joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001b50
Capabilities:
Read pipe
Write pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp + 0x20], r9d
push rsi
sub rsp, 0x40
xor ebx, ebx
mov rbp, r8
mov rsi, rdx
test rdx, rdx
je 0x140001c98
xor ecx, ecx
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 3]
mov dword [rsp + 0x28], 0x190000
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001c11
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x140001c81
mov edx, dword [rsp + 0x88]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x140001c81
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 3]
mov dword [rsp + 0x28], 0x190000
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001c81
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
jne 0x140001c72
xor r9d, r9d
mov dword [rsp + 0x68], 2
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x140001c72
mov rax, qword [rsp + 0x80]
mov r8d, 0x410
mov r9, qword [rsp + 0x70]
mov rdx, rbp
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x40c
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov ebx, eax
cmp rdi, 0xffffffffffffffff
je 0x140001c81
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
Function at 0x140007420
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov esi, r8d
mov r14, rdx
mov rdi, rcx
mov dword [rbp + 0x67], 0
xor eax, eax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, rax
mov qword [rbp + 0x7f], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 1], rax
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + 0x28]
mov qword [rbp + 7], rcx
cmp rbx, 0xffffffffffffffff
je 0x1400075d4
nop word [rax + rax]
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x67]
mov r8d, esi
mov rdx, r14
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000752f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140007524
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rbp - 1]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x1400074f4
cmp eax, 1
je 0x140007586
jmp 0x1400074a0
mov r9d, 1
lea r8, [rbp + 0x67]
lea rdx, [rbp - 0x59]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x14000752f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x1400075a0
jmp 0x14000760a
cmp eax, 0x6d
je 0x1400075ba
jmp 0x140007550
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
xor r9d, r9d
lea r8, [r9 - 1]
lea rdx, str.Read_Error
lea rcx, [rbp + 0x17]
call fcn.14000f830
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x39]
call fcn.140006e70
lea rdx, [0x14003ae78]
lea rcx, [rbp - 0x39]
call fcn.140014260
nop
lea rcx, [rbp - 0x39]
call fcn.140006ee0
lea rdx, [0x14003aee0]
lea rcx, [rbp - 0x39]
call fcn.140014260
int3
lea rcx, [rbp - 0x39]
call fcn.140006ee0
lea rdx, [0x14003aee0]
lea rcx, [rbp - 0x39]
call fcn.140014260
int3
lea rcx, [rbp - 0x39]
call fcn.140006ee0
lea rdx, [0x14003aee0]
lea rcx, [rbp - 0x39]
call fcn.140014260
int3
xor r9d, r9d
lea r8, [r9 - 1]
lea rdx, str.Failed_to_create_connection
lea rcx, [rbp + 0x17]
call fcn.14000f830
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x39]
call fcn.140006e70
lea rdx, [0x14003ae78]
lea rcx, [rbp - 0x39]
call fcn.140014260
nop
xor r9d, r9d
lea r8, [r9 - 1]
lea rdx, str.unexpected_error
lea rcx, [rbp + 0x17]
call fcn.14000f830
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x39]
call fcn.140006e70
lea rdx, [0x14003ae78]
lea rcx, [rbp - 0x39]
call fcn.140014260
int3
Function at 0x1400076b0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov esi, r8d
mov r14, rdx
mov rdi, rcx
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x140007853
mov dword [rbp + 0x67], 0
xor eax, eax
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, rax
mov qword [rbp + 0x7f], rax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + 0x28]
mov qword [rbp - 0x41], rcx
cmp rbx, 0xffffffffffffffff
je 0x14000786d
nop word [rax + rax]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x67]
mov r8d, esi
mov rdx, r14
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400077ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1400077ce
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rbp - 0x49]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x140007794
cmp eax, 1
je 0x14000781f
jmp 0x140007740
mov r9d, 1
lea r8, [rbp + 0x67]
lea rdx, [rbp - 0x69]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
cmp eax, 0xe8
je 0x140007839
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe9
je 0x140007839
xor r9d, r9d
lea r8, [r9 - 1]
lea rdx, str.Connection_Closed
lea rcx, [rbp + 7]
call fcn.14000f830
nop
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.140006e70
lea rdx, [0x14003ae78]
lea rcx, [rbp - 0x39]
call fcn.140014260
nop
lea rcx, [rbp - 0x39]
call fcn.140006ee0
lea rdx, [0x14003aee0]
lea rcx, [rbp - 0x39]
call fcn.140014260
int3
lea rcx, [rbp - 0x39]
call fcn.140006ee0
lea rdx, [0x14003aee0]
lea rcx, [rbp - 0x39]
call fcn.140014260
nop
lea rcx, [rbp + 7]
call fcn.140006ee0
lea rdx, [0x14003aee0]
lea rcx, [rbp + 7]
call fcn.140014260
nop
xor r9d, r9d
lea r8, [r9 - 1]
lea rdx, str.Failed_to_create_connection
lea rcx, [rbp + 7]
call fcn.14000f830
nop
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.140006e70
lea rdx, [0x14003ae78]
lea rcx, [rbp - 0x39]
call fcn.140014260
int3
Function at 0x1400078b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov dword [rsp + 0x38], 0xfffe00ff
lea rdx, [rsp + 0x38]
mov r8d, 4
mov rdi, rcx
call fcn.1400076b0
mov r8d, 4
mov dword [rsp + 0x38], 0x10000
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.1400076b0
mov eax, dword [rbx + 0xc]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov dword [rsp + 0x38], eax
mov rcx, rdi
call fcn.1400076b0
mov eax, dword [rbx + 8]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov dword [rsp + 0x38], eax
mov rcx, rdi
call fcn.1400076b0
mov eax, dword [rbx + 0x10]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov dword [rsp + 0x38], eax
mov rcx, rdi
call fcn.1400076b0
mov r8d, dword [rbx + 0x10]
mov rcx, rdi
mov rdx, qword [rbx + 0x18]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400076b0
Function at 0x140011b30
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov ecx, dword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140011b4d
cmp dword [rax], 0
jne 0x140011b57
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, rbx
call fcn.140011ce0
inc dword [rax]
add rsp, 0x20
pop rbx
ret

Function at 0x140011b70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, qword [rcx + 8]
mov ecx, dword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140011be1
cmp dword [rax], 0
jbe 0x140011be1
mov ecx, dword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140011c04
add dword [rax], 0xffffffff
jne 0x140011bb8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140011c27
mov ecx, dword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140011bcb
cmp dword [rax], 0
jne 0x140011bdb
lea rcx, [rbx + 0x10]
add rsp, 0x60
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x60
pop rbx
ret
lea rdx, str.must_own_monitor_prior_to_calling_exit__
lea rcx, [rsp + 0x20]
call fcn.140005540
lea rdx, [0x14003ae30]
lea rcx, [rsp + 0x20]
call fcn.140014260
int3
lea rdx, str.likely_unbalanced_enter_exit_monitor_pair__extra_exit_
lea rcx, [rsp + 0x20]
call fcn.140005540
lea rdx, [0x14003ae30]
lea rcx, [rsp + 0x20]
call fcn.140014260
int3
lea rdx, str.unable_to_set_tls_value
lea rcx, [rsp + 0x20]
call fcn.140005540
lea rdx, [0x14003ae30]
lea rcx, [rsp + 0x20]
call fcn.140014260
int3

Function at 0x140011c50
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rdi, rcx
mov ecx, 0x38
call fcn.1400127c4
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140011cac
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx + 8], eax
cmp eax, 0xffffffff
je 0x140011cbd
lea rcx, [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x140011cae
xor ebx, ebx
mov qword [rdi + 8], rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
lea rdx, str.unable_to_create_tls_index
lea rcx, [rsp + 0x28]
call fcn.140005540
lea rdx, [0x14003ae30]
lea rcx, [rsp + 0x28]
call fcn.140014260
int3
Function at 0x140011ce0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140011d28
lea edx, [rax + 4]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140011d36
mov dword [rax], 0
mov rdx, rax
mov ecx, dword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140011d59
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
lea rdx, str.unable_to_create_tls_data
lea rcx, [rsp + 0x20]
call fcn.140005540
lea rdx, [0x14003ae30]
lea rcx, [rsp + 0x20]
call fcn.140014260
int3
lea rdx, str.unable_to_set_tls_value
lea rcx, [rsp + 0x20]
call fcn.140005540
lea rdx, [0x14003ae30]
lea rcx, [rsp + 0x20]
call fcn.140014260
int3

Function at 0x140011e30
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov ecx, 8
call fcn.1400127c4
xor edx, edx
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140011e54
mov qword [rax], rdx
jmp 0x140011e57
mov rax, rdx
mov qword [rsp + 0x28], rdx
lea r8, [0x140011f00]
mov dword [rsp + 0x20], edx
mov r9, rbx
xor edx, edx
mov qword [rbx + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbx + 0x20]
mov qword [rcx], rax
add rsp, 0x30
pop rbx
ret
Function at 0x140001f80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov edi, ecx
mov ecx, 0x18
call fcn.1400024e8
mov qword [rax], rbx
mov dword [rax + 8], edi
lea rcx, [0x140001d00]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140002480]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140002199
cmp dword [rsp + 0x38], ebx
jne 0x14000200f
lea ecx, [rbx + 1]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x140002032
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140002059
imul rdi, rax, 0x64
jmp 0x140002074
cqo
idiv rbx
imul rdi, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rdi, rax
movabs rax, 0x7ffffffff4143dff
cmp rdi, rax
jge 0x14000208c
add rdi, 0xbebc200
jmp 0x140002096
movabs rdi, 0x7fffffffffffffff
movabs rsi, 0x311cdad160000
movabs rbp, 0x112e0be826d694b3
movsd xmm6, qword [0x1400047c0]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400020d0
imul rax, rax, 0x64
jmp 0x1400020eb
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x140002161
mov rbx, rdi
sub rbx, rax
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rdx, rax, 0x64
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
comisd xmm0, xmm6
seta r8b
test r8b, r8b
lea rcx, [rdx + rsi]
jne 0x14000211d
lea rcx, [rdx + rbx]
lea rax, [rdx + rbx]
add rdx, rsi
test r8b, r8b
cmove rdx, rax
mov rax, rbp
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x40], rdx
imul rax, rdx, 0x3b9aca00
sub ecx, eax
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x1400020b2
cmp dword [rsp + 0x38], 0
je 0x14000216f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400024c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [rsp + 0x60]
mov rsp, r11
pop rdi
ret
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140002e70
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1400bc088]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov ecx, eax
mov ebx, eax
call fcn.14005d8b4
mov r9, rax
lea rcx, [rsp + 0x40]
mov r8d, ebx
xor edx, edx
mov rdi, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
lea r9, [rsp + 0x20]
mov rcx, rdi
lea r8, [rsp + 0x28]
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueA]
mov rcx, qword [rsp + 0x28]
lea rdx, str.StringFileInfo_04x_04xProductVersion
movzx r9d, word [rcx + 2]
movzx r8d, word [rcx]
lea rcx, [rsp + 0x150]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0x24]
mov rcx, rdi
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x150]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
mov rdx, qword [rsp + 0x30]
lea rcx, [0x1400bdf80]
call fcn.140007cd0
mov rcx, rdi
call fcn.14005d3b0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140037f80
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x140038714
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400387a5
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x1400387a5
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400387a5
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140038789
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140038783
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14003878b
add rdx, 0x28
jmp 0x140038768
xor edx, edx
test rdx, rdx
jne 0x140038794
xor al, al
jmp 0x1400387ab
test dword [rdx + 0x24], 0x80000000
je 0x1400387a1
xor al, al
jmp 0x1400387ab
mov al, 1
jmp 0x1400387ab
xor al, al
jmp 0x1400387ab
add rsp, 0x18
ret
Function at 0x14007bcdc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140038cf0
sub rsp, rax
mov rax, qword [0x1400bc088]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r14, rdx
mov rbx, rcx
call fcn.14007719c
xor esi, esi
movsxd r12, eax
cmp dword [rbx + 0x10], esi
jne 0x14007bd30
mov rax, r14
jmp 0x14007be4a
mov rax, qword [rbx]
mov rdi, r12
sub rax, qword [rbx + 8]
xor r8d, r8d
cqo
sar rdi, 6
sub rax, rdx
mov rbx, r12
sar rax, 1
and ebx, 0x3f
mov r15, rax
shl rbx, 6
lea rax, [0x140000000]
mov ecx, r12d
mov rdx, qword [rax + rdi*8 + 0xbfa10]
mov rbp, r12
mov rdx, qword [rbx + rdx + 0x30]
call fcn.14007c944
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rdi*8 + 0xbfa10]
cmp r13, qword [rbx + rcx + 0x30]
je 0x14007bd97
or rax, 0xffffffffffffffff
jmp 0x14007be4a
mov rcx, rbp
mov qword [rsp + 0x20], rsi
sar rcx, 6
lea r9, [rsp + 0x30]
and ebp, 0x3f
lea rdx, [rsp + 0x40]
shl rbp, 6
mov r8d, 0x1000
mov rcx, qword [rax + rcx*8 + 0xbfa10]
mov rcx, qword [rcx + rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007bd8e
xor r8d, r8d
mov rdx, r14
mov ecx, r12d
call fcn.14007c944
test rax, rax
js 0x14007bd8e
mov eax, dword [rsp + 0x30]
cmp r15, rax
jg 0x14007bd8e
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test r15, r15
je 0x14007be3e
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14007be3e
cmp byte [rcx], 0xd
jne 0x14007be24
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14007be33
cmp byte [rcx + 1], 0xa
jne 0x14007be33
inc rcx
jmp 0x14007be33
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0xbcad0]
add rcx, rax
inc rsi
inc rcx
cmp rsi, r15
jne 0x14007be06
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140037f80
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140082f54
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
call fcn.14007fb80
cmp eax, 2
sete dil
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140082fa1
test rbx, rbx
je 0x140082f95
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test dil, dil
je 0x140082fd8
mov eax, 4
jmp 0x140082fe7
test dil, dil
je 0x140082fd8
call fcn.140079b40
test al, al
je 0x140082fd8
call fcn.140079e30
test al, al
jne 0x140082fce
bts esi, 0x15
xor ecx, ecx
mov rdx, rbx
mov r8, rbp
mov r9d, esi
call fcn.1400799c4
jmp 0x140082fe7
call fcn.140079d6c
mov rcx, rax
jmp 0x140082fbe
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb eax, eax
neg eax
add eax, 3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140089160
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r10, [0x1400bfa10]
mov r14, rdx
mov rax, r15
sar rax, 6
mov rdx, r15
and edx, 0x3f
mov rdi, r15
shl rdx, 6
mov r9, qword [r10 + rax*8]
mov r12, qword [r9 + rdx + 0x28]
test r8, r8
je 0x1400891c5
cmp byte [r14], 0xa
jne 0x1400891c5
mov rcx, r15
mov rax, r15
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
or byte [rax + rcx + 0x38], 4
jmp 0x1400891e6
mov dl, byte [r9 + rdx + 0x38]
mov rcx, rdi
and dl, 0xfb
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x38], dl
lea rbp, [r14 + r8]
mov rsi, r14
mov rbx, r14
cmp r14, rbp
jae 0x140089340
mov r13d, 1
mov al, byte [rsi]
cmp al, 0x1a
je 0x140089300
cmp al, 0xd
je 0x14008921a
mov byte [rbx], al
add rbx, r13
add rsi, r13
jmp 0x1400892f5
lea rax, [rsi + 1]
cmp rax, rbp
jae 0x140089240
cmp byte [rax], 0xa
jne 0x140089232
mov byte [rbx], 0xa
mov eax, 2
jmp 0x140089238
mov byte [rbx], 0xd
mov rax, r13
add rsi, rax
jmp 0x1400892f2
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, r13d
lea rdx, [rsp + 0x70]
mov rcx, r12
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400892e8
cmp dword [rsp + 0x78], 0
je 0x1400892e8
mov rcx, rdi
lea r10, [0x1400bfa10]
and ecx, 0x3f
mov rax, rdi
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
test byte [rax + rcx + 0x38], 0x48
je 0x1400892b8
mov dl, byte [rsp + 0x70]
cmp dl, 0xa
je 0x1400892c4
mov rcx, rdi
mov byte [rbx], 0xd
mov rax, rdi
and ecx, 0x3f
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x3a], dl
jmp 0x1400892f2
cmp byte [rsp + 0x70], 0xa
jne 0x1400892c9
cmp rbx, r14
jne 0x1400892c9
mov byte [rbx], 0xa
jmp 0x1400892f2
mov r8d, r13d
or rdx, 0xffffffffffffffff
mov ecx, r15d
call fcn.14007c94c
cmp byte [rsp + 0x70], 0xa
lea r10, [0x1400bfa10]
je 0x1400892f5
jmp 0x1400892ef
lea r10, [0x1400bfa10]
mov byte [rbx], 0xd
add rbx, r13
cmp rsi, rbp
jb 0x1400891ff
jmp 0x140089340
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov dl, byte [rax + rcx + 0x38]
test dl, 0x40
jne 0x140089339
mov rax, rdi
or dl, 2
sar rax, 6
and edi, 0x3f
shl rdi, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rdi + 0x38], dl
jmp 0x140089340
mov cl, byte [rsi]
mov byte [rbx], cl
add rbx, r13
sub rbx, r14
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret