joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002b0f4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x18002b126
call fcn.18001edf4
mov dword [rax], 0x16
call fcn.18001e698
jmp 0x18002b245
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x18002b245
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x18002b245
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x18002b155
lock or dword [rcx + 0x14], 0x10
jmp 0x18002b245
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x18002b169
call fcn.18002bc7c
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.18002603c
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.18002c194
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x18002b233
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x18002b1fe
mov rcx, rsi
call fcn.18002603c
cmp eax, edi
je 0x18002b1e9
mov rcx, rsi
call fcn.18002603c
cmp eax, 0xfffffffe
je 0x18002b1e9
mov rcx, rsi
call fcn.18002603c
movsxd rbx, eax
lea r14, [0x1805951b0]
mov rcx, rsi
sar rbx, 6
call fcn.18002603c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x18002b1f0
lea rdx, [0x1800503f0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18002b1fe
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x18002b222
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x18002b222
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x18002b222
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x18002b248
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x18002b260
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x18002af82
call fcn.18001edf4
mov dword [rax], 0x16
call fcn.18001e698
jmp 0x18002b0d2
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x18002b0d2
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x18002b0d2
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x18002afb1
lock or dword [rcx + 0x14], 0x10
jmp 0x18002b0d2
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x18002afc5
call fcn.18002bc7c
mov ebp, dword [rbx + 0x10]
cmp ebp, 1
jne 0x18002afd5
mov rax, qword [rbx]
mov r14b, byte [rax]
jmp 0x18002afd8
xor r14b, r14b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.18002603c
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.18002c194
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x18002b0c0
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x18002b06b
mov rcx, rbx
call fcn.18002603c
cmp eax, 0xffffffff
je 0x18002b056
mov rcx, rbx
call fcn.18002603c
cmp eax, 0xfffffffe
je 0x18002b056
mov rcx, rbx
call fcn.18002603c
movsxd rdi, eax
lea rsi, [0x1805951b0]
mov rcx, rbx
sar rdi, 6
call fcn.18002603c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x18002b05d
lea rdx, [0x1800503f0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18002b06b
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x18002b08f
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x18002b08f
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x18002b08f
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp ebp, 1
jne 0x18002b0ad
movzx ecx, byte [rdx]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, r14b
or cx, ax
inc rdx
jmp 0x18002b0b8
movzx ecx, word [rdx]
add dword [rbx + 0x10], 0xfffffffe
add rdx, 2
mov qword [rbx], rdx
movzx eax, cx
jmp 0x18002b0d7
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x18002af4c
Function at 0x18002bce8
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1805951b0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x18002bd46
cmp word [rdx], r12w
jne 0x18002bd46
or byte [rax + r8*8 + 0x38], cl
jmp 0x18002bd4c
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x18002bea7
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x18002be82
lea r9, [rcx + 2]
cmp ax, r13w
je 0x18002bd85
mov rcx, r9
jmp 0x18002bda8
cmp r9, rdx
jae 0x18002bdbf
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x18002bd69
jmp 0x18002bea7
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002be7c
cmp dword [rsp + 0x80], edi
je 0x18002be7c
mov rdx, r14
lea r11, [0x1805951b0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x18002be55
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x18002be28
mov word [rbx], r12w
jmp 0x18002bea3
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x18002be31
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x18002bea3
cmp word [rsp + 0x70], r12w
jne 0x18002be62
cmp rbx, rsi
je 0x18002be22
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.18002c974
cmp word [rsp + 0x70], r12w
je 0x18002bea7
mov word [rbx], r13w
jmp 0x18002bea3
lea r11, [0x1805951b0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x18002be9f
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x18002bea7
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18002e5a0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18002e5d0
xor eax, eax
jmp 0x18002e693
mov rbp, rbx
cmp word [rax], si
je 0x18002e5f5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18002e5dc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18002e5d8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18002e4f0
movsxd r14, eax
test eax, eax
jne 0x18002e633
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18002e5c9
mov rcx, r14
call fcn.180028730
mov rdi, rax
test rax, rax
jne 0x18002e64c
xor ecx, ecx
call fcn.1800286f4
jmp 0x18002e628
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18002e4f0
test eax, eax
jne 0x18002e67d
mov rcx, rdi
call fcn.1800286f4
jmp 0x18002e687
xor ecx, ecx
call fcn.1800286f4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180037bec
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18002c974
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18002c974
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180037d3c
cmp rax, 0xffffffffffffffff
je 0x180037d3c
xor edi, edi
test rbp, rbp
jle 0x180037ce7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.18002867c
mov rbx, rax
test rax, rax
jne 0x180037c74
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180037cdd
mov edx, 0x8000
mov ecx, r14d
call fcn.180037a74
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18002a7f8
cmp eax, 0xffffffff
je 0x180037cbd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180037c84
mov edx, r15d
mov ecx, r14d
call fcn.180037a74
jmp 0x180037cdd
cmp byte [rsi + 0x38], dil
je 0x180037cd4
cmp dword [rsi + 0x34], 5
jne 0x180037cd4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180037cdd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800286f4
jmp 0x180037d50
jns 0x180037d50
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18002c974
cmp rax, 0xffffffffffffffff
jne 0x180037d08
cmp byte [rsi + 0x30], dil
je 0x180037d50
mov edi, dword [rsi + 0x2c]
jmp 0x180037d50
mov ecx, r14d
call fcn.180030bcc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180037d50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180037d50
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180037d49
mov eax, dword [rsi + 0x2c]
jmp 0x180037d4e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18002c974
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140001c14
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140005620], eax
call fcn.140001920
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140005620], 0
jne case.default.0x140001c6a
mov ecx, 1
call fcn.140001920
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add dword [rax], eax
adc byte [rax], al
add byte [rax], al
sbb byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add dword [rax], eax
add dword [rax], eax
add byte [rax], al
xor byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add dword [rax], eax
or dword [rax + rax], eax
add byte [rax], cl
add byte [rax], al
invalid
Function at 0x140003e70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov byte [rsp + 0x10], dl
push rdi
sub rsp, 0x50
cmp byte [rcx + 0x40], 0
movzx esi, dl
mov rdi, rcx
je 0x140003f19
mov rax, qword [0x1400b5948]
mov qword [rsp + 0x38], 1
test rax, rax
jne 0x140003ec0
xor r8d, r8d
lea ecx, [rax + 1]
mov edx, 0x100000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1400b5948], rax
xor edx, edx
mov qword [rsp + 0x30], 2
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov rbx, rax
mov qword [rsp + 0x40], rax
mov byte [rax], sil
mov byte [rax + 1], 0
call fcn.14000f9e0
mov rcx, qword [0x1400b5948]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rax, qword [rcx + 0x18]
cmp rax, 1
jne 0x140003f64
mov rcx, qword [rcx]
lea r9, [0x1400b5958]
mov r8d, eax
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, 1
mov rcx, rdi
call fcn.140004900
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rax, rax
jne 0x140003fa8
lea edx, [rax + 1]
call fcn.140004900
mov rcx, qword [rdi]
lea r9, [0x1400b5958]
mov r8d, 1
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rcx + 0x10]
xor r8d, r8d
shr rbx, 1
mov rdx, rbx
call fcn.140004b20
mov rcx, qword [rdi]
lea r9, [0x1400b5958]
mov r8d, 1
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rdi + 0x10]
mov r8b, 1
and edx, 1
mov rcx, rdi
add rdx, rbx
call fcn.140004b20
mov rbx, qword [rsp + 0x60]
mov rax, rdi
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140004010
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
cmp byte [rcx + 0x40], 0
mov rsi, rdx
mov rdi, rcx
je 0x140004133
movaps xmm0, xmmword [rdx]
mov rax, qword [0x1400b5948]
movaps xmmword [rsp + 0x30], xmm0
psrldq xmm0, 8
movq rbx, xmm0
mov qword [rsp + 0x48], rbx
test rax, rax
jne 0x14000406a
xor r8d, r8d
lea ecx, [rax + 1]
mov edx, 0x100000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1400b5948], rax
inc rbx
xor edx, edx
mov r8, rbx
mov qword [rsp + 0x40], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8, qword [rsp + 0x30]
mov rsi, rax
mov qword [rsp + 0x50], rax
cmp rax, r8
je 0x140004101
test rbx, rbx
je 0x140004101
mov rdx, rbx
xor r10d, r10d
shr rdx, 3
test rdx, rdx
je 0x1400040d1
mov r9, r8
mov rcx, rax
sub r9, rax
mov r10, rdx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx + r9]
mov qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1400040c0
lea r10, [r10*8]
cmp r10, rbx
jae 0x140004101
sub r8, rsi
lea rcx, [rsi + r10]
sub rbx, r10
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rbx, 1
jne 0x1400040f0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000f9e0
mov rcx, qword [0x1400b5948]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rcx + 0x18]
cmp rax, 1
jne 0x14000417b
mov r8d, dword [rdx + 8]
lea r9, [0x1400b5958]
mov rdx, qword [rdx]
xor r10d, r10d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsi + 8]
mov rcx, rdi
call fcn.140004900
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
test rax, rax
jne 0x1400041bb
mov rdx, qword [rdx + 8]
call fcn.140004900
mov r8d, dword [rsi + 8]
lea r9, [0x1400b5958]
mov rdx, qword [rsi]
xor r10d, r10d
mov rcx, qword [rdi]
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rcx + 0x10]
xor r8d, r8d
shr rbx, 1
mov rdx, rbx
call fcn.140004b20
mov r8d, dword [rsi + 8]
lea r9, [0x1400b5958]
mov rdx, qword [rsi]
xor r10d, r10d
mov rcx, qword [rdi]
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rdi + 0x10]
mov r8b, 1
and edx, 1
mov rcx, rdi
add rdx, rbx
call fcn.140004b20
mov rbx, qword [rsp + 0x70]
mov rax, rdi
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140004220
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
movaps xmm0, xmmword [rdx]
mov rdi, rcx
mov rax, qword [0x1400b5950]
movaps xmmword [rsp + 0x30], xmm0
psrldq xmm0, 8
movq rbx, xmm0
mov qword [rsp + 0x60], rbx
test rax, rax
jne 0x14000426d
xor r8d, r8d
lea ecx, [rax + 1]
mov edx, 0x100000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x1400b5950], rax
lea r8, [rbx + 1]
xor edx, edx
mov qword [rsp + 0x58], r8
mov rcx, rax
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r9, qword [rsp + 0x30]
lea rdx, [rbx*2 + 2]
mov qword [rsp + 0x68], rax
mov rsi, rax
cmp rax, r9
je 0x140004301
test rdx, rdx
je 0x140004301
mov r8, rdx
xor r11d, r11d
shr r8, 3
test r8, r8
je 0x1400042d1
mov r10, r9
mov rcx, rax
sub r10, rax
mov r11, r8
nop
mov rax, qword [r10 + rcx]
mov qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x1400042c0
lea rax, [r11*8]
cmp rax, rdx
jae 0x140004301
sub r9, rsi
lea rcx, [rsi + rax]
sub rdx, rax
nop dword [rax + rax]
movzx eax, byte [rcx + r9]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400042f0
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.14000f170
cmp byte [rdi + 0x40], 0
je 0x140004328
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000f9e0
jmp 0x14000445c
mov r11, qword [rsp + 0x48]
mov r10, qword [rsp + 0x50]
test r11, r11
jne 0x14000433b
xor ebx, ebx
jmp 0x1400043a8
lea r8, [r10 - 1]
add r8, r11
lea rax, [r10 - 1]
cmp r11, 2
jbe 0x140004364
cmp byte [r10], 0xef
jne 0x140004364
cmp byte [r10 + 1], 0xbb
jne 0x140004364
cmp byte [r10 + 2], 0xbf
jne 0x140004364
add rax, 3
xor ebx, ebx
cmp rax, r8
je 0x1400043a8
nop dword [rax + rax]
movzx ecx, byte [rax + 1]
inc rax
inc rbx
cmp cl, 0x7f
jbe 0x1400043a3
mov edx, ecx
and edx, 0xf0
sub edx, 0xe0
je 0x14000439f
cmp edx, 0x10
je 0x140004399
inc rax
jmp 0x1400043a3
add rax, 3
jmp 0x1400043a3
add rax, 2
cmp rax, r8
jne 0x140004370
mov rax, qword [rdi + 0x18]
cmp rax, 1
jne 0x1400043de
mov rcx, qword [rdi]
lea r9, [0x1400b5958]
mov r8d, r11d
mov qword [rsp + 0x20], 0
mov rdx, r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, rbx
mov rcx, rdi
call fcn.140004900
jmp 0x14000445c
mov rcx, rdi
test rax, rax
jne 0x140004413
mov rdx, rbx
call fcn.140004900
mov r8d, dword [rsp + 0x48]
lea r9, [0x1400b5958]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdi]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14000445c
mov rbx, qword [rdi + 0x10]
xor r8d, r8d
shr rbx, 1
mov rdx, rbx
call fcn.140004b20
mov r8d, dword [rsp + 0x48]
lea r9, [0x1400b5958]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdi]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rdi + 0x10]
mov r8b, 1
and edx, 1
mov rcx, rdi
add rdx, rbx
call fcn.140004b20
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [0x1400b5948]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1400b5950]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x70]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400044a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x40], 0
mov rsi, rdx
mov rdi, rcx
je 0x1400044c9
call fcn.14000f9e0
mov rax, rdi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rcx + 0x18]
cmp rax, 1
jne 0x14000450e
mov r8d, dword [rdx + 8]
lea r9, [0x1400b5958]
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsi + 8]
mov rcx, rdi
call fcn.140004900
mov rax, rdi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
test rax, rax
jne 0x14000454b
mov rdx, qword [rdx + 8]
call fcn.140004900
mov r8d, dword [rsi + 8]
lea r9, [0x1400b5958]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rdi]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, rdi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov rbx, qword [rcx + 0x10]
shr rbx, 1
mov rdx, rbx
call fcn.140004b20
mov r8d, dword [rsi + 8]
lea r9, [0x1400b5958]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rdi]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [rdi + 0x10]
mov r8b, 1
and edx, 1
mov rcx, rdi
add rdx, rbx
call fcn.140004b20
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret