joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140118090
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 0x10]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140118258
mov rbx, qword [rcx + 0x18]
mov qword [rsp + 0x38], rbx
mov rcx, rbx
call fcn.140153090
test eax, eax
jne 0x140118281
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x14011828c
and qword [rsi + 0x28], 0
and qword [rsi + 0x30], 0
and qword [rsp + 0x50], 0
lea r12, vtable.fmt::v9::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], 0xfa
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rax, qword [rax + 8]
call qword [case.0x1401ad3ca.0]
cmp byte [rdi + 0x20], 0
je 0x1401181ea
mov r8, qword [rsi + 0x28]
cmp qword [rsi + 0x30], r8
jbe 0x1401181ea
test r8, r8
je 0x140118171
and qword [rsp + 0x20], 0
xor r9d, r9d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movsxd rdx, dword [rsi + 0x10]
movzx edx, word [rdi + rdx*2 + 0x30]
mov rcx, rdi
call fcn.14011983c
movzx r14d, ax
mov r8, qword [rsi + 0x30]
mov rdx, qword [rsi + 0x28]
cmp r8, rdx
jbe 0x1401181ae
sub r8d, edx
add rdx, qword [rsp + 0x48]
and qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movzx edx, r14w
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [rsi + 0x30]
mov r8, qword [rsp + 0x50]
cmp r8, rcx
jbe 0x14011820f
sub r8d, ecx
mov rdx, qword [rsp + 0x48]
add rdx, rcx
and qword [rsp + 0x20], 0
xor r9d, r9d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x14011820f
and dword [rsp + 0x30], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
cmp rcx, rax
je 0x14011824f
mov rdx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140118249
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011827b
call fcn.140172db0
nop
mov rcx, rbx
call fcn.1401530b4
nop
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14017a8e4
nop
mov ecx, 5
call fcn.140153528
int3
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call fcn.140153528
int3
Function at 0x1401197c8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov rbx, r9
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140119836
mov rax, qword [rsp + 0x78]
mov r9, rbx
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
je 0x140119830
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140119836
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x40
pop rbx
ret
Function at 0x14011a494
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov r14, rcx
mov rdi, qword [rdx + 0x10]
mov rcx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x14011a4ce
mov rcx, qword [rdx]
mov esi, 1
mov qword [rsp + 0x20], rsi
lea r9, [0x1402096c0]
xor r8d, r8d
mov rdx, rdi
call fcn.1400c181c
or r8, 0xffffffffffffffff
cmp rax, r8
je 0x14011a62f
add rax, 2
cmp rax, rdi
ja 0x14011a62f
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
sub rdi, rax
cmp rdi, r8
cmovb r8, rdi
cmp qword [rbx + 0x18], 0xf
jbe 0x14011a527
mov rbx, qword [rbx]
lea rdx, [rbx + rax]
lea rcx, [rbp - 0x28]
call fcn.14004ea74
nop
mov r9, qword [r14]
lea rbx, [rbp - 0x28]
mov r8, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
cmova rbx, r8
lea rcx, [rbp - 0x28]
cmova rcx, r8
mov rdi, qword [rbp - 0x18]
add rdi, rcx
cmp rbx, rdi
je 0x14011a5fc
movzx ecx, byte [rbx]
mov byte [rbp - 0x40], cl
test r9, r9
je 0x14011a652
mov eax, ecx
movabs rdx, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x100000001b3
imul rax, rdx
mov rdx, qword [r9 + 0x30]
and rdx, rax
add rdx, rdx
mov r8, qword [r9 + 0x18]
mov rax, qword [r8 + rdx*8 + 8]
cmp rax, qword [r9 + 8]
je 0x14011a5bf
mov r8, qword [r8 + rdx*8]
jmp 0x14011a5b8
cmp rax, r8
je 0x14011a5bf
mov rax, qword [rax + 8]
cmp cl, byte [rax + 0x10]
jne 0x14011a5af
jmp 0x14011a5c1
xor eax, eax
test rax, rax
je 0x14011a652
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x38]
mov rcx, r9
call fcn.14010665c
mov rcx, qword [rax]
mov r9, qword [rcx + 0x18]
cmp byte [r9 + 0x40], 0
jne 0x14011a655
add rbx, rsi
cmp rbx, rdi
jne 0x14011a564
mov rdx, qword [rbp - 0x10]
mov r8, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14011a62f
inc rdx
mov rax, r8
cmp rdx, 0x1000
jb 0x14011a626
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011a698
mov rcx, r8
call fcn.140172db0
nop
xor al, al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140173230
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
xor sil, sil
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x14011a68d
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011a687
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14011a692
call fcn.140172db0
nop
mov al, sil
jmp 0x14011a631
call fcn.14017a8e4
nop
call fcn.14017a8e4
int3
Function at 0x14011aa2c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, rdx
mov rdi, rcx
mov rbx, qword [rdx + 0x10]
mov r9, qword [rcx + 8]
mov r8, rbx
mov edx, 1
mov rcx, qword [rax + 8]
call fcn.1401859ac
cmp rax, rbx
jne 0x14011aa84
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140173230
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
call fcn.14017aa48
mov ebx, dword [rax]
lea rdx, [rdi + 0x10]
lea rcx, [rsp + 0x20]
call fcn.1401144f0
nop
mov r8, rax
lea rdx, str.Failed_writing_to_file
lea rcx, [rsp + 0x40]
call fcn.140105824
nop
mov edx, ebx
mov rcx, rax
call fcn.14011a764
int3
Function at 0x14012e238
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x14020ac40]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x1d
jb 0x14012e23b
mov byte [rcx + 0x1d], 0
mov rax, rcx
ret

Function at 0x14012e338
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
movabs rax, 0xf2b9d6480f2b9d65
mul r8
shr rdx, 8
imul rax, rdx, 0x10e
mov rdx, r8
sub rdx, rax
lea rax, [0x14020ac40]
mov al, byte [rdx + rax]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xf
jb 0x14012e33b
mov byte [rcx + 0xf], 0
mov rax, rcx
ret

Function at 0x14012ef40
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
jmp 0x14012efb2
cmp ecx, 0x7c
je 0x14012efb7
cmp ecx, 0x29
jne 0x14012efc2
cmp dword [rbx + 0x1c], 0
jne 0x14012efb7
test dword [rbx + 0x80], 0x10000000
je 0x14012f0e2
cmp ecx, 0x5d
jne 0x14012ef89
test dword [rbx + 0x80], 0x10000000
je 0x14012f0d4
mov dl, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14012e55c
mov dil, 1
mov rcx, rbx
call fcn.140131410
test dil, dil
je 0x14012efad
mov rcx, rbx
call fcn.140131484
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x14012ef54
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x2e
jne 0x14012efdf
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.1401313b8
mov rcx, rbx
call fcn.140131410
jmp 0x14012efa5
cmp ecx, 0x5c
jne 0x14012f03d
mov rcx, rbx
call fcn.140131410
test byte [rbx + 0x80], 0x80
je 0x14012f030
mov al, byte [rbx + 0x78]
cmp al, 0x62
jne 0x14012f014
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.1401313b8
mov rcx, rbx
call fcn.140131410
jmp 0x14012efad
cmp al, 0x42
jne 0x14012f030
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.1401313b8
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x14012f00a
mov rcx, rbx
call fcn.14012f100
jmp 0x14012efa5
cmp ecx, 0x5b
jne 0x14012f05d
mov rcx, rbx
call fcn.140131410
mov rcx, rbx
call fcn.14012f7e4
cmp dword [rbx + 0x7c], 0x5d
jne 0x14012f0d4
jmp 0x14012efd5
cmp ecx, 0x28
jne 0x14012f080
mov rcx, rbx
call fcn.140131410
mov rcx, rbx
call fcn.140131b20
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x14012f0e2
jmp 0x14012ef98
cmp ecx, 0x5e
jne 0x14012f08d
lea edx, [rcx - 0x5c]
jmp 0x14012f001
cmp ecx, 0x24
jne 0x14012f09a
lea edx, [rcx - 0x21]
jmp 0x14012f001
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14012f0c6
cmp ecx, 0x3f
je 0x14012f0c6
cmp ecx, 0x7b
je 0x14012f0c6
cmp ecx, 0x7d
jne 0x14012ef74
test dword [rbx + 0x80], 0x10000000
je 0x14012f0f0
jmp 0x14012ef89
mov edx, 0xa
mov rcx, rbx
call fcn.14013098c
int3
mov edx, 4
mov rcx, rbx
call fcn.14013098c
int3
mov edx, 5
mov rcx, rbx
call fcn.14013098c
int3
mov edx, 6
mov rcx, rbx
call fcn.14013098c
int3
Function at 0x140149dd0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x140281f58], 0x12c
mov rdi, rcx
jg 0x140149e9f
lea rdx, [rcx + 0x20]
add rcx, 0x50
lea r8, [rsp + 0x38]
call fcn.1401ad85c
lea rbx, [rdi + 0x18]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140149e63
cmp dword [rsp + 0x38], 0
jne 0x140149e63
cmp byte [rdi + 0x70], 0
lea rdx, [rsp + 0x38]
mov rcx, rbx
je 0x140149e2c
call fcn.1401ada5c
test al, al
jne 0x140149e3b
jmp 0x140149e63
mov r8d, 0x493e0
call fcn.1401adac0
test al, al
je 0x140149e9f
and dword [0x140281f58], 0
mov rcx, qword [rdi + 0x28]
mov byte [rdi + 0x70], 1
test rcx, rcx
je 0x140149e63
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1401ad3ca.0]
test al, al
jne 0x140149e94
cmp qword [rbx], 0xffffffffffffffff
je 0x140149e7c
cmp dword [rsp + 0x38], 0
jne 0x140149e94
mov rcx, rbx
call fcn.1401ad6fc
or qword [rbx], 0xffffffffffffffff
cmp dword [rsp + 0x38], 0
je 0x140149e94
inc dword [0x140281f58]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1401696e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140155912
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x1401558f5
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1401558e0

Function at 0x140173a30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140173a7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140173a7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140173a7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140173a7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140173a7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140173a7c
xor al, al
add rsp, 0x28
ret

Function at 0x140184860
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14018468c

Function at 0x140198928
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140198948
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14017a9d8
or eax, 0xffffffff
jmp 0x14019894a
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401a73c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov al, byte [rcx + 8]
nop
test al, al
je 0x1401a7478
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1401ad3ca.0]
test al, al
je 0x1401a7478
xor eax, eax
xchg byte [rdi + 8], al
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x1401a741a
mov rcx, qword [rbx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x1401a740d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov edx, 0x18
mov rcx, rbx
call fcn.140172db0
mov ecx, 0x18
call fcn.140172d74
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401a7446
lea rax, [0x1401a7380]
mov qword [rbx], rax
mov qword [rbx + 8], rdi
or qword [rbx + 0x10], 0xffffffffffffffff
jmp 0x1401a7448
xor ebx, ebx
mov qword [rdi + 0x10], rbx
and dword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x1401a7530]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
mov al, byte [rdi + 8]
nop
test al, al
sete al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1401ad768
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
or rbp, 0xffffffffffffffff
mov r14, r9
cmp qword [rcx + 0x10], 0
mov rbx, r8
mov rdi, rcx
jne 0x1401ad79d
mov dword [r8], 1
or rax, rbp
jmp 0x1401ad846
mov eax, 0x10624dd3
mov dword [r8], 7
mul dword [rdx]
mov esi, edx
shr esi, 4
test r14, r14
je 0x1401ad7ca
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x18]
call qword [case.0x1401ad3ca.0]
cmp eax, 6
je 0x1401ad843
cmp qword [rdi + 0x18], 7
mov rcx, rdi
jbe 0x1401ad7d7
mov rcx, qword [rdi]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x4110100
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1401ad840
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
cmp eax, 2
je 0x1401ad81d
cmp eax, 0xe7
jne 0x1401ad832
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
dec esi
test eax, eax
jne 0x1401ad7b0
jmp 0x1401ad843
lea rcx, [rsp + 0x60]
call fcn.1401ad654
mov dword [rbx], eax
jmp 0x1401ad843
and dword [rbx], 0
mov rax, rbp
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1401ad85c
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
or rsi, 0xffffffffffffffff
mov dword [r8], 7
cmp qword [rcx + 0x10], 0
mov rbx, r8
mov rdi, rcx
jne 0x1401ad88f
mov dword [r8], 1
jmp 0x1401ad950
and qword [rsp + 0x70], 0
lea r8, [rsp + 0x70]
xor r9d, r9d
lea rcx, str.S:_ML__NW___LW_
lea edx, [r9 + 1]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov rax, qword [rsp + 0x70]
and dword [rsp + 0x50], 0
mov qword [rsp + 0x48], rax
mov al, byte [0x140271544]
neg al
mov dword [rsp + 0x40], 0x18
sbb edx, edx
and edx, 0x80000
inc edx
cmp qword [rdi + 0x18], 7
jbe 0x1401ad8e0
mov rdi, qword [rdi]
lea rax, [rsp + 0x40]
mov r9d, 0xff
mov qword [rsp + 0x38], rax
mov r8d, 8
and dword [rsp + 0x30], 0
mov eax, 0x400
mov dword [rsp + 0x28], eax
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rcx, qword [rsp + 0x70]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp rsi, 0xffffffffffffffff
jne 0x1401ad93d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], eax
call fcn.1401ad654
mov dword [rbx], eax
jmp 0x1401ad950
cmp byte [0x140271544], 0
je 0x1401ad94d
mov byte [0x140271544], 0
and dword [rbx], 0
lea r11, [rsp + 0x60]
mov rax, rsi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1401ad968
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
xor edi, edi
mov dword [r8], 7
cmp qword [rcx], 0xffffffffffffffff
mov rbx, r8
mov r14, rdx
mov rsi, rcx
jne 0x1401ad99a
mov dword [r8], 1
jmp 0x1401ada4d
mov rcx, qword [rcx]
lea r9, [rbp + 0x48]
and dword [rbp + 0x40], edi
lea rdx, [rbp + 0x40]
and dword [rbp + 0x48], edi
mov r8d, 4
and qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401ad9d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x30], eax
cmp eax, 0xea
je 0x1401ad9d6
lea rcx, [rbp + 0x30]
jmp 0x1401ada46
cmp dword [rbp + 0x40], 0x1fffff
jbe 0x1401ad9e7
mov dword [rbx], 3
jmp 0x1401ada4d
mov edx, dword [rbp + 0x40]
lea r8, [rbp + 0x30]
mov rcx, r14
call fcn.1400059b6
mov ecx, dword [rbp + 0x40]
mov rdx, qword [r14]
lea r9, [rbp + 0x30]
and dword [rbp + 0x30], 0
sub ecx, edi
and qword [rsp + 0x20], 0
mov r8d, ecx
mov rcx, qword [rsi]
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401ada2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x10], eax
cmp eax, 0xea
jne 0x1401ada42
mov eax, dword [rbp + 0x30]
and dword [rbx], 0
add rdi, rax
mov ecx, dword [rbp + 0x40]
cmp rdi, rcx
jb 0x1401ad9f9
jmp 0x1401ada4d
lea rcx, [rbp - 0x10]
call fcn.1401ad654
mov dword [rbx], eax
mov rax, rdi
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401ada5c
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [rcx]
mov rsi, rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor ebx, ebx
test eax, eax
jne 0x1401adaa7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x1401adaa7
mov dil, bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], eax
call fcn.1401ad654
mov ebx, eax
jmp 0x1401adaaa
mov dil, 1
mov dword [rsi], ebx
mov al, dil
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1401adac0
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rdi, rdx
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x30]
mov qword [rbp - 0x20], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rbx
mov ecx, 0x18
call fcn.140172d74
test rax, rax
je 0x1401adb1f
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rax], xmm0
movsd xmm1, qword [rbp - 0x10]
movsd qword [rax + 0x10], xmm1
mov qword [rbp + 0x38], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1401ad5d0]
xor edx, edx
xor ecx, ecx
call fcn.14018b6cc
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1401adbb5
mov rdx, rdi
mov rcx, rbx
call fcn.1401ada5c
mov bl, al
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [rbp - 0x28], 0
je 0x1401adbc4
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp - 0x28], eax
je 0x1401adbcf
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x20], xmm0
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.140152fd8
test eax, eax
jne 0x1401adbda
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [rbp - 0x28], 0
jne 0x1401adbaf
mov al, bl
add rsp, 0x60
pop rdi
pop rbx
pop rbp
ret
call fcn.14018ad1c
nop
and dword [rbp - 0x28], 0
mov ecx, 6
call fcn.140153528
nop
mov ecx, 1
call fcn.140153528
int3
mov ecx, 5
call fcn.140153528
int3
mov ecx, 2
call fcn.140153528
int3
Function at 0x1401adbe8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor edi, edi
mov dword [r9], 7
cmp qword [rcx], 0xffffffffffffffff
mov rbx, r9
mov rsi, r8
mov rbp, rdx
mov r14, rcx
jne 0x1401adc1e
mov dword [r9], 1
jmp 0x1401adc98
cmp qword [r8], 0x1fffff
jbe 0x1401adc30
mov dword [r9], 3
jmp 0x1401adc98
mov eax, dword [r8]
lea r9, [rsp + 0x50]
mov rcx, qword [rcx]
lea rdx, [rsp + 0x68]
mov r8d, 4
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401adc75
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
call fcn.1401ad654
mov dword [rbx], eax
jmp 0x1401adc98
mov r8d, dword [rsi]
lea r9, [rsp + 0x50]
mov rcx, qword [r14]
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1401adc5d
mov dword [rbx], edi
mov edi, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1401dcb00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xe0
mov rsi, r8
mov r14, rdx
mov rdi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 7
jbe 0x1401dcb2f
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15d, eax
cmp eax, 0xffffffff
jne 0x1401dcbc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movsxd rbx, eax
test rsi, rsi
je 0x1401dcb64
mov dword [rsi], ebx
test eax, eax
setne cl
mov byte [rsi + 4], cl
lea rax, [0x1401fe9e8]
mov qword [rsi + 8], rax
cmp ebx, 0x35
ja 0x1401dcb79
movabs rcx, 0x2000000020800c
bt rcx, rbx
jb 0x1401dcbb9
cmp ebx, 0x7b
je 0x1401dcbb9
cmp ebx, 0x57
je 0x1401dcbb9
cmp ebx, 0xa1
je 0x1401dcbb9
cmp ebx, 0x20
jne 0x1401dcba2
mov dword [rdi], 0xa
mov dword [rdi + 4], 0xffff
jmp 0x1401dcceb
test rsi, rsi
je 0x1401dcd0a
xor ebp, ebp
mov dword [rdi + 4], 0xffff
jmp 0x1401dcce9
mov qword [rdi], 1
jmp 0x1401dcceb
mov edx, r15d
mov rcx, r14
call fcn.1401dc8a0
mov r12d, eax
xor ebp, ebp
bt r15d, 0xa
jae 0x1401dcca4
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x1401dcbed
mov rdx, qword [r14]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], bp
jne 0x1401dcc05
lea rcx, [rsp + 0x40]
call fcn.14004eb54
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x118], rax
lea rcx, [rsp + 0x40]
call fcn.140054cd8
cmp rbx, 0xffffffffffffffff
jne 0x1401dcc7a
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.1401dc9f0
nop
jmp 0x1401dcceb
mov rcx, r14
call fcn.1401dc780
test al, al
jne 0x1401dcc9b
mov dword [rdi], 9
mov dword [rdi + 4], r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401dcceb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x1401dccba
mov dword [rsi], ebp
mov byte [rsi + 4], 0
lea rax, [0x1401fe9e8]
mov qword [rsi + 8], rax
and r15d, 0x10
je 0x1401dccc9
mov eax, dword [rsp + 0x118]
jmp 0x1401dccd4
mov eax, r12d
mov r12d, dword [rsp + 0x118]
test r15d, r15d
setne bpl
add ebp, 2
test r15d, r15d
cmove r12d, eax
mov dword [rdi + 4], r12d
mov dword [rdi], ebp
mov rax, rdi
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rdx, str.boost::filesystem::status
lea rcx, [rsp + 0x70]
call fcn.140035de0
nop
call fcn.1400c0bc0
mov r8, rax
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.1401dc3a0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x60]
mov r8, r14
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x90]
call fcn.1401dd500
lea rdx, [0x14026c100]
lea rcx, [rsp + 0x90]
call fcn.140174178
int3
Function at 0x1401dde50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401dde78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1401dde78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret