joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025b40
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, r8
mov esi, edx
lea rcx, [rsp + 0x28]
call fcn.140020e00
nop
call fcn.140004ca0
mov rcx, rax
test rax, rax
je 0x140025d04
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov rbx, 0xffffffffffffffff
test rdi, rdi
je 0x140025bcc
cmp rdi, 0x10000
jae 0x140025bb8
movzx edx, di
lea rcx, [rsp + 0x20]
call fcn.140005670
jmp 0x140025bdf
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140025bc0
jmp 0x140025bce
xor eax, eax
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14000ae30
nop
mov dword [rsp + 0x30], esi
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffffffe8
call fcn.14000d080
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x20]
lea rcx, [rdi - 0x18]
call fcn.14000d080
add rax, 0x18
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], 0
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_7d98a55614e642993372e4126df9e37c___bool__struct_HWND______ptr64__unsigned_long_int__class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t____.0
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x30]
lea rcx, [0x14001fd40]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140025c6b
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rsp + 0x88], 0
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140025c89
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140025ca8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
nop
mov eax, ebx
lock xadd dword [rdi - 8], eax
sub eax, 1
jg 0x140025cc3
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + ioctlsocket]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140025cdf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + ioctlsocket]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1402435c0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 0x80004005
call fcn.140004b20
int3
Function at 0x14002a800
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x50a0
call fcn.140243620
sub rsp, rax
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rsp + 0x5090], rax
mov rbx, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x4e20
call fcn.140245f10
mov r8, rsi
lea rcx, [rsp + 0x270]
mov edx, 0x2710
call fcn.140259008
lea r8, [0x14028adf8]
mov edx, 0x2710
lea rcx, [rsp + 0x270]
call fcn.140258f88
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002a92a
lea rdx, [0x1402895ac]
lea rcx, [rsp + 0x4c]
call fcn.140256824
test eax, eax
je 0x14002a930
lea rdx, [0x1402895b0]
lea rcx, [rsp + 0x4c]
call fcn.140256824
test eax, eax
je 0x14002a930
mov r8, rsi
lea rcx, [rsp + 0x270]
mov edx, 0x2710
call fcn.140259008
lea r8, [0x140284c9c]
mov edx, 0x2710
lea rcx, [rsp + 0x270]
call fcn.140258f88
lea r8, [rsp + 0x4c]
mov edx, 0x2710
lea rcx, [rsp + 0x270]
call fcn.140258f88
test byte [rsp + 0x20], 0x10
je 0x14002a92e
mov rdx, rbx
lea rcx, [rsp + 0x270]
call fcn.14002a800
test eax, eax
jne 0x14002a930
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x14002a954
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14002a893
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov rcx, qword [rsp + 0x5090]
xor rcx, rsp
call fcn.1402435c0
lea r11, [rsp + 0x50a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14002a980
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rbx, rdx
mov rdi, rcx
mov r8, rcx
lea rdx, str.Updater_createProcess
lea rcx, str._start
call fcn.140039ff0
xorps xmm0, xmm0
lea rax, [0x140285288]
movups xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x24], 0x40
mov qword [rsp + 0x40], rbx
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
lea r8, str._suc
lea rcx, str._error
cmovne rcx, r8
lea rdx, str.Updater_createProcess
mov r8, rdi
call fcn.140039ff0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x14002aa50
Capabilities:
Create process on windows
Get common file path

Disassembly:
push rbx
mov eax, 0x4ec0
call fcn.140243620
sub rsp, rax
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rsp + 0x4eb0], rax
mov rbx, rcx
mov edx, 0x2710
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xorps xmm0, xmm0
lea rax, [0x140285288]
movups xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x50], 1
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x24], 0x40
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x40], rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x14002ab29
mov r8, rbx
lea rdx, str.createProcessAsUser
lea rcx, str._error
call fcn.140039ff0
mov rcx, qword [rsp + 0x4eb0]
xor rcx, rsp
call fcn.1402435c0
add rsp, 0x4ec0
pop rbx
ret
Function at 0x14002e130
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x20], 1
xor edx, edx
lea ecx, [rax + 0xf]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14002e1e6
nop
mov rdx, rsi
lea rcx, [rsp + 0x5c]
call fcn.140256824
test eax, eax
jne 0x14002e1d5
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14002e1c8
mov eax, dword [rsp + 0x38]
mov dword [rdx], eax
add qword [rbx + 8], 4
jmp 0x14002e1d5
lea r8, [rsp + 0x38]
mov rcx, rbx
call fcn.14000b950
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14002e1a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1402435c0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002e990
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
mov rdx, rcx
mov qword [rsp + 0x58], rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rdi
call fcn.14002e130
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9, qword [rsp + 0x28]
xor edi, edi
mov rcx, qword [rsp + 0x20]
mov rdx, r9
sub rdx, rcx
mov esi, eax
sar rdx, 2
test rdx, rdx
je 0x14002ea2d
mov qword [rsp + 0x50], rbx
mov r8d, dword [rcx + rdi*4]
cmp r8d, esi
je 0x14002ea16
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, 0x3e8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov rax, r9
inc rdi
sub rax, rcx
sar rax, 2
cmp rdi, rax
jb 0x14002e9d3
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
test rcx, rcx
je 0x14002ea6e
mov rdx, qword [rsp + 0x30]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x14002ea69
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ea73
call fcn.1402434a4
add rsp, 0x48
ret
call fcn.14024a84c
int3
Function at 0x140032330
Capabilities:
Create directory
Delete directory

Disassembly:
push rbx
mov eax, 0x4e50
call fcn.140243620
sub rsp, rax
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rsp + 0x4e40], rax
mov rdx, rcx
lea r8, str.try_create_directory
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test eax, eax
je 0x140032391
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1400323ab
lea r8, [0x140284a60]
lea rdx, str.testDirectoryPrivileges:CreateDirectory
lea rcx, str.no_privileges
call fcn.140039ff0
mov eax, ebx
mov rcx, qword [rsp + 0x4e40]
xor rcx, rsp
call fcn.1402435c0
add rsp, 0x4e50
pop rbx
ret
Function at 0x1400342d0
Capabilities:
Check if file exists
Copy file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov rdi, rcx
lea rcx, [rsp + 0x20]
call fcn.140035050
nop
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14003438f
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov esi, eax
test eax, eax
je 0x14003438f
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x40]
call fcn.140245f10
mov r9d, 0xa
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov ecx, esi
call fcn.140259540
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x40]
lea rcx, str._patchProc__create_dir_fail
call fcn.140039ff0
xor bl, bl
jmp 0x1400343b8
cmp qword [rbx + 0x18], 8
jb 0x140034399
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x1400343a3
mov rdi, qword [rdi]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
sete bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400343f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400343f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003441e
call fcn.1402434a4
movzx eax, bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402435c0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14024a84c
int3

Function at 0x140034cb0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], 0
call fcn.1400368a0
mov dword [rsp + 0x20], 1
mov rax, qword [rbx]
cmp dword [rax - 0x10], 0
jne 0x140034dc0
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x40]
call fcn.140245f10
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call fcn.140004ca0
mov rcx, rax
test rax, rax
je 0x140034de4
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov rdi, 0xffffffffffffffff
cmp rax, 0x10000
jae 0x140034d63
lea rax, [rsp + 0x40]
movzx edx, ax
lea rcx, [rsp + 0x28]
call fcn.140005670
jmp 0x140034d8d
lea rcx, [rsp + 0x40]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140034d70
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.14000ae30
nop
mov dword [rsp + 0x20], 3
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.14000c6d0
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140034dc0
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rioctlsocket + 8]
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1402435c0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x80004005
call fcn.140004b20
int3
Function at 0x14003ae80
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
xor r14b, r14b
cmp byte [0x140372a2c], r14b
je 0x14003aee1
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14003aee8
lea r8, [0x140284a60]
mov rdx, rdi
lea rcx, str._ApplyPatch__src_file_not_exist
call fcn.140039ff0
xor al, al
jmp 0x14003b0b4
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14003af12
lea r8, [0x140284a60]
mov rdx, rsi
lea rcx, str._ApplyPatch__patch_file_not_exist
call fcn.140039ff0
xor al, al
jmp 0x14003b0b4
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], r15w
jne 0x14003af35
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14000a430
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140035050
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14003af9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003af9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b0e0
call fcn.1402434a4
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14003b040
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rdx, qword [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov r15d, eax
test eax, eax
je 0x14003b040
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x60]
call fcn.140245f10
mov r9d, 0xa
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, r15d
call fcn.140259540
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x60]
lea rcx, str._ApplyPatch__create_dir_fail
call fcn.140039ff0
xor r14b, r14b
jmp 0x14003b072
mov rax, qword [0x140372a30]
test rax, rax
je 0x14003b05f
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call rax
movzx r14d, al
test al, al
jne 0x14003b072
mov r8, rsi
mov rdx, rdi
lea rcx, str._ApplyPatch__apply_patch_func__fail
call fcn.140039ff0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14003b0b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b0ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b0da
call fcn.1402434a4
movzx eax, r14b
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1402435c0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x270
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14024a84c
nop
call fcn.14024a84c
nop
int3
Function at 0x1400531c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov rdi, rcx
mov ebp, 0xa00000
test r8, r8
cmovne rbp, r8
mov rax, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x140053200
mov rax, qword [rdx]
xor r14d, r14d
mov qword [rdx + 0x10], r14
mov byte [rax], r14b
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
lea r8d, [r14 + 2]
lea rdx, [0x140285078]
lea rcx, [rsp + 0x30]
call fcn.14000a430
nop
lea r8, [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140053000
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14005328e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053289
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400533d8
call fcn.1402434a4
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x14005339a
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rdi
call fcn.140258110
test eax, eax
jne 0x14005339a
mov rcx, rdi
call fcn.140258658
mov rsi, rax
test rax, rax
js 0x14005339a
cmp rax, rbp
ja 0x14005339a
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140258110
test eax, eax
jne 0x14005339a
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.1400096d0
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140053313
mov rcx, qword [rbx]
mov r9, rdi
mov r8, rsi
mov edx, 1
call fcn.140257e00
cmp rsi, rax
je 0x1400533ce
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
movups xmm2, xmmword [rsp + 0x30]
movups xmm3, xmmword [rsp + 0x40]
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbx], xmm2
movups xmmword [rbx + 0x10], xmm3
psrldq xmm1, 8
movq rdx, xmm1
cmp rdx, 0x10
jb 0x14005339a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053395
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400533d2
call fcn.1402434a4
xor bl, bl
test rdi, rdi
je 0x1400533a9
mov rcx, rdi
call qword [rsp + 0x20]
nop
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402435c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov bl, 1
jmp 0x14005339c
call fcn.14024a84c
int3
call fcn.14024a84c
int3
Function at 0x140064c50
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xa8
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rbx, r9
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x39]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140064e0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0x26
je 0x140064e0e
mov qword [rbp - 0x11], rdi
mov qword [rbp - 1], rdi
mov qword [rbp + 7], 7
lea r8d, [rdi + 0x13]
lea rdx, str.ReadFile_get_error:
lea rcx, [rbp - 0x11]
call fcn.14000a430
mov edx, esi
lea rcx, [rbp + 0xf]
call fcn.1400638e0
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140064cdd
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.14000a2b0
mov rbx, rax
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x19], 7
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, str.seven_zip::FileStream::Read
lea rcx, [rbp - 0x31]
call fcn.14000a430
mov rdx, rbx
lea rcx, [rbp - 0x31]
call fcn.140037cb0
mov rdx, qword [rbp - 0x19]
cmp rdx, 8
jb 0x140064d5e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064d59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140064e2f
call fcn.1402434a4
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x19], 7
mov word [rbp - 0x31], di
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140064dae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064da9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140064e2f
call fcn.1402434a4
mov qword [rbp + 0x1f], rdi
mov qword [rbp + 0x27], 7
mov word [rbp + 0xf], di
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x140064dfa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064df5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140064e2f
call fcn.1402434a4
test esi, esi
jle 0x140064e07
movzx esi, si
or esi, 0x80070000
mov eax, esi
jmp 0x140064e17
mov edi, dword [rbp - 0x39]
test rbx, rbx
je 0x140064e15
mov dword [rbx], edi
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1402435c0
add rsp, 0xa8
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14024a84c
int3
Function at 0x140065420
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xa8
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rbx, r9
xor esi, esi
mov dword [rbp - 0x39], esi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x39]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400655d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rbp - 0x11], rsi
mov qword [rbp - 1], rsi
mov qword [rbp + 7], 7
lea r8d, [rsi + 0x14]
lea rdx, str.WriteFile_get_error:
lea rcx, [rbp - 0x11]
call fcn.14000a430
mov edx, edi
lea rcx, [rbp + 0xf]
call fcn.1400638e0
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x1400654a7
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.14000a2b0
mov rbx, rax
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], 7
mov r8d, 0x1c
lea rdx, str.seven_zip::FileStream::Write
lea rcx, [rbp - 0x31]
call fcn.14000a430
mov rdx, rbx
lea rcx, [rbp - 0x31]
call fcn.140037cb0
mov rdx, qword [rbp - 0x19]
cmp rdx, 8
jb 0x140065528
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065523
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400655f9
call fcn.1402434a4
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], 7
mov word [rbp - 0x31], si
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140065578
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065573
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400655f9
call fcn.1402434a4
mov qword [rbp + 0x1f], rsi
mov qword [rbp + 0x27], 7
mov word [rbp + 0xf], si
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1400655c4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400655bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400655f9
call fcn.1402434a4
test edi, edi
jle 0x1400655d1
movzx edi, di
or edi, 0x80070000
mov eax, edi
jmp 0x1400655e1
test rbx, rbx
je 0x1400655df
mov eax, dword [rbp - 0x39]
mov dword [rbx], eax
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1402435c0
add rsp, 0xa8
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14024a84c
int3