joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140f3b058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140f3b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f3b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f3b06f
add dl, dl
jne 0x140f3b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f3b0f6
xor eax, eax
add dl, dl
jne 0x140f3b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f3b1ad
add dl, dl
jne 0x140f3b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f3b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f3b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f3b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f3b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f3b07e
mov eax, 1
add dl, dl
jne 0x140f3b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f3b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f3b0fb
sub eax, ebx
mov ebx, 1
jne 0x140f3b14c
mov ecx, 1
add dl, dl
jne 0x140f3b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f3b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f3b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f3b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f3b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f3b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f3b15d
cmp eax, 0x7d00
jae 0x140f3b19b
cmp eax, 0x500
jb 0x140f3b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f3b07e
cmp eax, 0x7f
ja 0x140f3b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f3b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f3b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f3b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x680950
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x68095d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x68096d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x680955
lea eax, [rcx + 1]
jmp 0x68097b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x68098e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x680974
sub eax, 3
jb 0x6809ae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x6809fd
sar eax, 1
movsxd rbp, eax
jb 0x6809e4
jmp 0x6809bc
add ebx, ebx
jne 0x6809ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x6809e4
inc ecx
add ebx, ebx
jne 0x6809ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x6809e4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x6809dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x6809cc
add ecx, 2
jmp 0x6809e9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00680912
jmp 0x68095d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x8aa00
mov dl, 0x1c
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x680a49
cmp rsi, rcx
jae 0x680a51
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x680a30
cmp al, 0x8f
ja 0x680a30
cmp byte [rsi - 2], 0xf
je 0x680a36
sub al, 0xe8
cmp al, 1
ja 0x680a1a
cmp rsi, rcx
jae 0x680a51
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x680a20
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x680a51
lodsb al, byte [rsi]
jmp 0x680a30
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x27d000]
mov eax, dword [rdi]
or eax, eax
je 0x680aae
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x280000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x680a5e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x680aa8
mov qword [rbx], rax
add rbx, 8
jmp 0x680a7e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x680ae8
cmp al, 0xef
ja 0x680ada
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x680aba
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x680ac9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x680b3c
sub rsp, 0xffffffffffffff80
jmp 0x463d80
Function at 0x140f90ee0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140f90eed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140f90efd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140f90ee5
lea eax, [rcx + 1]
jmp 0x140f90f0b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140f90f1e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140f90f04
sub eax, 3
jb 0x140f90f3e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140f90f8d
sar eax, 1
movsxd rbp, eax
jb 0x140f90f74
jmp 0x140f90f4c
add ebx, ebx
jne 0x140f90f4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140f90f74
inc ecx
add ebx, ebx
jne 0x140f90f5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140f90f74
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140f90f6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140f90f5c
add ecx, 2
jmp 0x140f90f79
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140f90ea2
jmp 0x140f90eed
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xf8c000]
mov eax, dword [rdi]
or eax, eax
je 0x140f90fe9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xf9cb90]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140f90f99
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140f90fe3
mov qword [rbx], rax
add rbx, 8
jmp 0x140f90fb9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140f9102d
cmp al, 0xef
ja 0x140f91015
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140f90ff5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140f91004
mov eax, dword [rdi]
add rdi, 4
jmp 0x140f91004
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140f910ac], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140f910ac
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140f9109c
sub rsp, 0xffffffffffffff80
jmp 0x140001125
Function at 0x140011208
Capabilities:
Terminate process

Disassembly:
jmp 0x140013210
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011294
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014560
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014580
xor al, al
jmp 0x140014601
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014593
xor al, al
jmp 0x140014601
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400145bd
xor al, al
jmp 0x140014601
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400145d1
xor al, al
jmp 0x140014601
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400145e3
xor al, al
jmp 0x140014601
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400145ff
xor al, al
jmp 0x140014601
mov al, 1
add rsp, 0x38
ret
Function at 0x140012450
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113bb
movzx eax, al
test eax, eax
jne 0x140012470
mov ecx, 7
call fcn.140011334
nop
mov byte [rsp + 0x20], 0
call fcn.140011348
mov byte [rsp + 0x21], al
cmp dword [0x14001d868], 1
jne 0x140012494
mov ecx, 7
call fcn.140011334
nop
jmp 0x1400124ec
cmp dword [0x14001d868], 0
jne 0x1400124e7
mov dword [0x14001d868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111b3
test eax, eax
je 0x1400124c8
mov eax, 0xff
jmp 0x1400125f1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.14001133e
mov dword [0x14001d868], 2
jmp 0x1400124ec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001131b
call fcn.1400112b7
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012549
mov rcx, qword [rsp + 0x30]
call fcn.140011163
movzx eax, al
test eax, eax
je 0x140012549
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140023020]
nop
call fcn.1400112e9
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001257d
mov rcx, qword [rsp + 0x38]
call fcn.140011163
movzx eax, al
test eax, eax
je 0x14001257d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001137a
nop
call fcn.1400126a0
mov dword [rsp + 0x28], eax
call fcn.140011294
movzx eax, al
test eax, eax
jne 0x14001259c
mov ecx, dword [rsp + 0x28]
call fcn.14001105f
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400125ab
call fcn.140011384
nop
xor edx, edx
mov cl, 1
call fcn.140011154
mov eax, dword [rsp + 0x28]
jmp 0x1400125f1
add rsp, 0x68
ret
Function at 0x140006f96
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, [0x1400089dd]
call sub.msvcrt.dll_getenv
jmp 0x140007118
lea rcx, [0x1400089e1]
lea rdx, [0x1400089d9]
mov r8, rax
mov rax, qword [0x14000948a]
call rax
mov rsi, rax
lea rdi, [0x1400089e1]
lea r12, [0x1400072af]
push r12
push rsi
push r15
push r14
push rbx
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov rcx, 0x34e4
mov r10, 0xa743
mov qword [rbp - 0x1d], r14
mov word [rbp - 0x5e], si
or rsi, qword [rbp - 0x23]
add r14, qword [rbp - 0xa4]
mov rax, qword [rbp - 0x3c]
mov qword [rbp - 0xe], r11
mov qword [rbp - 0x2d], rdx
add r9, r8
add ebx, 0x3e2b
mov r10, r14
cmp edx, ebx
js 0x140007193
mov eax, ebx
mov eax, ecx
or dword [0x140008006], edx
mov r10, qword [rbp - 0x3a]
mov esi, dword [0x140008009]
add r9, qword [rbp - 0x7d]
mov rax, qword [rbp - 0x15]
mov r8, qword [rbp - 0xa4]
mov byte [rbp - 0x1b], bh
lea ecx, [rbp - 0x3c]
mov dword [rbp - 0xa5], edx
mov rbx, r14
mov eax, dword [rbp - 0xb]
mov esi, dword [rbp - 0x58]
mov r15, 0x3d96
mov eax, dword [rbp - 0x8c]
cmp rsi, qword [0x140008003]
je 0x140007215
xor dword [rbp - 0x24], eax
mov eax, 0xb860
mov dword [rbp - 0x74], edx
mov bl, ch
sub ecx, 0xd16b
mov r11, rcx
lea rbx, [rbp - 5]
mov dword [rbp - 0x65], edx
mov r10, qword [rbp - 0x35]
and dword [rbp - 0x1d], ebx
mov dword [rbp - 0x49], edx
and r14, r11
mov qword [rbp - 0x45], r9
mov dword [rbp - 0xa4], edx
mov r14, qword [rbp - 0x37]
mov rcx, qword [rbp - 0x51]
mov r15, qword [rbp - 0x2e]
mov edx, edx
mov qword [rbp - 0x14], rcx
mov edx, 0x79f0
mov ecx, dword [rbp - 0x2c]
cmp eax, eax
jmp 0x14000726c
mov esi, eax
movzx eax, dl
sub eax, 0x50f7
push r9
mov ecx, dword [0x14000800d]
mov esi, 0x1637
movzx eax, ax
mov r11, qword [0x140008007]
cmp rdx, qword [0x14000800a]
je 0x1400072a3
mov rax, r10
mov qword [rbp - 0x3f], r14
xor ebx, 0xe0c0
pop r14
leave
pop rbx
pop r14
pop r15
pop rsi
ret
Function at 0x140013ec0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140013f60
jmp 0x140013f4f
jae 0x14001401f
cmp r8, 0x201
jae 0x140013f60
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140013fb7
sub r8, rbx
sub rdi, rbx
cmp r8, rdi
jbe 0x140013f8f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.1400363d0
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140013fe0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001408b
mov r8d, r13d
cmp r12, r8
jne 0x140013f40
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400140bf
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140013f4f
jmp 0x140013f60
cmp r14, r8
jb 0x1400140d9
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140016ae0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140014074
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.14000d320
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14001405f
jmp 0x140014074
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140037780
jmp 0x1400140ee
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140037b30
ud2
Function at 0x14001a020
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.1400356e0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r15, rcx
lea r12, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xorps xmm6, xmm6
lea r13, [rbp + 0xffc]
lea rbx, [0x14001f520]
lea r14, [rbp + 0xfb0]
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1010], r15
mov r8d, 0x1000
mov rcx, r15
mov rdx, r12
call case.0x14001f070.237
mov r15, rdx
mov qword [rbp + 0xfd8], rax
mov qword [rbp + 0xfe0], rdx
test rax, rax
jne 0x14001a210
test r15, r15
je 0x14001a1dc
cmp r15, 0x1000
ja 0x14001a232
xor r12d, r12d
nop word cs:[rax + rax]
mov r8d, r15d
sub r8d, r12d
lea rdx, [r12 + rbp]
add rdx, 0xffffffffffffffb0
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r13
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbp + 0x1008]
mov r9, r14
call rsi
test eax, eax
je 0x14001a1b0
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x14001a140
mov ecx, dword [rbp + 0x1000]
mov eax, dword [rbp + 0x1004]
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
xor r8d, r8d
test ecx, ecx
setne r8b
cmove rdx, rax
mov qword [rbp + 0xfe8], r8
mov qword [rbp + 0xff0], rdx
jne 0x14001a1d0
add r12, rax
cmp r12, r15
je 0x14001a1a0
jbe 0x14001a0f0
jmp 0x14001a21e
mov r15, qword [rbp + 0x1010]
lea r12, [rbp - 0x50]
jmp 0x14001a09e
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe8], 1
mov qword [rbp + 0xff0], rax
lea rcx, [rbp + 0xff0]
call fcn.14000e580
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xfe0]
call fcn.14000e580
jmp 0x14001a1dc
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.140037ba0
jmp 0x14001a246
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.140037b30
ud2
Function at 0x14001d910
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14003bb68]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14001d948
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14001d99f
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x14001d9ac
xor edx, edx
xor eax, eax
jmp 0x14001d9d6
cmp eax, 0x103
je 0x14001d9e0
test eax, eax
js 0x14001d9bf
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14001d9d6
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140016890
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14000ebd0
mov ecx, 7
int 0x29
ud2

Function at 0x14001da30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14003bb68]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x14001da68
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14001dac6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x14001daf3
test eax, eax
js 0x14001dad2
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x14001dae9
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140016890
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14000ebd0
mov ecx, 7
int 0x29
ud2
Function at 0x14001e610
Capabilities:
Create pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xc0], xmm6
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov qword [rbp + 0x70], rcx
mov byte [rbp + 0xb5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x64], ecx
mov r12d, 8
mov sil, 1
xorps xmm6, xmm6
lea rbx, [rbp + 0x20]
mov r13, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
xor edi, edi
xor eax, eax
mov qword [rbp - 8], rax
nop word cs:[rax + rax]

Function at 0x14001fa10
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rdi, rdx
cmp qword [rdx], 0
jne 0x14001fb53
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp r8, rdx
je 0x14001fb28
sub r8, rdx
add rdx, qword [rbx + 8]
mov rax, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp r8, rcx
cmovae r8, rcx
mov dword [rbp - 0x38], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001fa90
mov eax, dword [rbp - 0x38]
mov ecx, 2
test rax, rax
je 0x14001fad2
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
jmp 0x14001fad6
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x38], rax
movabs rcx, 0xffffffff00000000
and rcx, rax
movabs rdx, 0x6d00000000
cmp rcx, rdx
je 0x14001fada
movabs rdx, 0x3e500000000
cmp rcx, rdx
jne 0x14001fb04
mov rax, rbp
jmp 0x14001fae6
mov byte [rsi + 1], 0
xor eax, eax
jmp 0x14001fb0a
mov qword [rbp], 1
lea rax, [rbp - 8]
mov qword [rax], 0
lea rcx, [rbp - 0x38]
call fcn.14000e580
mov rcx, qword [rbp]
mov rax, qword [rbp - 8]
cmp rcx, 2
jne 0x14001fb15
mov qword [rsi + 8], rax
mov al, 1
mov byte [rsi], al
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
test rcx, rcx
jne 0x14001fa79
mov ecx, 1
jmp 0x14001fa83
test r8, r8
mov ecx, 0x10
mov eax, 1
cmove rax, rcx
mov rcx, rbx
mov rdx, r8
mov r8, rax
call fcn.140036470
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x14001fa41
mov qword [rbp - 0x38], 0
lea rdx, [rbp - 0x38]
mov rcx, rdi
call fcn.140036340
int3