joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000795e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdx, rcx
lea rbx, [0x14003e050]
mov rcx, rbx
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, rbx
call fcn.140007b78
xor esi, esi
test rax, rax
je 0x140007a22
mov rdi, rax
mov rcx, rax
call fcn.140007c02
mov rax, qword [0x14000b530]
test byte [rax], 0x80
je 0x1400079b6
movzx eax, word [rdi]
test eax, eax
je 0x140007a22
cmp eax, 0x5c
je 0x140007a22
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
sub rdi, rbx
sar rdi, 1
cmp rdi, rax
jge 0x140007a01
lea rbx, [0x14003e050]
mov r14, qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rbx
call fcn.140007aa7
test rax, rax
je 0x1400079ec
test byte [rax], 0x10
je 0x140007a22
mov rcx, rbx
call fcn.140007a42
mov rcx, rbx
call r14
cdqe
cmp rdi, rax
jl 0x1400079da
lea rsi, [0x14003e050]
mov rcx, rsi
call fcn.140007ad8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
setne sil
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140007a88
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rax, qword [0x14000b2b8]
inc dword [rax + 0x10]
add rsp, 0x28
ret

Function at 0x140007db8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, r8d
mov edi, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x30], 0
mov rcx, rbx
mov edx, edi
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x140007e03
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov ebp, 0xffffff9b
movabs r14, 0x610073006e
mov r15, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rbx, [rsp + 0x28]
mov r12, qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
inc ebp
je 0x140007e76
mov qword [rsp + 0x28], r14
call r15
mov ecx, eax
imul rcx, rcx, 0x4ec4ec4f
shr rcx, 0x23
lea edx, [rcx + rcx*4]
lea edx, [rdx + rdx*4]
add edx, ecx
sub eax, edx
add word [rsp + 0x2c], ax
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
mov r9, rsi
call r12
test eax, eax
je 0x140007e39
jmp 0x140007e7d
mov word [rsi], 0
xor esi, esi
mov rax, rsi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140007e8f
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov esi, r8d
mov qword [rsp + 0x20], 0
lea rdi, [rsp + 0x34]
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
cmp dword [rdi], esi
sete cl
and cl, al
movzx eax, cl
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x140007ec5
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov esi, r8d
mov qword [rsp + 0x20], 0
lea rdi, [rsp + 0x34]
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
cmp dword [rdi], esi
sete cl
and cl, al
movzx eax, cl
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140007efb
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, rdx
mov rdi, rcx
xor r14d, r14d
mov esi, 1
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x140007f96
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x2e]
lea r9, [rsp + 0x30]
mov rcx, rdi
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140007f65
cmp dword [rsp + 0x30], 2
jne 0x140007f65
movzx eax, word [rsp + 0x2e]
cmp eax, 0xfeff
jne 0x140007f65
mov esi, r14d
jmp 0x140007f96
test rbx, rbx
je 0x140007f85
xor r14d, r14d
mov rcx, rdi
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x140007fa2
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rdx, [0x14000b592]
lea rsi, [rsp + 0x34]
mov rcx, rdi
mov r8d, 2
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsi], 2
mov ecx, 0x80004005
cmovne r14d, ecx
test eax, eax
cmove r14d, ecx
jmp 0x140007f60

Function at 0x1400080da
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r9
mov rdi, r8
xor r8d, r8d
cmp dword [rsp + 0x80], 0
mov dword [rsp + 0x3c], 0x800
setne r8b
shl r8d, 9
or r8d, 0x20019
lea r9, [rsp + 0x40]
call fcn.140008036
test eax, eax
jne 0x140008161
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x38]
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [rsi + 0x7fe], 0
test edi, edi
jne 0x140008161
mov eax, dword [rsp + 0x38]
add eax, 0xfffffffd
cmp eax, 0xfffffffd
ja 0x140008166
mov word [rsi], 0
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x1400085b6
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x260
mov rsi, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, 0x105
cmovb ecx, eax
test ecx, ecx
je 0x1400085ef
lea edx, [rcx - 1]
xor eax, eax
cmp word [rsp + rdx*2 + 0x20], 0x5c
sete al
jmp 0x1400085f4
mov eax, 1
mov ecx, ecx
lea rcx, [rsp + rcx*2]
add rcx, 0x20
lea rdx, [0x14000b58e]
lea r8, [rdx + rax*2]
lea rdx, str._s_S.dll
mov r9, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
nop
add rsp, 0x260
pop rsi
ret

Function at 0x140008750
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov eax, ecx
cmp dword [0x14003faa4], 0
lea rcx, [0x14003faa0]
jne 0x14000879a
xor r9d, r9d
mov r10d, 8
mov r11d, r9d
mov esi, r11d
shr esi, 1
and r11d, 1
neg r11d
and r11d, 0xedb88320
xor r11d, esi
dec r10d
jne 0x14000876f
mov dword [rcx + r9*4], r11d
inc r9
cmp r9, 0x100
jne 0x140008766
test r8, r8
je 0x1400087c0
not eax
xor r9d, r9d
mov r10b, byte [rdx + r9]
xor r10b, al
movzx r10d, r10b
shr eax, 8
xor eax, dword [rcx + r10*4]
inc r9
cmp r8, r9
jne 0x1400087a4
not eax
pop rsi
ret
Function at 0x140002860
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov r8d, dword [section..data]
lea rax, str.incompatible
test r8d, r8d
lea rdx, str.compatible
mov r9d, r8d
lea rcx, str._n_n_This_system_is__s__return_code__d__0x_08x___n
cmovne rdx, rax
call fcn.140002af0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov edx, dword [section..data]
mov rcx, 0xffffffffffffffff
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x140002960
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov esi, ecx
xor ebx, ebx
lea r14d, [rbx + 1]
lea rcx, str.GLCheck_Utility_n
call fcn.140002af0
lea rcx, str.Copyright_2012_BlueStack_Systems__Inc._n
call fcn.140002af0
lea rcx, str.All_Rights_Reserved_n
call fcn.140002af0
lea rcx, [0x14000f400]
call fcn.140002af0
cmp esi, 2
jl 0x1400029c1
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ebx, eax
cmp esi, 3
jne 0x1400029d3
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov r14d, eax
cmp ebx, 0x63
jne 0x1400029e2
lea ecx, [rbx - 0x64]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea eax, [rsi - 2]
cmp eax, 1
ja 0x140002aab
lea rcx, [0x140001600]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.140001dc0
cmp r14d, 1
jne 0x140002a10
test ebx, ebx
jne 0x140002a10
call fcn.1400020b0
nop
mov ecx, ebx
sub ecx, 2
je 0x140002a41
sub ecx, 1
je 0x140002a38
cmp ecx, 1
je 0x140002a2f
mov ebx, 1
lea rdi, str.OpenGL
jmp 0x140002a48
lea rdi, str.Directx_Auto
jmp 0x140002a48
lea rdi, str.Directx_11
jmp 0x140002a48
lea rdi, str.Directx_9
mov edx, ebx
mov ecx, r14d
call fcn.140001870
mov dword [section..data], eax
lea rcx, str.PASS
lea r8, str.FAIL
test eax, eax
cmove r8, rcx
mov rdx, rdi
lea rcx, str.Checking_for_Renderer__s...__t__s_n
call fcn.140002af0
jmp 0x140002a8a
call fcn.140002860
mov eax, dword [section..data]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov rdx, qword [rdi]
lea rcx, str.Usage:__s__renderer___glmode___n
call fcn.140002af0
lea rcx, str.__renderer__:_1_____opengl__2____DX9__3____DX11__4____DX11_auto_fallback_to_DX9_n
call fcn.140002af0
lea rcx, str.__renderer__:_99____Exit_with_non_zero_exit_code___1__n
call fcn.140002af0
lea rcx, str.__glmode____:_1_____PGA__default___2____AGA_n
call fcn.140002af0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
int3
Function at 0x140008b70
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
call fcn.14000aa70
mov edi, eax
test eax, eax
je 0x140008bf9
call fcn.140008380
mov ecx, dword [0x140015338]
mov edx, 1
mov r8, qword [rax]
call r8
test eax, eax
je 0x140008bf9
call fcn.140008380
cmp qword [rbx + 0x18], 0x10
mov r10, qword [rax + 8]
mov rax, rbx
jb 0x140008bc0
mov rax, qword [rbx]
mov edx, dword [0x140015338]
lea r9, str.xfileMove
mov dword [rsp + 0x38], edi
lea r8, str.C:code_app_playerhdSourcexplXfile.cpp
mov qword [rsp + 0x30], rax
mov ecx, 1
lea rax, str.Error_in_flushing_file__s_to_disk._Error___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9f
call r10
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x14000abb0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140015348]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
lea rcx, [rsp + 0x40]
call fcn.1400052d0
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x14000abe3
mov rbx, qword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400052d0
cmp qword [rax + 0x18], 8
jb 0x14000abfa
mov rax, qword [rax]
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
sete bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14000ac56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ac51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ac51
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b394
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], ax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000acb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000acab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000acab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b394
test bl, bl
je 0x14000acc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140003350
jmp 0x14000acc5
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000b510
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x14000aae0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140015348]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400052d0
cmp qword [rax + 0x18], 8
jb 0x14000ab0c
mov rax, qword [rax]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, qword [rsp + 0x38]
test eax, eax
sete bl
cmp rdx, 8
jb 0x14000ab61
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ab5c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ab5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b394
test bl, bl
je 0x14000ab92
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000ab92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140003350
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000b510
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000b510
add rsp, 0x50
pop rbx
ret
Function at 0x14000abb0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
call fcn.14000aa70
mov edi, eax
test eax, eax
je 0x140008bf9
call fcn.140008380
mov ecx, dword [0x140015338]
mov edx, 1
mov r8, qword [rax]
call r8
test eax, eax
je 0x140008bf9
call fcn.140008380
cmp qword [rbx + 0x18], 0x10
mov r10, qword [rax + 8]
mov rax, rbx
jb 0x140008bc0
mov rax, qword [rbx]
mov edx, dword [0x140015338]
lea r9, str.xfileMove
mov dword [rsp + 0x38], edi
lea r8, str.C:code_app_playerhdSourcexplXfile.cpp
mov qword [rsp + 0x30], rax
mov ecx, 1
lea rax, str.Error_in_flushing_file__s_to_disk._Error___d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9f
call r10
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x14000abb0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140015348]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
lea rcx, [rsp + 0x40]
call fcn.1400052d0
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x14000abe3
mov rbx, qword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400052d0
cmp qword [rax + 0x18], 8
jb 0x14000abfa
mov rax, qword [rax]
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
sete bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14000ac56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ac51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ac51
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b394
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], ax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14000acb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000acab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000acab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b394
test bl, bl
je 0x14000acc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140003350
jmp 0x14000acc5
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000b510
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x14000ae20
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140015348]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400052d0
cmp qword [rax + 0x18], 8
jb 0x14000ae4c
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, qword [rsp + 0x38]
mov ebx, eax
cmp rdx, 8
jb 0x14000ae9c
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae97
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ae97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b394
cmp ebx, 0xffffffff
jne 0x14000aec1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140003350
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000b510
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000b510
add rsp, 0x50
pop rbx
ret

Function at 0x14000aee0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000af17
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140003350
add rsp, 0x30
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x14000b150
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000b187
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140003350
add rsp, 0x30
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x415540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4156cb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005e4910]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4155a5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4155b4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4155d3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4155e3
cmp rbx, 0x1000
jae 0x4155ab
jmp 0x41564d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4155f5
xor edx, edx
jmp 0x415644
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x005e4910]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4155d9
jmp 0x4155c8
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005e4910]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x004dcafb]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004dd02a]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004df3dd]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x415700
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415926
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005e4910]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415773
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415782
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4157a5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4157b5
cmp rbx, 0x1000
jae 0x415779
nop
jmp 0x415838
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x4157cd
xor esi, esi
jmp 0x41582a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x005e4910]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x4157ab
jmp 0x415796
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x005e4910]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4158c0
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x004dd043]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x004dd02a]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004d9687]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x415860
call sym.runtime.printlock
lea rax, [0x004dd043]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x004dd02a]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x004debdd]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS