joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1f66e23ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1f66e242a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1f66e2421
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1f66e2421
mov rax, qword [rbp - 8]
jmp 0x1f66e243f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1f66e23f4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001b18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b62
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b64
xor al, al
add rsp, 0x28
ret

Function at 0x140001b2c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b76
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b76
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b76
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b76
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b76
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b78
xor al, al
add rsp, 0x28
ret
Function at 0x13b4058c0
Capabilities:
Accept command line arguments
Read file on windows
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
movsxd r14, edx
mov rbx, rcx
cmp r14d, 1
jl 0x13b405a54
mov byte [rcx], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8, rax
test rax, rax
je 0x13b405a54
movzx eax, word [rax]
test ax, ax
je 0x13b405a54
xor r15d, r15d
mov ecx, r15d
cmp ax, 0x22
jne 0x13b405947
movzx eax, word [r8 + 2]
lea ecx, [r15 + 1]
test ax, ax
je 0x13b40593b
mov edx, ecx
cmp ax, 0x22
je 0x13b40593b
movzx eax, word [r8 + rdx*2 + 2]
inc rdx
inc ecx
test ax, ax
jne 0x13b405925
movsxd rax, ecx
or byte [rax - 0x7d], cl
in al, dx
sbb byte [rax - 0x75], cl
and al, 0x20
add byte [rax - 0x75], cl
mov word [rax + rbp*8], fs
add byte [rax], al
add byte [rbx + rcx*4 - 0x3f], cl
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x78], rax

Function at 0x13b405a0e
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x148
lea rax, [0x13b44376c]
mov qword [rsp + 0x50], rax
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x28]
mov eax, eax
mov qword [rsp + 0xe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0xe8]
mov r8, rcx
Function at 0x13b406fd0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
cmp byte [0x13b444810], 0
je 0x13b40719a
mov dl, 1
lea rcx, str.steamclient64.dll
call fcn.13b406280
cmp qword [0x13b4433b8], 0
je 0x13b40719a
mov ecx, 2
mov qword [rsp + 0x30], rbx
call fcn.13b412304
mov rcx, rax
lea rdx, str.Looking_up_breakpad_interfaces_from_steamclient_n
call fcn.13b4088b0
mov rcx, qword [0x13b4433b8]
xor ebx, ebx
test rcx, rcx
jne 0x13b40704f
mov qword [0x13b444790], rbx
mov qword [0x13b444798], rbx
mov qword [0x13b4447a0], rbx
mov qword [0x13b4447a8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rdx, str.Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x13b4433b8]
mov qword [0x13b444790], rax
test rcx, rcx
jne 0x13b40708e
mov qword [0x13b444798], rbx
mov qword [0x13b4447a0], rbx
mov qword [0x13b4447a8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rdx, str.Breakpad_SteamWriteMiniDumpSetComment
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x13b4433b8]
mov qword [0x13b444798], rax
test rcx, rcx
jne 0x13b4070c6
mov qword [0x13b4447a0], rbx
mov qword [0x13b4447a8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rdx, str.Breakpad_SteamSetSteamID
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x13b4433b8]
mov qword [0x13b4447a0], rax
test rcx, rcx
jne 0x13b4070f7
mov qword [0x13b4447a8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rdx, str.Breakpad_SteamSetAppID
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x13b4433b8]
mov qword [0x13b4447a8], rax
test rcx, rcx
je 0x13b407195
lea rdx, str.Breakpad_SteamMiniDumpInit
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x13b407195
mov ecx, 2
call fcn.13b412304
mov rcx, rax
lea rdx, str.Calling_BreakpadMiniDumpSystemInit_n
call fcn.13b4088b0
mov rcx, qword [0x13b444870]
lea r8, [0x13b444858]
movzx r9d, byte [0x13b444811]
lea rdx, [0x13b444812]
mov qword [rsp + 0x28], rcx
mov rcx, qword [0x13b444868]
mov qword [rsp + 0x20], rcx
mov ecx, dword [0x13b444854]
call rbx
mov rcx, qword [0x13b444878]
test rcx, rcx
je 0x13b407195
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
jmp fcn.13b407320
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret

Function at 0x13b4071a0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x13b444378], 0
movzx ebx, dl
mov edi, ecx
jle 0x13b4071d0
lea rcx, str._S_API_FAIL__Standard_callback_dispatch_cannot_be_used__manual_dispatch_has_already_been_selected._n
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x13b444378], 0xffffffff
call fcn.13b407210
movzx edx, bl
mov ecx, edi
call fcn.13b403f80
mov ecx, dword [0x13b444800]
test ecx, ecx
je 0x13b4071f8
call fcn.13b403ca0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [0x13b444ce0]
test ecx, ecx
je 0x13b408a91
mov dl, 1
jmp 0x13b4071a0
ret
Function at 0x13b407ad0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
cmp dword [0x13b444378], 0
jg 0x13b407af1
lea rcx, str._S_API_FAIL__SteamAPI_ManualDispatch_GetNextCallback___Cannot_be_used__must_call_SteamAPI_ManualDispatch_Init_first._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
add rsp, 0x38
ret
mov r10, qword [0x13b444288]
test r10, r10
je 0x13b407aea
add rsp, 0x38
jmp r10

Function at 0x13b407b10
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp dword [0x13b444378], 0
jg 0x13b407b31
lea rcx, str._S_API_FAIL__SteamAPI_ManualDispatch_GetNextCallback___Cannot_be_used__must_call_SteamAPI_ManualDispatch_Init_first._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
add rsp, 0x28
ret
mov rax, qword [0x13b444278]
test rax, rax
je 0x13b407b2a
lea r8, [rsp + 0x40]
call rax
add rsp, 0x28
ret

Function at 0x13b407bb0
Capabilities:
Print debug messages

Disassembly:
cmp dword [0x13b444378], 0
jg 0x13b407bc7
lea rcx, str._S_API_FAIL__SteamAPI_ManualDispatch_RunFrame___Cannot_be_used__must_call_SteamAPI_ManualDispatch_Init_first._n
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test ecx, ecx
je 0x13b407bda
cmp ecx, dword [0x13b4447e8]
jne 0x13b407bda
xor edx, edx
jmp fcn.13b407210
ret
Function at 0x13b407be0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rsi, rdx
mov rbp, rcx
call fcn.13b404220
mov rbx, rax
test byte [rax + 0x30], 1
jne 0x13b403d60
mov qword [rax + 0x38], rax
lea r14, [0x13b404380]
mov qword [rax + 0x40], r14
mov edx, 0x2bf
lea rcx, [rax + 0x28]
call sym.steam_api64.dll_SteamAPI_RegisterCallback
test byte [rbx + 0x50], 1
je 0x13b403d4a
lea rcx, [rbx + 0x48]
call sym.steam_api64.dll_SteamAPI_UnregisterCallback
mov qword [rbx + 0x58], rbx
mov qword [rbx + 0x60], r14
mov edx, 0x2bf
lea rcx, [rbx + 0x48]
call sym.steam_api64.dll_SteamAPI_RegisterCallback
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
lea rdi, [rbx + 0x68]
mov rbx, qword [rdi]
mov qword [rsp + 0x20], rdi
xor esi, esi
mov qword [rsp + 0x28], rsi
lea ecx, [rsi + 0x30]
call fcn.13b408e40
mov r8, rax
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax + 0x20], xmm0
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov word [rax + 0x18], si
mov rax, qword [rdi]
mov rax, qword [rax + 8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], esi
cmp byte [rax + 0x19], sil
jne 0x13b403de6
mov rcx, qword [r8 + 0x20]
nop
mov qword [rsp + 0x30], rax
cmp rcx, qword [rax + 0x20]
jae 0x13b403dd8
mov dword [rsp + 0x38], 1
mov rax, qword [rax]
jmp 0x13b403de0
mov dword [rsp + 0x38], esi
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x13b403dc0
movabs rax, 0x555555555555555
cmp qword [rdi + 8], rax
je 0x13b403e28
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.13b404c60
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
call fcn.13b404fa0
nop
int3
cmp dword [0x13b444378], 0
jle 0x13b407bf7
lea rcx, str._S_API_FAIL__SteamAPI_RegisterCallResult_cannot_be_used__manual_dispatch_has_already_been_selected._n
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x13b444378], 0xffffffff
jmp 0x13b403cf0
Function at 0x13b407c10
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov ebx, edx
mov rdi, rcx
call fcn.13b404220
mov rsi, rax
or byte [rdi + 8], 1
mov dword [rdi + 0xc], ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rdi
mov rbx, qword [rax]
mov qword [rsp + 0x20], rax
xor edi, edi
mov qword [rsp + 0x28], rdi
lea ecx, [rdi + 0x30]
call fcn.13b408e40
mov r8, rax
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax + 0x20], xmm0
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov word [rax + 0x18], di
mov rax, qword [rsi]
mov rax, qword [rax + 8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], edi
cmp byte [rax + 0x19], dil
jne 0x13b403ed5
mov ecx, dword [r8 + 0x20]
nop dword [rax]
mov qword [rsp + 0x30], rax
cmp ecx, dword [rax + 0x20]
jge 0x13b403ec7
mov dword [rsp + 0x38], 1
mov rax, qword [rax]
jmp 0x13b403ecf
mov dword [rsp + 0x38], edi
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x13b403eb0
movabs rax, 0x555555555555555
cmp qword [rsi + 8], rax
je 0x13b403f0c
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.13b404c60
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.13b404fa0
nop
int3
cmp dword [0x13b444378], 0
jle 0x13b407c27
lea rcx, str._S_API_FAIL__SteamAPI_RegisterCallback_cannot_be_used__manual_dispatch_has_already_been_selected._n
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x13b444378], 0xffffffff
jmp 0x13b403e30
Function at 0x13b4081c0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
xor cl, cl
cmp dword [0x13b4447e8], 0
je 0x13b408282
mov qword [rsp + 0x20], rbx
nop dword [rax + rax]
mov byte [0x13b4448a4], 0
mov eax, 1
lock xadd dword [0x13b4448a0], eax
test eax, eax
sete al
test al, al
je 0x13b40824c
cmp dword [0x13b444378], 0
mov ebx, dword [0x13b4447e8]
jle 0x13b40821d
lea rcx, str._S_API_FAIL__Standard_callback_dispatch_cannot_be_used__manual_dispatch_has_already_been_selected._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov cl, 1
jmp 0x13b408253
xor edx, edx
mov dword [0x13b444378], 0xffffffff
mov ecx, ebx
call fcn.13b407210
xor edx, edx
mov ecx, ebx
call fcn.13b403f80
mov ecx, dword [0x13b444800]
test ecx, ecx
je 0x13b408248
call fcn.13b403ca0
mov cl, 1
jmp 0x13b408253
mov byte [0x13b4448a4], 1
mov eax, 0xffffffff
lock xadd dword [0x13b4448a0], eax
cmp eax, 1
sete al
test al, al
je 0x13b408279
movzx eax, byte [0x13b4448a4]
test al, al
jne 0x13b4081e0
mov rbx, qword [rsp + 0x20]
test cl, cl
jne 0x13b4082a5
mov rax, qword [0x13b4447f8]
test rax, rax
je 0x13b408292
xor ecx, ecx
call rax
mov ecx, dword [0x13b444800]
test ecx, ecx
je 0x13b4082a5
add rsp, 0x28
jmp fcn.13b403ca0
add rsp, 0x28
ret

Function at 0x13b4087d0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x428
mov r10d, ecx
test rdx, rdx
je 0x13b40882a
mov rcx, qword [0x13b4447d8]
test rcx, rcx
je 0x13b40880b
mov r8d, dword [0x13b4447e8]
test r8d, r8d
je 0x13b40880b
mov rax, qword [rcx]
mov r9, rdx
mov edx, r10d
add rsp, 0x428
jmp qword [rax + 0x60]
mov r8, rdx
lea rcx, [rsp + 0x20]
lea rdx, str._S_API_FAIL__Tried_to_access_Steam_interface__s_before_SteamAPI_Init_succeeded._n
call fcn.13b4052e0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
add rsp, 0x428
ret

Function at 0x13b408a80
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x13b444378], 0
movzx ebx, dl
mov edi, ecx
jle 0x13b4071d0
lea rcx, str._S_API_FAIL__Standard_callback_dispatch_cannot_be_used__manual_dispatch_has_already_been_selected._n
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [0x13b444378], 0xffffffff
call fcn.13b407210
movzx edx, bl
mov ecx, edi
call fcn.13b403f80
mov ecx, dword [0x13b444800]
test ecx, ecx
je 0x13b4071f8
call fcn.13b403ca0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [0x13b444ce0]
test ecx, ecx
je 0x13b408a91
mov dl, 1
jmp 0x13b4071a0
ret

Function at 0x13b41c790
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x13b41c76d
call fcn.13b419158
mov dword [rax], 0x16
call fcn.13b410e8c
or eax, 0xffffffff
jmp 0x13b41c78a
sub dword [rcx + 0x10], 1
jns 0x13b41c77c
add rsp, 0x28
jmp fcn.13b41d274
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x13b41c74c
Function at 0x180610058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1806101df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180610089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18061006f
add dl, dl
jne 0x180610096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806100f6
xor eax, eax
add dl, dl
jne 0x1806100a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1806101ad
add dl, dl
jne 0x1806100b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806100c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806100d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1806100dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1806100ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18061007e
mov eax, 1
add dl, dl
jne 0x180610106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180610113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1806100fb
sub eax, ebx
mov ebx, 1
jne 0x18061014c
mov ecx, 1
add dl, dl
jne 0x18061012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18061013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180610123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18061007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180610168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180610175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18061015d
cmp eax, 0x7d00
jae 0x18061019b
cmp eax, 0x500
jb 0x180610196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18061007e
cmp eax, 0x7f
ja 0x18061019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18061007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1806101d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18061007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400019f8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov r15, rdx
mov rdi, rcx
mov r12d, r9d
mov r14d, r8d
mov esi, r13d
lea edx, [r13 + 0x41]
lea ecx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140001b3f
lea ebp, [r13 + 7]
cmp r14d, ebp
jb 0x140001a5a
mov edx, r14d
lea rcx, str.ERROR_qmezdwwpbUsYlIght_request_create___count_u__max_is_7__n
call fcn.14000bdb4
cmp r14d, ebp
cmovb ebp, r14d
mov r10d, r13d
mov esi, 1
test ebp, ebp
je 0x140001b09
lea r9, [r15 + 2]
movzx edx, byte [r9 - 2]
mov cl, dl
mov al, dl
or al, 0x10
and cl, 0xf0
movzx eax, al
lea ecx, [r10*8 + 2]
cmove edx, eax
lea eax, [r10*8 + 1]
mov byte [rax + rbx], dl
mov al, byte [r9 - 1]
mov byte [rcx + rbx], al
lea ecx, [r10*8 + 3]
mov al, byte [r9]
lea r9, [r9 + 8]
mov byte [rcx + rbx], al
lea ecx, [r10*8 + 4]
mov al, byte [r9 - 7]
mov byte [rcx + rbx], al
lea ecx, [r10*8 + 5]
mov al, byte [r9 - 6]
mov byte [rcx + rbx], al
lea ecx, [r10*8 + 6]
mov al, byte [r9 - 5]
mov byte [rcx + rbx], al
lea ecx, [r10*8 + 7]
mov al, byte [r9 - 4]
mov byte [rcx + rbx], al
lea ecx, [r10*8 + 8]
mov al, byte [r9 - 3]
add r10d, esi
mov byte [rcx + rbx], al
cmp r10d, ebp
jb 0x140001a72
or word [rbx + 0x3d], 0xffff
lea rdx, [rbx + 1]
mov dword [rbx + 0x39], 0xff550404
movzx ecx, r13w
mov r8d, reloc.netapi32.dll_Ordinal_62
movzx eax, byte [rdx]
add rdx, rsi
add cx, ax
sub r8, rsi
jne 0x140001b24
movzx eax, cx
mov byte [rbx + 0x40], cl
shr ax, 8
mov byte [rbx + 0x3f], al
test esi, esi
je 0x140001be6
jmp 0x140001bd4
mov ebp, r13d
test rdi, rdi
je 0x140001bb6
mov rcx, qword [rdi + 0x78]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001bb6
movzx r9d, word [rdi + 0x2a]
mov r8d, reloc.netapi32.dll_Ordinal_65
cmp r9d, r8d
jb 0x140001ba5
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r13
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, eax
test eax, eax
jne 0x140001bc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rdi + 8]
lea rcx, str.ERROR_qmezdwwpbUsYlIght_device_send_raw____device__u__WriteFile__0x_08x__n
mov r8d, eax
call fcn.14000bdb4
jmp 0x140001bc5
mov edx, dword [rdi + 8]
lea rcx, str.ERROR_qmezdwwpbUsYlIght_device_send_raw____device__u__Size_is_not_valide__siz___u__max___u__n
call fcn.14000bdb4
jmp 0x140001bc5
mov edx, dword [rdi + 8]
lea rcx, str.ERROR_qmezdwwpbUsYlIght_device_send_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.14000bdb4
and esi, ebp
test r12d, r12d
je 0x140001bd1
mov rdi, qword [rdi]
jmp 0x140001bd4
mov rdi, r13
test rdi, rdi
jne 0x140001b4c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea r11, [rsp + 0x40]
mov eax, esi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002128
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x70
mov rbp, rcx
mov edx, 0x338
mov ecx, Ordinal_65
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x1400022f0
and dword [rbx + 0x1c], 0
lea r14, [rax + 8]
and dword [rbx + 0x20], 0
mov eax, 0x4000000
mov dword [r14], eax
mov r8, rbp
mov dword [rbx + 0xc], eax
xor edx, edx
mov eax, SQLGetData
mov rcx, r14
mov word [rbx + 0x28], ax
call fcn.140001fb0
test eax, eax
je 0x1400022d2
lea rsi, [rbx + 0x22a]
mov edi, 0x100
mov rdx, rsi
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1400022de
mov ecx, edi
mov rax, rsi
cmp byte [rax], 0
je 0x1400021c7
inc rax
sub rcx, 1
jne 0x1400021b9
test rcx, rcx
je 0x1400021d4
mov rax, rdi
sub rax, rcx
jmp 0x1400021d6
xor eax, eax
test rcx, rcx
je 0x1400022de
lea rcx, [rax + rsi]
sub rdi, rax
je 0x140002219
lea rdx, [rax + 0x7ffffeff]
add rdx, rdi
lea rax, [0x1400fbb38]
sub rax, rcx
test rdx, rdx
je 0x140002219
mov r8b, byte [rax + rcx]
test r8b, r8b
je 0x140002219
mov byte [rcx], r8b
dec rdx
inc rcx
sub rdi, 1
jne 0x1400021fc
test rdi, rdi
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], 0
je 0x1400022de
mov qword [rsp + 0x60], rbp
lea rax, [0x140001ecc]
mov qword [rsp + 0x58], r14
lea rdi, [rbx + 0x32c]
mov qword [rsp + 0x50], rax
lea r9, [0x140001d30]
lea rax, [0x140001e98]
mov rcx, rdi
mov qword [rsp + 0x48], rax
lea r8, [0x140001d20]
lea rax, [0x140001e60]
mov qword [rsp + 0x40], rax
lea rdx, [fcn.140001d1c]
lea rax, [fcn.140001e2c]
mov qword [rsp + 0x38], rax
lea rax, [0x140001df4]
mov qword [rsp + 0x30], rax
lea rax, [0x140001dbc]
mov qword [rsp + 0x28], rax
lea rax, [fcn.140001d38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.Cabinet.dll_FCICreate]
mov qword [rbx], rax
test rax, rax
jne 0x1400022de
mov ecx, dword [rdi]
call fcn.1400020ac
mov edx, dword [rdi]
lea rcx, str.ERROR_qmezdwwpcabinet_create___FCICreate_failed_with_error_code__d:__S_n
mov r8, rax
call fcn.14000bdb4
jmp 0x1400022de
lea rcx, str.ERROR_qmezdwwpcabinet_create___Failed_to_initialize_the_cabinet_information_structure._n
call fcn.14000bdb4
cmp qword [rbx], 0
jne 0x1400022f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, rax
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret