joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d360
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [0x14002a940]
mov r13d, edx
mov r12d, 0x1000
xor edx, edx
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [0x14002afc0]
mov rdx, rbx
mov rbp, rax
mov rdi, rax
call fcn.14001f65c
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x14001d4ce
mov qword [rsp + 0x60], rsi
mov esi, r12d
nop dword [rax + rax]
mov byte [rsp + 0x70], r14b
lea rdx, [rsp + 0x70]
cmp qword [rbx + 8], r14
je 0x14001d3e4
mov r8d, 1
mov rcx, rbx
call fcn.14001de50
mov dword [rsp + 0x78], eax
jmp 0x14001d3fd
mov rcx, qword [rbx]
lea r9, [rsp + 0x78]
mov r8d, 1
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
movzx ecx, byte [rsp + 0x70]
test cl, cl
je 0x14001d410
mov byte [rdi], cl
movzx ecx, byte [rsp + 0x70]
inc rdi
mov rax, rdi
sub rax, rbp
cmp rax, rsi
jl 0x14001d44d
mov rcx, qword [0x14002a940]
add r12d, 0x1000
mov r8, rbp
movsxd rsi, r12d
mov edx, 8
sub edi, ebp
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx ecx, byte [rsp + 0x70]
movsxd rdi, edi
mov rbp, rax
add rdi, rax
test cl, cl
je 0x14001d4c9
cmp dword [rsp + 0x78], r14d
je 0x14001d466
cmp cl, 0xd
je 0x14001d466
cmp cl, 0xa
jne 0x14001d3c0
dec rdi
cmp cl, 0xd
jne 0x14001d4c9
lea rdx, [rsp + 0x70]
cmp qword [rbx + 8], r14
je 0x14001d489
mov r8d, 1
mov rcx, rbx
call fcn.14001de50
jmp 0x14001d4a2
mov rcx, qword [rbx]
lea r9, [rsp + 0x78]
mov r8d, 1
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rsp + 0x70], 0xa
je 0x14001d4c9
cmp qword [rbx + 8], r14
je 0x14001d4b4
inc dword [rbx + 0x14]
jmp 0x14001d4c9
mov rcx, qword [rbx]
mov r9d, 1
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rsi, qword [rsp + 0x60]
or r9d, 0xffffffff
mov r8, rbp
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], r14d
mov byte [rdi], r14b
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, r13d
lea ecx, [rax - 1]
mov ebx, eax
call fcn.140020170
or r9d, 0xffffffff
mov r8, rbp
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [0x14002a940]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x14001d540
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdx, rcx
mov rcx, qword [0x14002afc0]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
call fcn.14001f65c
mov rdi, rax
test rax, rax
je 0x14001d5e4
cmp qword [rax + 8], rbx
je 0x14001d5a7
lea r8d, [rbx + 1]
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14001de50
test rax, rax
je 0x14001d594
inc dword [rdi + 0x14]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ebx, 1
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov r8d, 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001d5f6
cmp dword [rsp + 0x58], ebx
je 0x14001d5f6
mov rcx, qword [rdi]
mov r9d, 1
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, dword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
or ebx, 0xffffffff
movsxd rax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14001d610
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, rcx
mov rcx, qword [0x14002afc0]
call fcn.14001f65c
mov rbx, rax
test rax, rax
je 0x14001d664
cmp qword [rax + 8], 0
je 0x14001d642
cmp dword [rax + 0x1c], 0
jne 0x14001d642
mov rcx, rax
call fcn.14001cae0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r11d, eax
mov eax, dword [rsp + 0x38]
shl rax, 0x20
or rax, r11
add rsp, 0x20
pop rbx
ret
or rax, 0xffffffffffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x14001d670
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rdx, rcx
mov rcx, qword [0x14002afc0]
mov rbx, r8
mov dword [rsp + 0x58], 0
call fcn.14001f65c
test rax, rax
je 0x14001d6d8
cmp qword [rax + 8], 0
mov rdx, rdi
je 0x14001d6be
mov r8, rbx
mov rcx, rax
call fcn.14001de50
cdqe
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x58]
mov r8d, ebx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001d7e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rdx, rcx
mov rcx, qword [0x14002afc0]
xor esi, esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x68], esi
call fcn.14001f65c
mov rbx, rax
test rax, rax
je 0x14001d8e4
test rdi, rdi
je 0x14001d87c
cmp word [rdi], si
je 0x14001d87c
lea r8, [rsp + 0x30]
mov rdx, rdi
mov ecx, 0xfde9
call fcn.14001df80
mov rdi, rax
test rax, rax
je 0x14001d87c
mov r8d, dword [rsp + 0x30]
mov rdx, rax
cmp qword [rbx + 8], rsi
je 0x14001d857
mov rcx, rbx
call fcn.14001dd50
mov dword [rsp + 0x60], eax
jmp 0x14001d86a
mov rcx, qword [rbx]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14002a940]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8d, 2
lea rdx, [0x1400240a0]
cmp qword [rbx + 8], rsi
je 0x14001d8b3
mov rcx, rbx
call fcn.14001dd50
mov r11, rax
mov eax, dword [rsp + 0x60]
add eax, r11d
cdqe
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rbx]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x60]
mov r11d, dword [rsp + 0x68]
add eax, r11d
cdqe
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
movsxd rax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14001d900
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdx, rcx
mov rcx, qword [0x14002afc0]
call fcn.14001f65c
mov rdi, rax
test rax, rax
je 0x14001d940
mov rcx, rbx
call fcn.14001d2d0
mov rcx, rbx
mov rdx, rax
call fcn.14001d780
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001d950
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
mov rdx, rcx
mov rcx, qword [0x14002afc0]
call fcn.14001f65c
test rax, rax
je 0x14001d9fa
sub ebx, 2
je 0x14001d9c1
sub ebx, 2
je 0x14001d9b2
dec ebx
je 0x14001d9a3
dec ebx
je 0x14001d994
cmp ebx, 0x13
jne 0x14001d9fa
lea r8d, [rbx - 0x11]
lea rdx, [0x140024110]
jmp 0x14001d9ce
mov r8d, 4
lea rdx, [0x140024108]
jmp 0x14001d9ce
mov r8d, 4
lea rdx, [0x140024100]
jmp 0x14001d9ce
mov r8d, 2
lea rdx, [0x1400240fc]
jmp 0x14001d9ce
mov r8d, 3
lea rdx, [0x14002409c]
cmp qword [rax + 8], 0
je 0x14001d9e3
mov rcx, rax
call fcn.14001dd50
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rax]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x30
pop rbx
ret
Function at 0x14001da00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rdi, rcx
call 0x14001e040
lea rdx, [0x140024114]
mov r8d, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14001e040
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov edi, r8d
mov rsi, rdx
mov dword [rsp + 0x48], 0
test rdx, rdx
je 0x14001e14b
cmp word [rdx], 0
je 0x14001e14b
mov rdx, rcx
mov rcx, qword [0x14002afc0]
mov qword [rsp + 0x40], rbx
call fcn.14001f65c
mov rbx, rax
test rax, rax
je 0x14001e146
mov rdx, rsi
cmp edi, 0x19
jne 0x14001e0e1
or rcx, 0xffffffffffffffff
cmp qword [rax + 8], 0
mov rdi, rsi
je 0x14001e0bf
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, rbx
call fcn.14001dd50
mov dword [rsp + 0x48], eax
jmp 0x14001e146
xor eax, eax
lea r9, [rsp + 0x48]
repne scasw ax, word [rdi]
mov qword [rsp + 0x20], rax
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14001e146
xor ecx, ecx
mov eax, 0xfde9
cmp edi, 2
lea r8, [rsp + 0x58]
cmove ecx, eax
call fcn.14001df80
mov rdi, rax
test rax, rax
je 0x14001e146
cmp qword [rbx + 8], 0
mov r8d, dword [rsp + 0x58]
mov rdx, rax
je 0x14001e11d
mov rcx, rbx
call fcn.14001dd50
mov dword [rsp + 0x48], eax
jmp 0x14001e134
mov rcx, qword [rbx]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14002a940]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
movsxd rax, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14001da40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
sub rsp, 0x30
mov rdi, rcx
mov rdx, rcx
mov rcx, qword [0x14002afc0]
xor r12d, r12d
mov ebx, 0x18
mov dword [rsp + 0x60], r12d
call fcn.14001f65c
mov rbp, rax
test rax, rax
je 0x14001db83
mov rcx, rdi
mov qword [rsp + 0x50], rsi
call fcn.14001d2d0
lea rdx, [rsp + 0x58]
mov rsi, rax
cmp qword [rbp + 8], r12
je 0x14001daa8
lea r8d, [rbx - 0x14]
mov rcx, rbp
call fcn.14001de50
mov r11, rax
mov dword [rsp + 0x60], eax
jmp 0x14001dac7
mov rcx, qword [rbp]
lea r9, [rsp + 0x60]
mov r8d, 4
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rsp + 0x60]
cmp r11d, 2
jl 0x14001dae9
movzx eax, word [rsp + 0x58]
cmp ax, word [0x140024110]
jne 0x14001dae9
mov ebx, 0x19
lea rdx, [rsi + 2]
jmp 0x14001db76
cmp r11d, 3
jl 0x14001db24
lea rax, [rsp + 0x58]
lea rcx, [0x14002409c]
movzx edx, word [rax]
cmp dx, word [rcx]
jne 0x14001db0c
movzx edx, byte [rax + 2]
cmp dl, byte [rcx + 2]
je 0x14001db14
sbb eax, eax
sbb eax, 0xffffffff
mov r12d, eax
test r12d, r12d
jne 0x14001db24
lea ebx, [r12 + 2]
lea rdx, [rsi + 3]
jmp 0x14001db76
cmp r11d, 2
jl 0x14001db43
movzx eax, word [rsp + 0x58]
cmp ax, word [0x1400240fc]
jne 0x14001db43
mov ebx, 4
lea rdx, [rsi + 2]
jmp 0x14001db76
cmp r11d, 4
jl 0x14001db73
mov eax, dword [rsp + 0x58]
cmp eax, dword [0x140024100]
jne 0x14001db60
mov ebx, 5
lea rdx, [rsi + 4]
jmp 0x14001db76
cmp eax, dword [0x140024108]
jne 0x14001db73
mov ebx, 6
lea rdx, [rsi + 4]
jmp 0x14001db76
mov rdx, rsi
mov rcx, rdi
call fcn.14001d780
mov rsi, qword [rsp + 0x50]
movsxd rax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r12
pop rdi
pop rbp
ret

Function at 0x14001dca0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
mov dword [rsp + 0x48], 0
test rdx, rdx
je 0x14001dd45
cmp word [rdx], 0
je 0x14001dd45
mov rdx, rcx
mov rcx, qword [0x14002afc0]
mov qword [rsp + 0x40], rdi
call fcn.14001f65c
mov rdi, rax
test rax, rax
je 0x14001dd40
lea r8, [rsp + 0x50]
mov rdx, rbx
mov ecx, 0xfde9
call fcn.14001df80
mov rbx, rax
test rax, rax
je 0x14001dd40
cmp qword [rdi + 8], 0
mov r8d, dword [rsp + 0x50]
mov rdx, rax
je 0x14001dd17
mov rcx, rdi
call fcn.14001dd50
mov dword [rsp + 0x48], eax
jmp 0x14001dd2e
mov rcx, qword [rdi]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14002a940]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x40]
movsxd rax, dword [rsp + 0x48]
add rsp, 0x30
pop rbx
ret
Function at 0x14001dd50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x1c], 1
movsxd rdi, r8d
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x50], 0
jne 0x14001dd9a
mov edx, dword [rcx + 0x14]
mov rcx, qword [rcx]
mov r9d, 1
neg edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0x1c], 0
mov dword [rbx + 0x14], eax
mov ecx, dword [rbx + 0x14]
cmp ecx, edi
jle 0x14001ddd6
mov eax, dword [rbx + 0x10]
mov edx, edi
sub eax, ecx
movsxd rcx, eax
add rcx, qword [rbx + 8]
dec edx
je 0x14001ddcf
dec edx
je 0x14001ddc7
cmp edx, 2
je 0x14001ddc1
mov rdx, rsi
jmp 0x14001de24
mov eax, dword [rsi]
mov dword [rcx], eax
jmp 0x14001de2c
movzx eax, word [rsi]
mov word [rcx], ax
jmp 0x14001de2c
movzx eax, byte [rsi]
mov byte [rcx], al
jmp 0x14001de2c
mov rcx, rbx
call fcn.14001cae0
mov r11d, dword [rbx + 0x10]
mov rdx, rsi
cmp edi, r11d
jl 0x14001de19
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
movsxd rax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
sub r11d, dword [rbx + 0x14]
movsxd rcx, r11d
add rcx, qword [rbx + 8]
mov r8, rdi
call sub.msvcrt.dll_memcpy
sub dword [rbx + 0x14], edi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x14001de50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor r12d, r12d
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp dword [rcx + 0x1c], r12d
jne 0x14001de84
call fcn.14001cae0
mov dword [rbx + 0x1c], 1
mov dword [rbx + 0x14], r12d
movsxd rcx, dword [rbx + 0x14]
mov eax, dword [rbx + 0x18]
sub eax, ecx
mov rbp, rcx
cmp rcx, rdi
jl 0x14001dee9
movsxd rcx, eax
mov rax, rdi
add rcx, qword [rbx + 8]
dec rax
je 0x14001dedf
dec rax
je 0x14001ded1
cmp rax, 2
je 0x14001dec5
mov rdx, rcx
mov r8, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
movsxd rax, edi
jmp 0x14001df64
mov eax, dword [rcx]
mov dword [rsi], eax
movsxd rax, edi
jmp 0x14001df64
movzx eax, word [rcx]
mov word [rsi], ax
movsxd rax, edi
jmp 0x14001df64
movzx eax, byte [rcx]
mov byte [rsi], al
movsxd rax, edi
jmp 0x14001df64
movsxd rdx, eax
mov r8, rcx
mov rcx, rsi
add rdx, qword [rbx + 8]
call sub.msvcrt.dll_memcpy
movsxd r8, dword [rbx + 0x10]
mov rcx, qword [rbx]
sub rdi, rbp
add rsi, rbp
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
cmp rdi, r8
jl 0x14001df31
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x50]
mov dword [rbx + 0x14], r12d
add eax, ebp
cdqe
jmp 0x14001df67
mov rdx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd r11, dword [rsp + 0x50]
mov rdx, qword [rbx + 8]
cmp rdi, r11
mov rcx, rsi
mov dword [rbx + 0x14], r11d
cmovg rdi, r11
mov dword [rbx + 0x18], r11d
mov r8, rdi
call sub.msvcrt.dll_memcpy
lea eax, [rbp + rdi]
cdqe
sub dword [rbx + 0x14], edi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x14001e040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rdi, rcx
call 0x14001e040
lea rdx, [0x140024114]
mov r8d, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14001e040
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov edi, r8d
mov rsi, rdx
mov dword [rsp + 0x48], 0
test rdx, rdx
je 0x14001e14b
cmp word [rdx], 0
je 0x14001e14b
mov rdx, rcx
mov rcx, qword [0x14002afc0]
mov qword [rsp + 0x40], rbx
call fcn.14001f65c
mov rbx, rax
test rax, rax
je 0x14001e146
mov rdx, rsi
cmp edi, 0x19
jne 0x14001e0e1
or rcx, 0xffffffffffffffff
cmp qword [rax + 8], 0
mov rdi, rsi
je 0x14001e0bf
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, rbx
call fcn.14001dd50
mov dword [rsp + 0x48], eax
jmp 0x14001e146
xor eax, eax
lea r9, [rsp + 0x48]
repne scasw ax, word [rdi]
mov qword [rsp + 0x20], rax
not rcx
lea r8d, [rcx + rcx - 2]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14001e146
xor ecx, ecx
mov eax, 0xfde9
cmp edi, 2
lea r8, [rsp + 0x58]
cmove ecx, eax
call fcn.14001df80
mov rdi, rax
test rax, rax
je 0x14001e146
cmp qword [rbx + 8], 0
mov r8d, dword [rsp + 0x58]
mov rdx, rax
je 0x14001e11d
mov rcx, rbx
call fcn.14001dd50
mov dword [rsp + 0x48], eax
jmp 0x14001e134
mov rcx, qword [rbx]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x14002a940]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
movsxd rax, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14001e160
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
mov rcx, qword [0x14002a940]
mov rbp, r8
mov r13d, edx
mov r8d, 0x1000
xor edx, edx
mov r15, r9
xor edi, edi
mov r14d, 0x800
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
je 0x14001e333
movzx edx, word [rsp + 0x30]
mov qword [rsp + 0x70], rbx
mov rbx, rax
nop dword [rax]
cmp rbp, 0xffffffffffffffff
je 0x14001e1d2
test rbp, rbp
je 0x14001e294
dec rbp
cmp qword [rsi + 8], 0
lea rdx, [rsp + 0x30]
je 0x14001e1f2
mov r8d, 2
mov rcx, rsi
call fcn.14001de50
mov dword [rsp + 0x34], eax
jmp 0x14001e20f
mov rcx, qword [rsi]
lea r9, [rsp + 0x34]
mov r8d, 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x34]
movzx edx, word [rsp + 0x30]
cmp eax, 2
jne 0x14001e294
test dx, dx
je 0x14001e22a
mov word [rbx], dx
movzx edx, word [rsp + 0x30]
add rbx, 2
mov rdi, rbx
lea eax, [r14 - 1]
sub rdi, r12
movsxd rcx, eax
sar rdi, 1
cmp rdi, rcx
jle 0x14001e270
mov rcx, qword [0x14002a940]
add r14d, 0x800
mov r8, r12
movsxd r9, r14d
mov edx, 8
add r9, r9
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx edx, word [rsp + 0x30]
mov r12, rax
movsxd rax, edi
lea rbx, [r12 + rax*2]
test dx, dx
je 0x14001e294
mov edi, 0
test r13d, r13d
jne 0x14001e1c0
cmp dx, 0xd
je 0x14001e299
cmp dx, 0xa
je 0x14001e29f
jmp 0x14001e1c0
test r13d, r13d
jne 0x14001e2a3
cmp dx, 0xa
jne 0x14001e2be
sub rbx, 2
xor edi, edi
mov rax, rbx
sub rax, r12
sar rax, 1
mov qword [r15], rax
mov word [rbx], di
mov rbx, qword [rsp + 0x70]
mov rax, r12
jmp 0x14001e336
cmp dx, 0xd
jne 0x14001e2a3
sub rbx, 2
cmp qword [rsi + 8], 0
lea rdx, [rsp + 0x30]
je 0x14001e2ea
mov r8d, 2
mov rcx, rsi
call fcn.14001de50
xor edi, edi
mov dword [rsp + 0x34], eax
jmp 0x14001e303
mov rcx, qword [rsi]
xor edi, edi
lea r9, [rsp + 0x34]
lea r8d, [rdi + 2]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [rsp + 0x30], 0xa
je 0x14001e2a5
cmp qword [rsi + 8], 0
je 0x14001e318
add dword [rsi + 0x14], 2
jmp 0x14001e2a5
mov rcx, qword [rsi]
mov r9d, 1
xor r8d, r8d
lea edx, [r9 - 3]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x14001e2a5
mov rax, rdi
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001e360
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [0x14002a940]
mov rsi, r8
mov r12d, edx
mov r13d, 0x1000
xor edx, edx
mov r8d, r13d
mov r14, r9
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14001e515
movzx r8d, byte [rsp + 0x30]
mov qword [rsp + 0x70], rbx
mov rbx, rax
cmp rsi, 0xffffffffffffffff
je 0x14001e3ca
test rsi, rsi
je 0x14001e487
dec rsi
lea rdx, [rsp + 0x30]
cmp qword [rdi + 8], r15
je 0x14001e3e9
mov r8d, 1
mov rcx, rdi
call fcn.14001de50
mov dword [rsp + 0x34], eax
jmp 0x14001e406
mov rcx, qword [rdi]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x34]
movzx r8d, byte [rsp + 0x30]
cmp eax, 1
jne 0x14001e487
test r8b, r8b
je 0x14001e422
mov byte [rbx], r8b
movzx r8d, byte [rsp + 0x30]
inc rbx
lea eax, [r13 - 1]
mov rdx, rbx
movsxd rcx, eax
sub rdx, rbp
cmp rdx, rcx
jle 0x14001e464
mov rcx, qword [0x14002a940]
add r13d, 0x1000
mov r8, rbp
mov edx, 8
movsxd r9, r13d
sub ebx, ebp
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
movzx r8d, byte [rsp + 0x30]
movsxd rbx, ebx
mov rbp, rax
add rbx, rax
test r8b, r8b
je 0x14001e487
test r12d, r12d
jne 0x14001e3b8
cmp r8b, 0xd
je 0x14001e48c
cmp r8b, 0xa
jne 0x14001e3b8
dec rbx
jmp 0x14001e4ff
test r12d, r12d
jne 0x14001e4ff
cmp r8b, 0xa
jne 0x14001e497
dec rbx
jmp 0x14001e4ff
cmp r8b, 0xd
jne 0x14001e4ff
dec rbx
lea rdx, [rsp + 0x30]
cmp qword [rdi + 8], r15
je 0x14001e4bf
mov r8d, 1
mov rcx, rdi
call fcn.14001de50
mov dword [rsp + 0x34], eax
jmp 0x14001e4d8
mov rcx, qword [rdi]
lea r9, [rsp + 0x34]
mov r8d, 1
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rsp + 0x30], 0xa
je 0x14001e4ff
cmp qword [rdi + 8], r15
je 0x14001e4ea
inc dword [rdi + 0x14]
jmp 0x14001e4ff
mov rcx, qword [rdi]
mov r9d, 1
xor r8d, r8d
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rax, rbx
sub rax, rbp
mov qword [r14], rax
mov byte [rbx], r15b
mov rbx, qword [rsp + 0x70]
mov rax, rbp
jmp 0x14001e518
mov rax, r15
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret