joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039d00
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
sub rsp, 0x20
mov ebx, ecx
mov rcx, qword [str.P5_n_]
lea r12, str.P5_n_
lea r13, [0x140009828]
cmp rcx, r12
je 0x140039d52
test byte [rcx + 0x1c], 4
je 0x140039d52
cmp byte [rcx + 0x19], 5
jb 0x140039d52
mov rcx, qword [rcx + 0x10]
mov edx, 0x63
mov r8, r13
call fcn.14000ffa8
mov rcx, qword [0x1400a3fe8]
lea rax, [0x14000a0a8]
lea rdx, [0x14000a0c8]
test ebx, ebx
cmove rdx, rax
call fcn.14003a3ac
mov rsi, rax
test rax, rax
jne 0x140039da9
lea ebx, [rax + 8]
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x140039ee8
test byte [rcx + 0x1c], 4
je 0x140039ee8
cmp byte [rcx + 0x19], 2
jb 0x140039ee8
lea edx, [rax + 0x64]
jmp 0x140039edc
lea rax, [0x1400a3d80]
lea rdi, [0x1400a3d78]
test ebx, ebx
cmove rdi, rax
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140039dfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x140039ee8
test byte [rcx + 0x1c], 4
je 0x140039ee8
cmp byte [rcx + 0x19], 2
jb 0x140039ee8
mov edx, 0x65
jmp 0x140039e78
or qword [rdi], 0xffffffffffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140039e40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x140039e40
test byte [rcx + 0x1c], 4
je 0x140039e40
cmp byte [rcx + 0x19], 2
jb 0x140039e40
mov rcx, qword [rcx + 0x10]
mov edx, 0x66
mov r9d, eax
mov r8, r13
call fcn.1400100e0
mov rdx, qword [0x1400a3fe8]
mov r8, rdi
mov ecx, ebx
call fcn.140039518
mov ebx, eax
test eax, eax
je 0x140039e89
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x140039ee8
test byte [rcx + 0x1c], 4
je 0x140039ee8
cmp byte [rcx + 0x19], 2
jb 0x140039ee8
mov edx, 0x67
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r13
call fcn.1400100e0
jmp 0x140039ee8
mov rcx, qword [rdi]
call fcn.14003a4e4
test eax, eax
jne 0x140039ebf
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x140039ee8
test byte [rcx + 0x1c], 4
je 0x140039ec6
cmp byte [rcx + 0x19], 2
jb 0x140039ec6
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x68]
xor r9d, r9d
mov r8, r13
call fcn.1400100e0
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x140039ee8
test byte [rcx + 0x1c], 4
je 0x140039ee8
cmp byte [rcx + 0x19], 5
jb 0x140039ee8
mov edx, 0x69
mov rcx, qword [rcx + 0x10]
mov r8, r13
call fcn.14000ffa8
mov rcx, rsi
call fcn.140076afc
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r13
ret
Function at 0x14003a4e4
Capabilities:
Timestomp file

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x30
xor r12d, r12d
xor eax, eax
mov rdi, rcx
mov qword [r11 - 0x16], rax
mov word [r11 - 0x18], r12w
mov dword [r11 + 0x10], r12d
mov dword [rsp + 0x2a], eax
mov word [rsp + 0x2e], ax
mov dword [rsp + 0x4c], eax
mov rcx, qword [str.P5_n_]
lea rbp, str.P5_n_
cmp rcx, rbp
je 0x14003a54d
test byte [rcx + 0x1c], 4
je 0x14003a54d
cmp byte [rcx + 0x19], 5
jb 0x14003a54d
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x79]
lea r8, [0x140009828]
call fcn.14000ffa8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov ebx, eax
cmp eax, r12d
jne 0x14003a594
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
cmp rcx, rbp
je 0x14003a5e5
test byte [rcx + 0x1c], 4
je 0x14003a5e5
cmp byte [rcx + 0x19], 2
jb 0x14003a5e5
mov edx, 0x7a
jmp 0x14003a5d2
lea rdx, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov ebx, eax
cmp eax, r12d
jne 0x14003a5e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
cmp rcx, rbp
je 0x14003a5e5
test byte [rcx + 0x1c], 4
je 0x14003a5e5
cmp byte [rcx + 0x19], 2
jb 0x14003a5e5
mov edx, 0x7b
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009828]
mov r9d, eax
call fcn.1400100e0
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop r12
ret
Function at 0x14003b350
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [str.P5_n_]
lea r12, str.P5_n_
cmp rcx, r12
je 0x14003b397
test byte [rcx + 0x1c], 4
je 0x14003b397
cmp byte [rcx + 0x19], 5
jb 0x14003b397
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009818]
mov edx, 0x14
call fcn.14000ffa8
lea rcx, [0x1400a3d88]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx + 8]
mov r11, qword [rbx]
mov qword [rax], r11
mov qword [r11 + 8], rax
mov eax, dword [rbx + 0x18]
and qword [rbx], 0
and qword [rbx + 8], 0
test eax, eax
jne 0x14003b3d8
cmp dword [rbx + 0x2c], eax
jne 0x14003b3d8
lea rcx, [0x1400a3c44]
call fcn.1400446ac
jmp 0x14003b53a
cmp eax, 2
jne 0x14003b447
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x14003b53a
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x14003b53a
mov rax, qword [str.P5_n_]
cmp rax, r12
je 0x14003b53a
test byte [rax + 0x1c], 4
je 0x14003b53a
cmp byte [rax + 0x19], 2
jb 0x14003b53a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea r8, [0x140009818]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x15
call fcn.1400100e0
jmp 0x14003b53a
cmp eax, 3
jne 0x14003b53a
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14003b49b
mov rax, qword [str.P5_n_]
cmp rax, r12
je 0x14003b49b
test byte [rax + 0x1c], 4
je 0x14003b49b
cmp byte [rax + 0x19], 2
jb 0x14003b49b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea r8, [0x140009818]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x16
call fcn.1400100e0
cmp dword [rbx + 0x660], 0
je 0x14003b4f6
cmp dword [rbx + 0x65c], 0
je 0x14003b4ff
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14003b4f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x14003b4f6
test byte [rcx + 0x1c], 4
je 0x14003b4f6
cmp byte [rcx + 0x19], 2
jb 0x14003b4f6
mov rcx, qword [rcx + 0x10]
lea r9, [rbx + 0x40]
lea r8, [0x140009818]
mov edx, 0x17
mov dword [rsp + 0x20], eax
call fcn.140011a18
cmp dword [rbx + 0x65c], 0
jne 0x14003b53a
cmp qword [rbx + 0x668], 0
je 0x14003b53a
lea rcx, [0x1400a3e30]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x668]
mov edx, 1
mov r9d, edx
mov r8d, edx
call fcn.14004c778
lea rcx, [0x1400a3e30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
call fcn.140076afc
lea rcx, [0x1400a3d88]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14003db10
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
sub rsp, 0x250
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
mov rcx, qword [str.P5_n_]
lea rbp, str.P5_n_
cmp rcx, rbp
je 0x14003db71
test byte [rcx + 0x1c], 4
je 0x14003db71
cmp byte [rcx + 0x19], 5
jb 0x14003db71
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009808]
mov edx, 0x38
call fcn.14000ffa8
lea rcx, [rsp + 0x32]
xor r13d, r13d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], r13w
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x30]
lea rdx, [0x14000a778]
mov r9d, 0x104
mov rcx, rdi
call fcn.14003d684
cmp eax, r13d
jne 0x14003dbee
mov rax, qword [str.P5_n_]
cmp rax, rbp
je 0x14003dbe7
test byte [rax + 0x1c], 4
je 0x14003dbe7
cmp byte [rax + 0x19], 2
jb 0x14003dbe7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea edx, [r13 + 0x39]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009808]
mov r9d, eax
call fcn.1400100e0
xor eax, eax
jmp 0x14003dcab
lea rcx, [rsp + 0x30]
call fcn.140077860
mov qword [rdi + 0x48], rax
cmp rax, r13
jne 0x14003dca6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, rbp
je 0x14003dc3d
test byte [rcx + 0x1c], 4
je 0x14003dc3d
cmp byte [rcx + 0x19], 2
jb 0x14003dc3d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009808]
mov edx, 0x3a
mov r9d, eax
call fcn.1400100e0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r13d
jne 0x14003dc99
mov rax, qword [str.P5_n_]
cmp rax, rbp
je 0x14003dc99
test byte [rax + 0x1c], 4
je 0x14003dc99
cmp byte [rax + 0x19], 2
jb 0x14003dc99
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
mov r9d, dword [rdi + 0x20]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x30]
lea r8, [0x140009808]
mov edx, 0x3b
mov qword [rsp + 0x20], rax
call fcn.14003b8f4
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003dbe7
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14008c5b0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret
Function at 0x14003dcdc
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x250
mov rax, qword [0x14009e140]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
mov rcx, qword [str.P5_n_]
lea rbp, str.P5_n_
cmp rcx, rbp
je 0x14003dd3d
test byte [rcx + 0x1c], 4
je 0x14003dd3d
cmp byte [rcx + 0x19], 5
jb 0x14003dd3d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009808]
mov edx, 0x3c
call fcn.14000ffa8
lea rcx, [rsp + 0x32]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], r12w
call sub.msvcrt.dll_memset
cmp qword [rdi + 0x258], r12
jne 0x14003de83
lea r8, [rsp + 0x30]
lea rdx, [0x14000a780]
mov r9d, 0x104
mov rcx, rdi
call fcn.14003d684
cmp eax, r12d
jne 0x14003ddc8
mov rax, qword [str.P5_n_]
cmp rax, rbp
je 0x14003ddc1
test byte [rax + 0x1c], 4
je 0x14003ddc1
cmp byte [rax + 0x19], 2
jb 0x14003ddc1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea edx, [r12 + 0x3d]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009808]
mov r9d, eax
call fcn.1400100e0
xor eax, eax
jmp 0x14003de88
lea rcx, [rsp + 0x30]
call fcn.140077860
mov qword [rdi + 0x258], rax
cmp rax, r12
jne 0x14003de83
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, rbp
je 0x14003de1a
test byte [rcx + 0x1c], 4
je 0x14003de1a
cmp byte [rcx + 0x19], 2
jb 0x14003de1a
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009808]
mov edx, 0x3e
mov r9d, eax
call fcn.1400100e0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, r12d
jne 0x14003de76
mov rax, qword [str.P5_n_]
cmp rax, rbp
je 0x14003de76
test byte [rax + 0x1c], 4
je 0x14003de76
cmp byte [rax + 0x19], 2
jb 0x14003de76
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
mov r9d, dword [rdi + 0x20]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x30]
lea r8, [0x140009808]
mov edx, 0x3f
mov qword [rsp + 0x20], rax
call fcn.14003b8f4
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14003ddc1
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14008c5b0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x14004c660
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x14004c69d
test byte [rcx + 0x1c], 4
je 0x14004c69d
cmp byte [rcx + 0x19], 5
jb 0x14004c69d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f68]
mov edx, 0x129
call fcn.14000ffa8
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140047adc

Function at 0x14004cd08
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r12
sub rsp, 0x30
xor ebx, ebx
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x60], ebx
mov rcx, qword [str.P5_n_]
lea r12, str.P5_n_
cmp rcx, r12
je 0x14004cd55
test byte [rcx + 0x1c], 4
je 0x14004cd55
cmp byte [rcx + 0x19], 5
jb 0x14004cd55
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f68]
mov edx, 0x136
call fcn.14000ffa8
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov r8d, 4
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x14004cda1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x14004cde6
test byte [rcx + 0x1c], 4
je 0x14004cde6
cmp byte [rcx + 0x19], 2
jb 0x14004cde6
mov edx, 0x137
mov r9d, eax
jmp 0x14004cdce
cmp dword [rsp + 0x60], 4
je 0x14004cde0
mov r9d, 0x26
mov ebx, r9d
mov rcx, qword [str.P5_n_]
cmp rcx, r12
je 0x14004cde6
test byte [rcx + 0x1c], 4
je 0x14004cde6
cmp byte [rcx + 0x19], 2
jb 0x14004cde6
mov edx, 0x138
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f68]
call fcn.1400100e0
jmp 0x14004cde6
mov eax, dword [rsp + 0x68]
mov dword [rdi], eax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x14004d558
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push r12
push r14
push r15
sub rsp, 0x40
and dword [rax + 0x20], 0
and qword [rax - 0x20], 0
mov ebp, r8d
mov r12, rdx
mov rsi, rcx
mov dword [rax - 0x24], 1
mov rcx, qword [str.P5_n_]
lea r14, str.P5_n_
lea r15, [0x140008f68]
cmp rcx, r14
je 0x14004d5c1
test byte [rcx + 0x1c], 4
je 0x14004d5c1
cmp byte [rcx + 0x19], 5
jb 0x14004d5c1
mov rcx, qword [rcx + 0x10]
mov edx, 0x14a
mov r8, r15
call fcn.14000ffa8
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x38]
mov edx, ebp
mov rcx, r12
call fcn.14004d210
mov ebx, eax
test eax, eax
je 0x14004d618
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14004d765
test byte [rcx + 0x1c], 4
je 0x14004d765
cmp byte [rcx + 0x19], 2
jb 0x14004d765
mov rcx, qword [rcx + 0x10]
mov edx, 0x14b
mov r9d, eax
mov r8, r15
call fcn.1400100e0
jmp 0x14004d765
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x34]
mov r8d, 4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14004d671
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14004d765
test byte [rcx + 0x1c], 4
je 0x14004d765
cmp byte [rcx + 0x19], 2
jb 0x14004d765
mov edx, 0x14c
jmp 0x14004d756
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x78]
mov r8d, 4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14004d6ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14004d765
test byte [rcx + 0x1c], 4
je 0x14004d765
cmp byte [rcx + 0x19], 2
jb 0x14004d765
mov edx, 0x14d
jmp 0x14004d756
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x38]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14004d713
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14004d765
test byte [rcx + 0x1c], 4
je 0x14004d765
cmp byte [rcx + 0x19], 2
jb 0x14004d765
mov edx, 0x14e
jmp 0x14004d756
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, ebp
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14004d765
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14004d765
test byte [rcx + 0x1c], 4
je 0x14004d765
cmp byte [rcx + 0x19], 2
jb 0x14004d765
mov edx, 0x14f
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r15
call fcn.1400100e0
cmp qword [rsp + 0x38], 0
je 0x14004d777
mov rcx, qword [rsp + 0x38]
call fcn.140076afc
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x14004d98c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r12, rdx
mov rbp, rcx
xor esi, esi
mov rcx, qword [str.P5_n_]
lea r14, str.P5_n_
lea r15, [0x140008f68]
cmp rcx, r14
je 0x14004d9e3
test byte [rcx + 0x1c], 4
je 0x14004d9e3
cmp byte [rcx + 0x19], 5
jb 0x14004d9e3
mov rcx, qword [rcx + 0x10]
mov edx, 0x155
mov r8, r15
call fcn.14000ffa8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x14004da2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14004db8b
test byte [rcx + 0x1c], 4
je 0x14004db8b
cmp byte [rcx + 0x19], 2
jb 0x14004db8b
mov edx, 0x156
jmp 0x14004db0d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0x678
jae 0x14004da79
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14004da6f
test byte [rcx + 0x1c], 4
je 0x14004da6f
cmp byte [rcx + 0x19], 3
jb 0x14004da6f
mov rcx, qword [rcx + 0x10]
mov edx, 0x157
mov r9d, edi
mov r8, r15
call fcn.1400100e0
mov ebx, 0x570
jmp 0x14004db9c
mov rcx, rdi
call fcn.140076a54
mov rsi, rax
test rax, rax
jne 0x14004dabf
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14004dab5
test byte [rcx + 0x1c], 4
je 0x14004dab5
cmp byte [rcx + 0x19], 2
jb 0x14004dab5
mov rcx, qword [rcx + 0x10]
mov edx, 0x158
mov r9d, edi
mov r8, r15
call fcn.1400100e0
mov ebx, 8
jmp 0x14004db8f
and qword [rsp + 0x20], rbx
lea r9, [rsp + 0x70]
mov r8d, edi
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14004db1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14004db8b
test byte [rcx + 0x1c], 4
je 0x14004db8b
cmp byte [rcx + 0x19], 2
jb 0x14004db8b
mov edx, 0x159
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r15
call fcn.1400100e0
jmp 0x14004db8b
mov edx, dword [rsp + 0x70]
cmp edi, edx
je 0x14004db59
mov ebx, 0x26
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14004db8f
test byte [rcx + 0x1c], 4
je 0x14004db8f
cmp byte [rcx + 0x19], 2
jb 0x14004db8f
mov edx, 0x15a
mov rcx, qword [rcx + 0x10]
mov r9d, ebx
mov r8, r15
call fcn.1400100e0
jmp 0x14004db8f
mov rcx, rsi
call fcn.140045430
test eax, eax
jne 0x14004db87
lea ebx, [rax + 0xd]
mov rcx, qword [str.P5_n_]
cmp rcx, r14
je 0x14004db8f
test byte [rcx + 0x1c], 4
je 0x14004db8f
cmp byte [rcx + 0x19], 2
jb 0x14004db8f
mov edx, 0x15b
jmp 0x14004db48
mov qword [r12], rsi
test ebx, ebx
je 0x14004db9c
test rsi, rsi
je 0x14004db9c
mov rcx, rsi
call fcn.140076afc
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140054100
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 2
mov r12, r9
sete bpl
cmp dword [rcx + 0x24], 2
mov edi, r8d
mov ebx, edx
jne 0x140054138
mov rcx, qword [rcx + 0x248]
mov rsi, qword [rcx + 0x198]
mov rcx, qword [str.P5_n_]
lea rax, str.P5_n_
cmp rcx, rax
je 0x140054173
test byte [rcx + 0x1c], 4
je 0x140054173
cmp byte [rcx + 0x19], 5
jb 0x140054173
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008f28]
mov edx, 0x10
call fcn.14000ffa8
test ebp, ebp
je 0x14005419a
neg ebx
sbb eax, eax
and eax, 0xfffffff8
add eax, 0x10
test edi, eax
je 0x14005418c
mov eax, 1
jmp 0x1400541a3
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1400541a3
mov edx, ebx
mov ecx, edi
call fcn.14005fec4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400568d4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x30
mov rcx, qword [str.P5_n_]
lea rbp, str.P5_n_
lea r12, [0x140008f08]
cmp rcx, rbp
je 0x140056918
test byte [rcx + 0x1c], 4
je 0x140056918
cmp byte [rcx + 0x19], 5
jb 0x140056918
mov rcx, qword [rcx + 0x10]
mov edx, 0x34
mov r8, r12
call fcn.14000ffa8
lea rax, [rsp + 0x58]
lea r8, [0x140011504]
xor ebx, ebx
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
cmp rax, rbx
jne 0x14005698c
mov rax, qword [str.P5_n_]
cmp rax, rbp
je 0x140056a70
test byte [rax + 0x1c], 4
je 0x140056a70
cmp byte [rax + 0x19], 2
jb 0x140056a70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.P5_n_]
lea edx, [rbx + 0x35]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r12
call fcn.1400100e0
jmp 0x140056a70
mov r8d, 0x4e20
xor edx, edx
lea ecx, [rdx + 3]
call fcn.1400325d8
mov edx, 0x2710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x140056a0b
cmp eax, 0x102
jne 0x1400569e6
mov rcx, qword [str.P5_n_]
cmp rcx, rbp
je 0x1400569de
test byte [rcx + 0x1c], 4
je 0x1400569de
cmp byte [rcx + 0x19], 5
jb 0x1400569de
mov rcx, qword [rcx + 0x10]
mov edx, 0x37
mov r8, r12
call fcn.14000ffa8
mov r8d, 0x7530
jmp 0x140056992
mov rax, qword [str.P5_n_]
cmp rax, rbp
je 0x140056a67
test byte [rax + 0x1c], 4
je 0x140056a67
cmp byte [rax + 0x19], 2
jb 0x140056a67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x38
jmp 0x140056a40
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp eax, ebx
jne 0x140056a58
mov rax, qword [str.P5_n_]
cmp rax, rbp
je 0x140056a67
test byte [rax + 0x1c], 4
je 0x140056a67
cmp byte [rax + 0x19], 2
jb 0x140056a67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x36
mov rcx, qword [str.P5_n_]
mov r9d, eax
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.1400100e0
jmp 0x140056a67
mov ecx, dword [rsp + 0x50]
cmp ecx, ebx
sete bl
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rbp
ret
Function at 0x14005cc40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov edi, ebx
mov rcx, qword [str.P5_n_]
lea rsi, str.P5_n_
cmp rcx, rsi
je 0x14005cc87
test byte [rcx + 0x1c], 4
je 0x14005cc87
cmp byte [rcx + 0x19], 5
jb 0x14005cc87
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008ef8]
mov edx, 0x8e
call fcn.14000ffa8
lea rax, [rsp + 0x40]
lea r8, [0x140058958]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400a40a8], rax
cmp rax, rbx
jne 0x14005ccf9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [str.P5_n_]
cmp rcx, rsi
je 0x14005cced
test byte [rcx + 0x1c], 4
je 0x14005cced
cmp byte [rcx + 0x19], 2
jb 0x14005cced
mov rcx, qword [rcx + 0x10]
lea r8, [0x140008ef8]
mov edx, 0x8f
mov r9d, eax
call fcn.1400100e0
cmp edi, ebx
je 0x14005ccfb
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
mov rsi, qword [rsp + 0x50]
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret