.mb::common::io::FileStreamUtils::Write
mov rcx, rbx
call rdi
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400120ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400120c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001212b
call fcn.1401629f4
xor al, al
jmp 0x140012116
test rbx, rbx
je 0x140012114
mov rax, qword [r9]
lea rcx, str.Skipping_writting_zero_byte_buffer__this_may_be_an_empty_file_
mov qword [rsp + 0x30], rcx
lea rcx, str.FileStreamUtils
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 4
mov r9d, 0xb3
lea r8, str.D:JenkinsworkspaceN_MBCommon_vs2022_srcmbcommonFileStreamUtils_Win32.cpp
lea rdx, str.mb::common::io::FileStreamUtils::Write
mov rcx, rbx
call qword [rax + 0x20]
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140162ed0
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
call fcn.14017234c
int3
Function at 0x140013890
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400138b2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14001392c
mov rdi, r14
mov rcx, rbx
call fcn.140006ad0
test rax, rax
jle 0x140013904
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14019d040
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14001391c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140013924
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400138c6
sub r14, rdi
jmp 0x140013a0f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140013943
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140013945
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140013977
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14019d040
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140013a0c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400139b2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1400139ed
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1401748b0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140013a0c
cmp rbp, rax
ja 0x1400139c0
test rbp, rbp
je 0x140013a0c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1401748b0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret