joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bf5c
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1400a3ac8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ebx, r8d
mov rsi, rdx
xor edi, edi
mov rcx, qword [str._0_n_]
lea r14, str._0_n_
cmp rcx, r14
je 0x14000bfc2
test byte [rcx + 0x1c], 4
je 0x14000bfc2
cmp byte [rcx + 0x19], 5
jb 0x14000bfc2
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092c30]
mov edx, 0xea
call fcn.14000459c
lea rcx, str.Inbox
test ebx, ebx
lea rax, str.SentItems
mov r9, rsi
cmove rax, rcx
lea r8, [0x140092720]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0x104
call fcn.140004520
mov ebx, eax
test eax, eax
jns 0x14000c03f
mov rcx, qword [str._0_n_]
cmp rcx, r14
je 0x14000c02a
test byte [rcx + 0x1c], 4
je 0x14000c02a
cmp byte [rcx + 0x19], 2
jb 0x14000c02a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092c30]
mov edx, 0xeb
mov r9d, eax
call fcn.1400045c8
mov eax, ebx
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x14000c03b
movzx ebx, bx
mov eax, ebx
jmp 0x14000c09a
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14000c098
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rcx, qword [str._0_n_]
cmp rcx, r14
je 0x14000c098
test byte [rcx + 0x1c], 4
je 0x14000c098
cmp byte [rcx + 0x19], 2
jb 0x14000c098
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x30]
mov edx, 0xec
mov dword [rsp + 0x20], eax
lea r8, [0x140092c30]
call fcn.14000c804
mov eax, edi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001b10
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14000ced4
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, rdx
mov rcx, qword [str._0_n_]
lea r14, str._0_n_
cmp rcx, r14
je 0x14000cf20
test byte [rcx + 0x1c], 4
je 0x14000cf20
cmp byte [rcx + 0x19], 5
jb 0x14000cf20
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092d00]
mov edx, 0x20
call fcn.14000459c
mov r9d, 2
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.14006f790
xor ebx, ebx
mov rsi, rax
test rax, rax
jne 0x14000cf95
mov rax, qword [str._0_n_]
cmp rax, r14
je 0x14000cff6
test byte [rax + 0x1c], 4
je 0x14000cff6
cmp byte [rax + 0x19], 3
jb 0x14000cff6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [str._0_n_]
lea edx, [rsi + 0x21]
mov r9, rdi
mov dword [rsp + 0x20], eax
lea r8, [0x140092d00]
mov rcx, qword [rcx + 0x10]
call fcn.140004880
jmp 0x14000cff6
lea rdx, str.NTUserName
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
je 0x14000cfe7
mov rcx, qword [str._0_n_]
cmp rcx, r14
je 0x14000cfe7
test byte [rcx + 0x1c], 4
je 0x14000cfe7
cmp byte [rcx + 0x19], 3
jb 0x14000cfe7
mov rcx, qword [rcx + 0x10]
lea r9, str.NTUserName
mov edx, 0x22
mov dword [rsp + 0x20], eax
lea r8, [0x140092d00]
call fcn.14000c804
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.14006ee70
test eax, eax
jne 0x14000d04b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._0_n_]
cmp rcx, r14
je 0x14000d04b
test byte [rcx + 0x1c], 4
je 0x14000d04b
cmp byte [rcx + 0x19], 2
jb 0x14000d04b
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092d00]
mov edx, 0x23
mov dword [rsp + 0x20], eax
mov r9, rdi
call fcn.14000c804
mov rsi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x14000ef68
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rbp, rdx
mov r14, rcx
mov rcx, qword [str._0_n_]
lea rax, str._0_n_
cmp rcx, rax
je 0x14000efbe
test byte [rcx + 0x1c], 4
je 0x14000efbe
cmp byte [rcx + 0x19], 5
jb 0x14000efbe
mov rcx, qword [rcx + 0x10]
lea r8, [0x140092d00]
mov edx, 0x44
call fcn.14000459c
mov rbx, qword [r14]
mov rbx, qword [rbx]
cmp rbx, qword [r14]
je 0x14000eff1
mov rsi, qword [rbx + 0x10]
mov rcx, rbp
mov rdx, qword [rsi + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x14000efc1
test rdi, rdi
je 0x14000efec
mov qword [rdi], rbx
mov rax, rsi
jmp 0x14000eff3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400152b0
Capabilities:
Compare security identifiers

Disassembly:
sub rsp, 0x28
mov r10d, dword [rcx + 0x24]
test edx, r10d
jne 0x1400152c1
xor eax, eax
jmp 0x1400152fd
lea eax, [r10 - 4]
test eax, 0xfffffffb
je 0x1400152f8
test r8d, r8d
jne 0x1400152f8
cmp r10d, 2
jne 0x1400152de
mov rcx, qword [rcx + 0x248]
mov rdx, qword [rcx + 0x198]
mov rcx, r9
call qword [sym.imp.ADVAPI32.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x1400152bd
mov eax, 1
add rsp, 0x28
ret

Function at 0x1400242d4
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rcx, qword [str._0_n_]
lea r14, str._0_n_
cmp rcx, r14
je 0x14002431d
test byte [rcx + 0x1c], 4
je 0x14002431d
cmp byte [rcx + 0x19], 5
jb 0x14002431d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400931c0]
mov edx, 0x2b
call fcn.14000459c
mov r9d, 0x2001f
lea rdx, str.SoftwareMicrosoftFaxReceipts
xor r8d, r8d
mov rcx, 0xffffffff80000002
call fcn.14006f790
xor esi, esi
mov rdi, rax
test rax, rax
jne 0x140024395
mov rax, qword [str._0_n_]
cmp rax, r14
je 0x14002449c
test byte [rax + 0x1c], 4
je 0x14002449c
cmp byte [rax + 0x19], 2
jb 0x14002449c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [str._0_n_]
lea edx, [rdi + 0x2c]
mov r9d, eax
lea r8, [0x1400931c0]
mov rcx, qword [rcx + 0x10]
call fcn.140004994
jmp 0x14002449c
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140083d0c
mov rbx, rax
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x140024469
test eax, eax
je 0x14002441f
test rbx, rbx
lea r8, [0x1400926f8]
mov rcx, rdi
cmovne r8, rbx
call fcn.140085830
test eax, eax
jne 0x140024469
mov rax, qword [str._0_n_]
cmp rax, r14
je 0x14002441f
test byte [rax + 0x1c], 4
je 0x14002441f
cmp byte [rax + 0x19], 2
jb 0x14002441f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [str._0_n_]
lea r8, [0x1400931c0]
mov edx, 0x2d
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.140004994
lea rdx, str.Password
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
je 0x140024469
mov rcx, qword [str._0_n_]
cmp rcx, r14
je 0x140024469
test byte [rcx + 0x1c], 4
je 0x140024469
cmp byte [rcx + 0x19], 2
jb 0x140024469
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400931c0]
mov edx, 0x2e
mov r9d, eax
call fcn.140004994
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test rbx, rbx
je 0x14002449c
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], si
jne 0x140024481
add rcx, rcx
xor eax, eax
mov rdi, rbx
rep stosb byte [rdi], al
mov rcx, rbx
call fcn.14006a328
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140026c20
Capabilities:
Listen for remote procedure calls

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
sub rsp, 0x20
mov rcx, qword [str._0_n_]
lea rsi, str._0_n_
lea rbp, [0x1400931c0]
cmp rcx, rsi
je 0x140026c66
test byte [rcx + 0x1c], 4
je 0x140026c66
cmp byte [rcx + 0x19], 5
jb 0x140026c66
mov rcx, qword [rcx + 0x10]
mov edx, 0x64
mov r8, rbp
call fcn.14000459c
call fcn.1400240a8
mov ebx, eax
test eax, eax
je 0x140026ca4
mov rcx, qword [str._0_n_]
cmp rcx, rsi
je 0x140026c9d
test byte [rcx + 0x1c], 4
je 0x140026c9d
cmp byte [rcx + 0x19], 2
jb 0x140026c9d
mov edx, 0x65
mov r9d, eax
mov rcx, qword [rcx + 0x10]
mov r8, rbp
call fcn.140004994
mov eax, ebx
jmp 0x140026df6
call fcn.14006fbd4
lea ecx, [rax - 1]
cmp ecx, 1
jbe 0x140026d5a
cmp eax, 0x20
je 0x140026d5a
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0xa]
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x140026d5a
mov rcx, qword [str._0_n_]
cmp rcx, rsi
je 0x140026d08
test byte [rcx + 0x1c], 4
je 0x140026d08
cmp byte [rcx + 0x19], 2
jb 0x140026d08
mov rcx, qword [rcx + 0x10]
mov edx, 0x66
mov r9d, eax
mov r8, rbp
call fcn.140004994
xor edx, edx
lea rcx, [0x14008e200]
lea r8d, [rdx + 1]
call qword [sym.imp.RPCRT4.dll_RpcServerUnregisterIf]
nop dword [rax + rax]
test eax, eax
je 0x140026c9d
mov rcx, qword [str._0_n_]
cmp rcx, rsi
je 0x140026c9d
test byte [rcx + 0x1c], 4
je 0x140026c9d
cmp byte [rcx + 0x19], 2
jb 0x140026c9d
mov edx, 0x67
mov r9d, eax
jmp 0x140026c91
mov ecx, 1
mov edx, 0x4d2
mov r8d, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x140026df4
mov rcx, qword [str._0_n_]
cmp rcx, rsi
je 0x140026da5
test byte [rcx + 0x1c], 4
je 0x140026da5
cmp byte [rcx + 0x19], 2
jb 0x140026da5
mov rcx, qword [rcx + 0x10]
mov edx, 0x68
mov r9d, eax
mov r8, rbp
call fcn.140004994
xor edx, edx
lea rcx, [0x14008e200]
lea r8d, [rdx + 1]
call qword [sym.imp.RPCRT4.dll_RpcServerUnregisterIf]
nop dword [rax + rax]
test eax, eax
je 0x140026c9d
mov rcx, qword [str._0_n_]
cmp rcx, rsi
je 0x140026c9d
test byte [rcx + 0x1c], 4
je 0x140026c9d
cmp byte [rcx + 0x19], 2
jb 0x140026c9d
mov edx, 0x69
jmp 0x140026d52
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x140028e28
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x60
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov esi, ebp
lea edx, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
nop dword [rax + rax]
mov rcx, qword [str._0_n_]
lea r14, str._0_n_
cmp rcx, r14
je 0x140028e8e
test byte [rcx + 0x1c], 4
je 0x140028e8e
cmp byte [rcx + 0x19], 5
jb 0x140028e8e
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x17]
lea r8, [0x1400931c0]
call fcn.14000459c
call fcn.140070ccc
lea rax, [0x140092710]
mov qword [0x1400a7320], rbp
lea rbx, [0x1400a7310]
mov qword [0x1400a7338], rax
mov qword [str._0_n_], rbx
lea rdi, [0x1400a7338]
mov qword [0x1400a7310], rbp
mov qword [0x1400a7328], 1
mov r8, qword [rdi]
lea rax, [rbx + 8]
mov qword [rsp + 0x38], rax
lea rcx, [0x140028d90]
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], r8
lea rdi, [rdi + 8]
mov qword [rsp + 0x50], rbp
mov r9d, 1
mov qword [rsp + 0x28], rbp
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov qword [rbx + 0x20], r8
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
nop dword [rax + rax]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140028ecf
mov rax, qword [str._0_n_]
cmp rax, r14
je 0x140028f66
test byte [rax + 0x1c], 4
je 0x140028f66
cmp byte [rax + 0x19], 5
jb 0x140028f66
call qword [sym.imp.KERNEL32.dll_GetVersion]
nop dword [rax + rax]
mov rcx, qword [str._0_n_]
lea edx, [rbx + 0x18]
mov r9d, eax
lea r8, [0x1400931c0]
mov rcx, qword [rcx + 0x10]
call fcn.1400045c8
mov ecx, 1
call qword [sym.imp.GDI32.dll_EnableEUDC]
nop dword [rax + rax]
test eax, eax
je 0x140028fd6
lea rcx, section..data
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
nop dword [rax + rax]
test eax, eax
jne 0x140029003
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
mov rbx, qword [str._0_n_]
cmp rbx, r14
je 0x140029039
test byte [rbx + 0x1c], 4
je 0x14002900a
cmp byte [rbx + 0x19], 2
jb 0x14002900a
mov rcx, qword [rbx + 0x10]
lea r8, [0x1400931c0]
mov edx, 0x19
mov r9d, eax
call fcn.140004900
jmp 0x140029003
mov rbx, qword [str._0_n_]
cmp rbx, r14
je 0x140029039
test byte [rbx + 0x1c], 4
je 0x14002900a
cmp byte [rbx + 0x19], 2
jb 0x14002900a
mov rcx, qword [rbx + 0x10]
lea r8, [0x1400931c0]
mov edx, 0x1a
call fcn.14000459c
mov rbx, qword [str._0_n_]
cmp rbx, r14
je 0x140029039
jmp 0x14002902d
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002902a
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
nop dword [rax + rax]
mov qword [rbx + 8], rbp
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140029011
mov qword [str._0_n_], r14
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [0x1400a77ec], eax
add eax, ebx
jne 0x14002906a
mov rcx, qword [0x1400a3ec0]
cmp rcx, rbx
je 0x14002906a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov qword [0x1400a3ec0], rbx
lea r11, [rsp + 0x60]
mov eax, esi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140029c48
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [str._0_n_]
lea r14, str._0_n_
lea r15, [0x140093478]
cmp rcx, r14
je 0x140029c9a
test byte [rcx + 0x1c], 4
je 0x140029c9a
cmp byte [rcx + 0x19], 5
jb 0x140029c9a
mov rcx, qword [rcx + 0x10]
mov edx, 0x63
mov r8, r15
call fcn.14000459c
mov rcx, qword [0x1400a7560]
lea rax, str.OutboxLOG.txt
test ebx, ebx
lea rdx, str.InboxLOG.txt
cmovne rdx, rax
call fcn.1400290ac
mov rsi, rax
test rax, rax
jne 0x140029cf1
lea ebx, [rax + 8]
mov rcx, qword [str._0_n_]
cmp rcx, r14
je 0x140029e56
test byte [rcx + 0x1c], 4
je 0x140029e56
cmp byte [rcx + 0x19], 2
jb 0x140029e56
lea edx, [rax + 0x64]
jmp 0x140029e4a
mov rcx, qword [0x1400a7370]
lea rax, [0x1400a7370]
test ebx, ebx
lea rdi, [0x1400a7340]
cmove rcx, qword [0x1400a7340]
cmovne rdi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
jne 0x140029d6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._0_n_]
cmp rcx, r14
je 0x140029e56
test byte [rcx + 0x1c], 4
je 0x140029e56
cmp byte [rcx + 0x19], 2
jb 0x140029e56
mov edx, 0x65
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r15
call fcn.140004994
jmp 0x140029e56
or qword [rdi], 0xffffffffffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x140029dbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [str._0_n_]
cmp rcx, r14
je 0x140029dbe
test byte [rcx + 0x1c], 4
je 0x140029dbe
cmp byte [rcx + 0x19], 2
jb 0x140029dbe
mov rcx, qword [rcx + 0x10]
mov edx, 0x66
mov r9d, eax
mov r8, r15
call fcn.140004994
mov rdx, qword [0x1400a7560]
mov r8, rdi
mov ecx, ebx
call fcn.140029758
mov ebx, eax
test eax, eax
je 0x140029df7
mov rcx, qword [str._0_n_]
cmp rcx, r14
je 0x140029e56
test byte [rcx + 0x1c], 4
je 0x140029e56
cmp byte [rcx + 0x19], 2
jb 0x140029e56
mov edx, 0x67
jmp 0x140029d5b
mov rcx, qword [rdi]
call fcn.14002d900
test eax, eax
jne 0x140029e2d
mov rcx, qword [str._0_n_]
cmp rcx, r14
je 0x140029e56
test byte [rcx + 0x1c], 4
je 0x140029e34
cmp byte [rcx + 0x19], 2
jb 0x140029e34
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x68]
xor r9d, r9d
mov r8, r15
call fcn.140004994
mov rcx, qword [str._0_n_]
cmp rcx, r14
je 0x140029e56
test byte [rcx + 0x1c], 4
je 0x140029e56
cmp byte [rcx + 0x19], 5
jb 0x140029e56
mov edx, 0x69
mov rcx, qword [rcx + 0x10]
mov r8, r15
call fcn.14000459c
mov rcx, rsi
call fcn.14006a328
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x14002cda4
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400a3ac8]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, ecx
mov rcx, qword [str._0_n_]
lea r14, str._0_n_
cmp rcx, r14
je 0x14002cdff
test byte [rcx + 0x1c], 4
je 0x14002cdff
cmp byte [rcx + 0x19], 5
jb 0x14002cdff
mov rcx, qword [rcx + 0x10]
lea r8, [0x140093478]
mov edx, 0x5c
call fcn.14000459c
mov eax, dword [0x1400a7568]
xor ebx, ebx
test eax, eax
je 0x14002ce80
mov rcx, qword [0x1400a7370]
test edi, edi
cmove rcx, qword [0x1400a7340]
cmp eax, 1
jne 0x14002cebb
xor eax, eax
lea rdx, [rbp - 0x30]
mov qword [rbp - 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
jne 0x14002cea4
mov rax, qword [str._0_n_]
cmp rax, r14
je 0x14002ce80
test byte [rax + 0x1c], 4
je 0x14002ce80
cmp byte [rax + 0x19], 2
jb 0x14002ce80
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea edx, [rbx + 0x5d]
mov rcx, qword [str._0_n_]
lea r8, [0x140093478]
mov r9d, eax
mov rcx, qword [rcx + 0x10]
call fcn.140004994
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001b10
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
mov ecx, dword [0x1400a756c]
shl rcx, 0x14
cmp qword [rbp - 0x30], rcx
jl 0x14002ce80
mov eax, 1
jmp 0x14002ce82
cmp eax, 2
jne 0x14002ce80
xor r9d, r9d
lea rdx, [rbp - 0x30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetFileTime]
nop dword [rax + rax]
test eax, eax
jne 0x14002cf08
mov rax, qword [str._0_n_]
cmp rax, r14
je 0x14002ce80
test byte [rax + 0x1c], 4
je 0x14002ce80
cmp byte [rax + 0x19], 2
jb 0x14002ce80
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x5e
jmp 0x14002ce66
xorps xmm0, xmm0
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
movups xmmword [rbp - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
nop dword [rax + rax]
test eax, eax
jne 0x14002cf61
mov rax, qword [str._0_n_]
cmp rax, r14
je 0x14002ce80
test byte [rax + 0x1c], 4
je 0x14002ce80
cmp byte [rax + 0x19], 2
jb 0x14002ce80
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edx, 0x5f
jmp 0x14002ce66
xorps xmm0, xmm0
lea rcx, [rbp - 0x18]
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
nop dword [rax + rax]
movzx ecx, word [rbp - 0x28]
movzx edx, word [rbp - 0x18]
sub edx, ecx
movzx ecx, word [rbp - 0x26]
lea r8d, [rdx + rdx*2]
shl r8d, 2
sub r8d, ecx
movzx ecx, word [rbp - 0x16]
add r8d, ecx
cmp r8d, dword [0x1400a7570]
setae bl
mov eax, ebx
jmp 0x14002ce82
Function at 0x14002cfb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1400a3ac8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
mov ebx, r15d
lea r12, str._0_n_
mov rcx, qword [str._0_n_]
cmp rcx, r12
je 0x14002d012
test byte [rcx + 0x1c], 4
je 0x14002d012
cmp byte [rcx + 0x19], 5
jb 0x14002d012
lea edx, [r15 + 0xa]
lea r8, [0x140093478]
mov rcx, qword [rcx + 0x10]
call fcn.14000459c
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r15
mov word [rsp + 0x40], r15w
cmp dword [0x1400a7554], r15d
jne 0x14002d039
mov eax, 1
jmp 0x14002d1dc
lea r8, [rsp + 0x40]
mov rdx, r14
mov rcx, rsi
call fcn.14002a3e4
test eax, eax
jne 0x14002d082
mov rcx, qword [str._0_n_]
cmp rcx, r12
je 0x14002d078
test byte [rcx + 0x1c], 4
je 0x14002d078
cmp byte [rcx + 0x19], 2
jb 0x14002d078
lea edx, [rax + 0xb]
lea r8, [0x140093478]
mov rcx, qword [rcx + 0x10]
call fcn.14000459c
mov ebx, 0xe
jmp 0x14002d1b9
xor ecx, ecx
call fcn.14002cda4
test eax, eax
je 0x14002d11e
mov rcx, qword [str._0_n_]
cmp rcx, r12
je 0x14002d0be
test byte [rcx + 0x1c], 4
je 0x14002d0be
cmp byte [rcx + 0x19], 5
jb 0x14002d0be
mov edx, 0xd
lea r8, [0x140093478]
mov rcx, qword [rcx + 0x10]
call fcn.14000459c
xor ecx, ecx
call fcn.14002cccc
mov ebx, eax
test eax, eax
je 0x14002d11e
mov rcx, qword [str._0_n_]
cmp rcx, r12
je 0x14002d0fb
test byte [rcx + 0x1c], 4
je 0x14002d0fb
cmp byte [rcx + 0x19], 2
jb 0x14002d0fb
mov edx, 0xe
mov r9d, eax
lea r8, [0x140093478]
mov rcx, qword [rcx + 0x10]
call fcn.140004994
cmp dword [0x1400a7554], r15d
je 0x14002d1b9
mov rcx, qword [0x1400a7340]
cmp rcx, 0xffffffffffffffff
je 0x14002d1b9
mov ebx, r15d
jmp 0x14002d125
mov rcx, qword [0x1400a7340]
mov eax, dword [rsp + 0x50]
lea r8d, [rax + rax]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x14002d196
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._0_n_]
cmp rcx, r12
je 0x14002d196
test byte [rcx + 0x1c], 4
je 0x14002d196
cmp byte [rcx + 0x19], 2
jb 0x14002d196
mov edx, 0xf
mov r9d, eax
lea r8, [0x140093478]
mov rcx, qword [rcx + 0x10]
call fcn.140004994
test ebx, ebx
jne 0x14002d1b9
cmp qword [rsp + 0x58], 8
jb 0x14002d02f
mov rcx, qword [rsp + 0x40]
call fcn.140001390
jmp 0x14002d02f
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
nop
cmp qword [rsp + 0x58], 8
jb 0x14002d1da
mov rcx, qword [rsp + 0x40]
call fcn.140001390
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001b10
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14002d208
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x70
mov rax, qword [0x1400a3ac8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
xor r14d, r14d
mov ebx, r14d
lea r15, str._0_n_
mov rcx, qword [str._0_n_]
cmp rcx, r15
je 0x14002d268
test byte [rcx + 0x1c], 4
je 0x14002d268
cmp byte [rcx + 0x19], 5
jb 0x14002d268
lea edx, [r14 + 0x10]
lea r8, [0x140093478]
mov rcx, qword [rcx + 0x10]
call fcn.14000459c
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r14
mov word [rsp + 0x40], r14w
cmp dword [0x1400a7558], r14d
jne 0x14002d28f
mov eax, 1
jmp 0x14002d435
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14002ad64
test eax, eax
jne 0x14002d2d5
mov rcx, qword [str._0_n_]
cmp rcx, r15
je 0x14002d2cb
test byte [rcx + 0x1c], 4
je 0x14002d2cb
cmp byte [rcx + 0x19], 2
jb 0x14002d2cb
lea edx, [rax + 0x11]
lea r8, [0x140093478]
mov rcx, qword [rcx + 0x10]
call fcn.14000459c
mov ebx, 0xe
jmp 0x14002d412
mov ecx, 1
call fcn.14002cda4
test eax, eax
je 0x14002d377
mov rcx, qword [str._0_n_]
cmp rcx, r15
je 0x14002d314
test byte [rcx + 0x1c], 4
je 0x14002d314
cmp byte [rcx + 0x19], 5
jb 0x14002d314
mov edx, 0x13
lea r8, [0x140093478]
mov rcx, qword [rcx + 0x10]
call fcn.14000459c
mov ecx, 1
call fcn.14002cccc
mov ebx, eax
test eax, eax
je 0x14002d377
mov rcx, qword [str._0_n_]
cmp rcx, r15
je 0x14002d354
test byte [rcx + 0x1c], 4
je 0x14002d354
cmp byte [rcx + 0x19], 2
jb 0x14002d354
mov edx, 0x14
mov r9d, eax
lea r8, [0x140093478]
mov rcx, qword [rcx + 0x10]
call fcn.140004994
cmp dword [0x1400a7558], r14d
je 0x14002d412
mov rcx, qword [0x1400a7370]
cmp rcx, 0xffffffffffffffff
je 0x14002d412
mov ebx, r14d
jmp 0x14002d37e
mov rcx, qword [0x1400a7370]
mov eax, dword [rsp + 0x50]
lea r8d, [rax + rax]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x14002d3ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [str._0_n_]
cmp rcx, r15
je 0x14002d3ef
test byte [rcx + 0x1c], 4
je 0x14002d3ef
cmp byte [rcx + 0x19], 2
jb 0x14002d3ef
mov edx, 0x15
mov r9d, eax
lea r8, [0x140093478]
mov rcx, qword [rcx + 0x10]
call fcn.140004994
test ebx, ebx
jne 0x14002d412
cmp qword [rsp + 0x58], 8
jb 0x14002d285
mov rcx, qword [rsp + 0x40]
call fcn.140001390
jmp 0x14002d285
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
nop
cmp qword [rsp + 0x58], 8
jb 0x14002d433
mov rcx, qword [rsp + 0x40]
call fcn.140001390
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001b10
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret