joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180020c20
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1800a0830]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rdi, rdx
xor ebx, ebx
mov rax, qword [0x1800a3100]
test rax, rax
jne 0x180020c8d
mov ecx, 0x1a8
call fcn.18002f60c
mov qword [rsp + 0x28], rax
test rax, rax
je 0x180020c83
mov rcx, rax
call fcn.18001ff00
jmp 0x180020c86
mov rax, rbx
mov qword [0x1800a3100], rax
mov rcx, rax
call fcn.180020030
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp word [rax], 0
jne 0x180020cb3
mov r8, rbx
jmp 0x180020ccb
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180020cc0
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18000ae90
nop
mov r8d, 0x10
lea rdx, str.INTLGTVCDbus.exe
lea rcx, [rsp + 0x50]
call fcn.1800102c0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180020e66
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.18004f390
lea r8, str.0da03ade
lea rdx, [0x18006b9d0]
lea rcx, [rsp + 0x70]
call fcn.180010760
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
xor r8d, r8d
lea rdx, [0x18006ae40]
lea rcx, [rsp + 0x30]
call fcn.18000ae90
nop
mov r8d, 1
lea rdx, [0x18006b9d8]
lea rcx, [rsp + 0x30]
call fcn.18000ae90
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180010190
mov r8d, 2
lea rdx, [0x18006b9dc]
lea rcx, [rsp + 0x30]
call fcn.1800102c0
cmp word [rsp + 0x70], 0
jne 0x180020db2
mov r8, rbx
jmp 0x180020dcb
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180020dc0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1800102c0
mov r8d, 2
lea rdx, [0x18006fd3c]
lea rcx, [rsp + 0x30]
call fcn.1800102c0
cmp word [rdi], 0
je 0x180020e0a
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x180020e00
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1800102c0
mov r8d, 1
lea rdx, [0x18006b9d8]
lea rcx, [rsp + 0x30]
call fcn.1800102c0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call fcn.18001cfa0
nop
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x180020e66
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.18000afe0
nop
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x180020e83
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.18000afe0
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.18002f6f0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180020eb0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800a0830]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
mov rax, qword [0x1800a3100]
test rax, rax
jne 0x180020f04
mov ecx, 0x1a8
call fcn.18002f60c
mov qword [rsp + 0x38], rax
test rax, rax
je 0x180020efa
mov rcx, rax
call fcn.18001ff00
jmp 0x180020efd
mov rax, rbx
mov qword [0x1800a3100], rax
mov rcx, rax
call fcn.180020030
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
cmp word [rax], 0
jne 0x180020f2a
mov r8, rbx
jmp 0x180020f3b
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180020f30
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18000ae90
nop
mov r8d, 0xc
lea rdx, str.TINTmhlp.exe
lea rcx, [rsp + 0x40]
call fcn.1800102c0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180020fa4
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ca89328d
call fcn.18001cd10
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x180020fc1
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.18000afe0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18002f6f0
add rsp, 0x70
pop rbx
ret
Function at 0x180025910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x40
mov rax, r8
mov rbx, rdx
mov rdx, rax
mov rcx, rbx
mov r8, r9
mov ebp, 0x8007000e
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x180025b52
mov rdx, rax
mov qword [rsp + 0x60], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x180025b4d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x180025b4d
mov edx, esi
mov qword [rsp + 0x70], r14
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
je 0x180025b48
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x180025b3f
mov r8d, esi
mov qword [rsp + 0x68], r12
mov rdx, rdi
mov rcx, rax
call fcn.18004ee70
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor r12d, r12d
lea r8, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x30], r12
mov rcx, r14
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x180025b3a
mov rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.180022bc0
mov rsi, rax
test rax, rax
je 0x180025b2f
mov eax, dword [rax + 0x10]
mov qword [rsp + 0x78], r15
mov dword [rsi + 0x10], r12d
test eax, eax
jne 0x180025b1c
cmp byte [rsp + 0x90], r12b
je 0x180025ad3
lea ecx, [rax + 0x18]
call sub.gdiplus.dll_GdipAlloc
mov edi, dword [rsp + 0x88]
mov rbx, rax
mov r15d, dword [rsp + 0x80]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x180025a62
mov rcx, rsi
call fcn.180022e10
mov r9d, eax
mov r8d, edi
mov edx, r15d
mov rcx, rbx
call fcn.180021d60
mov rcx, rax
jmp 0x180025a65
mov rcx, r12
mov rax, qword [rsp + 0x98]
mov qword [rax], rcx
test rcx, rcx
je 0x180025b1c
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], r12
call sub.gdiplus.dll_GdipGetImageGraphicsContext
mov rbx, qword [rsp + 0x38]
mov edx, 4
mov rcx, rbx
call sub.gdiplus.dll_GdipSetSmoothingMode
mov edx, 7
mov rcx, rbx
call sub.gdiplus.dll_GdipSetInterpolationMode
mov rdx, qword [rsi + 8]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov rcx, rbx
mov dword [rsp + 0x20], r15d
call sub.gdiplus.dll_GdipDrawImageRectI
mov rcx, rbx
mov ebp, r12d
call sub.gdiplus.dll_GdipDeleteGraphics
jmp 0x180025b1c
mov rcx, rsi
call fcn.180022e10
mov rcx, rsi
mov edi, eax
call fcn.180022de0
mov rcx, rsi
mov ebx, eax
call fcn.180023000
mov r9d, eax
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
mov rcx, rsi
call fcn.180022aa0
mov rcx, rax
mov rax, qword [rsp + 0x98]
test rcx, rcx
cmovne ebp, r12d
mov qword [rax], rcx
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [r8]
mov r15, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov r12, qword [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r14, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x60]
mov eax, ebp
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800294f0
Capabilities:
Check if file exists
Copy file
Read .ini file

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1800a4100]
test rax, rax
jne 0x18002952d
mov ecx, 0x178
call fcn.18002f60c
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180029526
mov rcx, rax
call fcn.180029a00
nop
mov qword [0x1800a4100], rax
mov rcx, rax
add rsp, 0x38
jmp fcn.18002bf70
Function at 0x18002c5b0
Capabilities:
Read .ini file

Disassembly:
push rbx
push r14
sub rsp, 0x468
mov rax, qword [0x1800a0830]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.18004f390
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.18004f390
mov rax, qword [r14 + 0x48]
mov rax, qword [rax]
mov rbx, qword [rax]
cmp rbx, rax
je 0x18002c7eb
mov qword [rsp + 0x488], rbp
mov qword [rsp + 0x490], rsi
mov qword [rsp + 0x460], r15
lea r15, str.nothing
mov qword [rsp + 0x498], rdi
mov rbp, qword [rbx + 0x28]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbp + rax*2 + 0x18], 0
jne 0x18002c640
test eax, eax
jle 0x18002c773
lea r8, [rbp + 0x18]
lea rdx, str.Is_s
lea rcx, [rsp + 0x240]
call fcn.180010760
lea rdi, [r14 + 0xf8]
cmp qword [rdi + 0x18], 8
jb 0x18002c67e
mov rax, qword [rdi]
jmp 0x18002c681
mov rax, rdi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, [0x1800717b0]
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x240]
lea rcx, str.HotKey
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [rsp + 0x30]
cmp ax, word [0x1800717b0]
jne 0x18002c6d9
movzx eax, word [rsp + 0x32]
cmp ax, word [0x1800717b2]
jne 0x18002c6d9
movzx eax, word [rsp + 0x34]
cmp ax, word [0x1800717b4]
je 0x18002c6e9
lea rcx, [rsp + 0x30]
call fcn.180055dfc
mov rcx, qword [rbp + 8]
mov byte [rcx], al
lea r8, [rbp + 0x18]
lea rdx, str.Use_s
lea rcx, [rsp + 0x240]
call fcn.180010760
cmp qword [rdi + 0x18], 8
jb 0x18002c70b
mov rdi, qword [rdi]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
mov r8, r15
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x240]
lea rcx, str.HotKey
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r15 + rcx*2 - 2]
jne 0x18002c757
cmp rcx, 8
jne 0x18002c740
jmp 0x18002c773
mov rdx, qword [rbp + 0x10]
lea rcx, [rsp + 0x30]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x18002c760
cmp byte [rbx + 0x19], 0
jne 0x18002c7be
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x18002c79e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x18002c7be
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x18002c790
jmp 0x18002c7be
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18002c7bb
cmp rbx, qword [rax + 0x10]
jne 0x18002c7bb
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18002c7a8
mov rbx, rax
mov rax, qword [r14 + 0x48]
cmp rbx, qword [rax]
jne 0x18002c631
mov r15, qword [rsp + 0x460]
mov rdi, qword [rsp + 0x498]
mov rsi, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18002f6f0
add rsp, 0x468
pop r14
pop rbx
ret
Function at 0x1800333b8
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1800333cb
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.180033a30
lea rdx, [0x18008ff78]
lea rcx, [rsp + 0x20]
call fcn.18004f2a8
int3

Function at 0x18003dfc4
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1800a5360]
xor edx, edx
jmp fcn.1800333b8

Function at 0x18003e9b4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1800a5360]
jmp fcn.1800333b8
Function at 0x14000b860
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14000b8ac
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14000b8fa
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000b8f5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b919
mov rcx, r8
call fcn.14002fdf4
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], sil
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call fcn.140051164
int3

Function at 0x14000b920
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
mov rax, qword [rbx + 0x10]
jb 0x14000b972
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r8d, [rax + rax]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000b9c5
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000b9c0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b9e4
mov rcx, r8
call fcn.14002fdf4
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call fcn.140051164
int3
Function at 0x14000d8f0
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400a0088]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov r15, rdx
mov qword [rsp + 0x30], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rbx, qword [rsp + 0xe0]
cmp qword [rcx + 0x18], 8
jb 0x14000d941
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000d976
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 7
mov word [r15], ax
lea r8d, [rax + 0x19]
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, r15
call fcn.140002010
jmp 0x14000da95
mov ecx, 0x208
mov r15d, 1
call fcn.140030118
mov rsi, rax
movdqa xmm0, xmmword [0x14008daa0]
movdqu xmmword [rsp + 0x58], xmm0
xor eax, eax
mov word [rsp + 0x48], ax
mov ebp, 0x104
lea rdi, [rax - 1]
nop word [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x14000d9bd
mov rax, qword [r14]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000d9ca
mov r8, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x14000d9d9
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x14000d9e7
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [rbp - 1]
cmp eax, ecx
jb 0x14000da5b
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000da0d
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000da27
add rax, 2
test ecx, ecx
jne 0x14000da13
test edx, edx
je 0x14000da5b
mov rcx, rsi
call fcn.14002fdf4
inc r15d
imul ebp, r15d, 0x104
mov ecx, ebp
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140030118
mov rsi, rax
jmp 0x14000d9b0
mov r15, qword [rsp + 0x30]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x14000da60
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140002010
mov rcx, rsi
call fcn.14002fdf4
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [r15 + 0x10], xmm1
mov rax, r15
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14002fdd0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000fa70
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400a0088]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
lea rdi, [0x1400a5c60]
mov qword [rbp - 1], rdi
mov rcx, rdi
call fcn.14002e9ac
test eax, eax
je 0x14000fac3
mov ecx, eax
call fcn.14002e468
nop
mov dword [rbp - 0x39], 1
xor esi, esi
mov dword [rbp - 0x31], esi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x31]
lea r8d, [rsi + 4]
lea rdx, [rbp - 0x39]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rbx + 0x358]
lea rcx, [rbp + 7]
call fcn.140011d90
mov rdx, rax
mov rcx, rbx
call fcn.14000b920
lea rdx, [rbx + 0x378]
lea rcx, [rbp + 7]
call fcn.140011d90
mov rdx, rax
mov rcx, rbx
call fcn.14000b920
lea rdx, [rbx + 0x398]
lea rcx, [rbp + 7]
call fcn.140011d90
mov rdx, rax
mov rcx, rbx
call fcn.14000b920
lea rdx, [rbx + 0x3b8]
lea rcx, [rbp + 7]
call fcn.140011d90
mov rdx, rax
mov rcx, rbx
call fcn.14000b920
lea rdx, [rbx + 0x2d8]
lea rcx, [rbp + 7]
call fcn.140011d90
mov rdx, rax
mov rcx, rbx
call fcn.14000b920
lea r8, [rbx + 0x4b0]
cmp qword [r8 + 0x10], rsi
jne 0x14000fc8a
movdqa xmm0, xmmword [0x14008dab0]
movdqu xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x27], sil
lea r8d, [rsi + 0xb]
lea rdx, str.Jan_22_2022
lea rcx, [rbp + 0x27]
call fcn.1400021c0
nop
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.140014da0
nop
lea r9d, [rsi + 6]
lea r8, str.Build.
mov rcx, rax
call fcn.1400072d0
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x29], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x19], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.14000b920
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x14000fc3c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fc37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fd0d
call fcn.14002fdf4
movdqa xmm0, xmmword [0x14008daa0]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], si
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14000fca5
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fc83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fd07
call fcn.14002fdf4
jmp 0x14000fca5
lea rdx, str.Build.
lea rcx, [rbp + 7]
call fcn.140002410
mov rdx, rax
mov rcx, rbx
call fcn.14000b920
lea rdx, [rbp + 7]
call fcn.140010000
mov rdx, rax
mov rcx, rbx
call fcn.14000b860
lea rdx, [rbp + 7]
call fcn.1400102a0
mov rdx, rax
mov rcx, rbx
call fcn.14000b860
nop
mov rcx, rdi
call fcn.14002e9d0
test eax, eax
je 0x14000fce2
mov ecx, eax
call fcn.14002e468
nop
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14002fdd0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140051164
nop
call fcn.140051164
int3
Function at 0x14000fd20
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rbx, rcx
lea rcx, [0x1400a5c60]
call fcn.14002e9ac
test eax, eax
je 0x14000fd4e
mov ecx, eax
call fcn.14002e468
mov dword [rsp + 0x58], 2
xor edi, edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0xb0]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x58]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [0x1400a5c60]
call fcn.14002e9d0
test eax, eax
je 0x14000fdbd
mov ecx, eax
call fcn.14002e468
nop
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140011720
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rsi, r8
mov rbx, rdx
mov qword [rax - 0x50], rdx
xor ebp, ebp
mov dword [rax - 0x68], ebp
mov rdi, qword [0x1400a56d0]
lea r14, [0x1400a5c60]
mov qword [rax - 0x48], r14
mov rcx, r14
call fcn.14002e9ac
test eax, eax
je 0x140011773
mov ecx, eax
call fcn.14002e468
nop
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x30]
mov r8d, 4
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.140001f30
mov rdx, rax
mov rcx, rdi
call fcn.14000b860
nop
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
mov r8d, 4
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x30]
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], 0
mov dword [rsp + 0x40], 2
mov rdx, rsi
mov rcx, rbx
call fcn.1400044c0
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140011816
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.14002e9d0
test eax, eax
je 0x140011842
mov ecx, eax
call fcn.14002e468
nop
mov rax, rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140012750
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400128e0
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, rcx
mov rbx, qword [rcx + 0x20]
xor esi, esi
mov qword [rcx + 0x20], rsi
mov rcx, qword [rcx + 0x10]
call fcn.14002e9ac
nop
test eax, eax
je 0x14001291b
mov ecx, eax
call fcn.14002e468
nop
mov byte [rdi + 0x18], 1
mov rcx, qword [rdi + 8]
call fcn.14002ecc4
nop
test eax, eax
je 0x140012935
mov ecx, eax
call fcn.14002e468
nop
mov rcx, qword [rdi + 0x10]
call fcn.14002e9d0
nop
test eax, eax
je 0x14001294b
mov ecx, eax
call fcn.14002e468
nop
lea rcx, [0x1400a5c60]
call fcn.14002e9ac
nop
test eax, eax
je 0x140012964
mov ecx, eax
call fcn.14002e468
nop
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x78], 6
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov r8d, 4
lea rdx, [rsp + 0x78]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140001f30
nop
mov rdx, rax
mov rcx, qword [rbx + 0x28]
call fcn.14000b860
nop
mov eax, esi
cmp byte [rbx + 0x20], al
setne al
mov dword [rsp + 0x78], eax
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x70]
mov r8d, 4
lea rdx, [rsp + 0x78]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [0x1400a5c60]
call fcn.14002e9d0
nop
test eax, eax
je 0x1400129fc
mov ecx, eax
call fcn.14002e468
nop
call fcn.14002ece4
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140012a39
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140012a33
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140012a66
mov rcx, r8
call fcn.14002fdf4
nop
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], 0
mov edx, 0x30
mov rcx, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp fcn.14002fdf4
call fcn.140051164
nop
int3