joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140126160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r8, qword [rcx]
test r8, r8
je 0x1401261bb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x1401261bb
movzx eax, byte [r8 + rcx]
cmp eax, 0x49
je 0x1401261d6
cmp eax, 0x42
jne 0x1401261bb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x14012628a
cmp byte [r8 + r11], 0x5f
jne 0x14012628a
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x1401262fe
mov rcx, rsi
xor edx, edx
call fcn.140124f50
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.140124f50
test al, al
jne 0x140126398
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x140126211
lea rcx, [0x140237ae4]
mov edx, 1
call fcn.14015e2a0
test al, al
jne 0x140126398
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x1401261ca
xor r14d, r14d
lea rbx, [0x140237ade]
nop word cs:[rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x140126249
test rax, rax
je 0x140126249
cmp byte [rax + rcx], 0x45
je 0x1401263c1
sub r14, 1
jb 0x14012626d
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x14012626d
mov edx, 2
mov rcx, rbx
call fcn.14015e2a0
test al, al
jne 0x140126398
mov rcx, rsi
call fcn.140125680
test al, al
jne 0x140126398
mov rax, qword [rsi]
test rax, rax
jne 0x140126230
jmp 0x1401261ca
xor eax, eax
mov edi, 0x3e
nop word cs:[rax + rax]
mov r9b, 1
cmp r11, r10
jae 0x14012635f
movzx edx, byte [r8 + r11]
cmp dl, 0x5f
je 0x1401262f2
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x1401262dc
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x1401262cb
add dl, 0xa9
jmp 0x1401262da
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x14012635f
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x14012635f
movzx edx, bl
add rax, rdx
jae 0x1401262a0
jmp 0x14012635f
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x14012635f
cmp rax, rcx
jae 0x14012635c
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x1401263a0
cmp qword [rsi + 0x20], 0
je 0x1401263ba
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140126160
mov edi, eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
cmp al, 2
jne 0x1401261ca
jmp 0x140126398
mov r9b, 1
xor edi, edi
mov r8, qword [rsi + 0x20]
test r8, r8
je 0x1401263af
lea rax, [0x140237aa9]
lea rcx, [0x140237a90]
test r9b, r9b
cmovne rcx, rax
xor r9b, 1
movzx eax, r9b
lea rdx, [rax + rax*8]
or rdx, 0x10
call fcn.14015e2a0
test al, al
je 0x1401263af
mov dil, 2
jmp 0x1401261ca
mov dil, 1
xor r9d, r9d
mov r8, qword [rsi + 0x20]
test r8, r8
jne 0x14012636a
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x1401261ca
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x1401261ca
Function at 0x14012f360
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x14012f3f0
jmp 0x14012f3df
jae 0x14012f4b0
cmp r8, 0x201
jae 0x14012f3f0
lea r12, [rbp - 0x58]
mov esi, 0x200
mov r15, r8
jmp 0x14012f448
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x14012f41f
lea rcx, [rbp + 0x3c8]
mov rdx, r13
call fcn.1401d7070
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3d8], r13
mov rbx, rdi
mov r12, qword [rbp + 0x3e8]
mov rsi, r13
mov r15, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r12
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14012f471
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14012f518
mov r8d, r14d
cmp r15, r8
jne 0x14012f3d0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14012f53b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14012f3df
jmp 0x14012f3f0
cmp rsi, r8
jb 0x14012f555
lea rcx, [rbp + 0x3a8]
mov rdx, r12
call fcn.140135440
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x14012f501
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.1400648d0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x14012f4e9
jmp 0x14012f501
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1401d87e0
jmp 0x14012f56a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1401d8ca0
ud2
Function at 0x14012f6c0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.14014a990
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x410], rax
test rax, rax
je 0x14012f836
mov qword [rbp + 0x408], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x418], rax
xor edi, edi
xor ebx, ebx
xor esi, esi
cmp r8, 0x201
jae 0x14012f770
jmp 0x14012f75f
jae 0x14012f848
cmp r8, 0x201
jae 0x14012f770
lea r13, [rbp - 0x60]
mov r15d, 0x200
mov r12, r8
jmp 0x14012f7c7
sub r8, rsi
sub rbx, rsi
cmp rbx, r8
jae 0x14012f79f
lea rcx, [rbp + 0x3e8]
mov rdx, rsi
call fcn.1401d7070
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x418], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov esi, 0xffffffff
cmovb rsi, rdi
mov qword [rbp + 0x3f8], rsi
mov rbx, rdi
mov r13, qword [rbp + 0x418]
mov r15, rsi
mov r12, rsi
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0x410]
mov rdx, r13
mov r8d, r12d
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x14012f7f7
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14012f91b
mov r8d, r14d
cmp r12, r8
jne 0x14012f750
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14012f945
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14012f75f
jmp 0x14012f770
lea rcx, [rbp - 0x58]
call fcn.1400037b0
mov byte [rsi + 0x18], 2
jmp 0x14012f8da
cmp r15, r8
jb 0x14012f95f
lea rcx, [rbp + 0x3a0]
mov rdx, r13
call fcn.140135440
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x14012f899
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x418]
mov rdx, rdi
call fcn.1400648d0
cmp byte [rbp + 0x3d8], 2
jne 0x14012f8f1
mov rsi, qword [rbp + 0x408]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.1400037b0
mov rdx, qword [rbp + 0x400]
test rdx, rdx
je 0x14012f8da
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x410]
call fcn.1400648d0
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x408]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x400]
test rdx, rdx
jne 0x14012f8c5
jmp 0x14012f8da
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x14012f881
jmp 0x14012f899
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1401d87e0
jmp 0x14012f974
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.1401d8ca0
ud2
Function at 0x140130670
Capabilities:
Create directory

Disassembly:
cmp byte [rcx], 0
je 0x140130680
mov rcx, rdx
mov rdx, r8
jmp fcn.140130690
mov rcx, rdx
mov rdx, r8
jmp fcn.14013e200

Function at 0x140135f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140135f50
test ecx, ecx
jne 0x140135fa0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x140135f5c
test ecx, ecx
jne 0x140135fa0
mov rcx, rdi
call fcn.140135e00
movzx eax, al
test bpl, bpl
jne 0x140135fa7
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140135f93.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x140136118]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140135f93.2
xor eax, eax
test bpl, bpl
je 0x140135f6c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x1401360f9
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x140135fda
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x140136059
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x140136020
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x14013603b
inc rax
dec rdi
cmp rax, 1
jne 0x140136000
jmp 0x140136059
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x14013603b
cmp ebx, 0x5c
je 0x14013603b
inc rax
dec rdi
cmp rax, 1
jne 0x140136020
jmp 0x140136059
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x140136107
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140136083
mov al, 9
cmp rdx, 2
je 0x140136087
cmp rdx, 1
jne 0x140136097
cmp byte [r8], 0x2e
jne 0x140136097
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140136097
mov al, 0xa
jmp 0x140136097
cmp byte [r8], 0x2e
jne 0x140136097
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140135f93.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140135f93.2
mov ecx, 2
jmp case.0x140135f93.2
lea r8, str.library_std_srcpath.rs
call fcn.1401d8c20
ud2
lea r8, str.library_std_srcpath.rs
call fcn.1401d8c20
ud2
Function at 0x14013a150
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.1401a94d0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r12, rcx
lea r13, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
call fcn.1401aaf60
lea rcx, [rbp + 0xfe8]
xorps xmm6, xmm6
lea rbx, [rbp + 0xff8]
lea rsi, [0x140142e90]
lea r15, [rbp + 0xfb0]
mov r14, qword [sym.imp.kernel32.dll_WriteFileEx]
mov rdi, qword [sym.imp.kernel32.dll_SleepEx]
mov qword [rbp + 0x1010], r12
mov r9d, 0x1000
mov rdx, r12
mov r8, r13
call fcn.1401424a0
cmp qword [rbp + 0xfe8], 0
jne 0x14013a327
mov r12, qword [rbp + 0xff0]
test r12, r12
je 0x14013a2f3
cmp r12, 0x1000
ja 0x14013a349
xor r13d, r13d
nop word cs:[rax + rax]
mov r8d, r12d
sub r8d, r13d
lea rdx, [r13 - 0x50]
add rdx, rbp
mov dword [rbp + 0xff8], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], rbx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp + 0x1008]
mov r9, r15
call r14
test eax, eax
je 0x14013a2c7
nop word [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xff8], 0
je 0x14013a270
mov eax, dword [rbp + 0xffc]
test rax, rax
jne 0x14013a2cd
mov eax, dword [rbp + 0x1000]
add r13, rax
cmp r13, r12
je 0x14013a2b0
jbe 0x14013a220
jmp 0x14013a335
mov r12, qword [rbp + 0x1010]
lea r13, [rbp - 0x50]
lea rcx, [rbp + 0xfe8]
jmp 0x14013a1d5
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe0], rax
mov qword [rbp + 0xfd8], 1
lea rcx, [rbp + 0xfe0]
call fcn.1400037b0
mov rsi, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xff0]
call fcn.1400037b0
jmp 0x14013a2f3
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, r13
mov rdx, r12
call fcn.1401d8d20
jmp 0x14013a35d
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov rcx, r12
call fcn.1401d8ca0
ud2
Function at 0x14013e200
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.14014a990
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
test rax, rax
je 0x14013e2b7
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.140141450
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x14013e2b7
mov rcx, rdi
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x14013e28b
test rsi, rsi
je 0x14013e287
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.1400648d0
xor esi, esi
jmp 0x14013e2b7
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x14013e2b4
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.1400648d0
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x14013e7b0
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.14014a990
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
test rax, rax
je 0x14013e865
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.140141450
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x14013e865
mov rcx, rdi
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x14013e839
test rsi, rsi
je 0x14013e835
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.1400648d0
xor esi, esi
jmp 0x14013e865
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x14013e862
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.1400648d0
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x14013e870
Capabilities:
Move file

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r9
mov rbx, r8
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x18]
call fcn.14014a990
mov rax, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
test rax, rax
je 0x14013e9aa
mov rcx, qword [rbp - 8]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x18]
mov r8b, 1
call fcn.140141450
mov rax, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
test rax, rax
je 0x14013e9aa
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x28], rsi
lea rcx, [rbp - 0x18]
mov rdx, rbx
mov r8, rdi
call fcn.14014a990
mov rax, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
test rax, rax
je 0x14013e989
mov rcx, qword [rbp - 8]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x18]
mov r8b, 1
call fcn.140141450
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
test rdi, rdi
je 0x14013e989
mov r15, qword [rbp - 0x20]
mov rcx, r15
mov rdx, rdi
mov r8d, 1
call qword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
mov r14, qword [rbp - 0x28]
je 0x14013e9ba
test rsi, rsi
je 0x14013e96c
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.1400648d0
test r14, r14
je 0x14013e985
add r14, r14
mov r8d, 2
mov rcx, r15
mov rdx, r14
call fcn.1400648d0
xor esi, esi
jmp 0x14013e9aa
mov r14, qword [rbp - 0x28]
mov r15, qword [rbp - 0x20]
test r14, r14
je 0x14013e9aa
add r14, r14
mov r8d, 2
mov rcx, r15
mov rdx, r14
call fcn.1400648d0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x14013e9e3
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.1400648d0
mov rsi, rbx
test r14, r14
jne 0x14013e996
jmp 0x14013e9aa
Function at 0x14013f100
Capabilities:
Copy file

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rcx
lea rcx, [rbp - 0x20]
call fcn.14014a990
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
test rax, rax
je 0x14013f212
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x20]
mov r8b, 1
call fcn.140141450
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x40]
test rax, rax
je 0x14013f212
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x30], rdx
mov r8, qword [rbp + 0x50]
lea rcx, [rbp - 0x20]
mov rdx, rdi
call fcn.14014a990
mov rax, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x18]
test rax, rax
je 0x14013f21f
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rcx
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x20]
mov r8b, 1
call fcn.140141450
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x40]
test rbx, rbx
je 0x14013f21f
mov qword [rbp - 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x14013f2c0]
lea r9, [rbp - 0x20]
mov r14, qword [rbp - 0x28]
mov rcx, r14
mov rdx, rbx
call qword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
je 0x14013f230
mov rax, qword [rbp - 0x20]
mov qword [rsi + 8], rax
mov qword [rsi], 0
test rdi, rdi
jne 0x14013f24e
jmp 0x14013f262
mov qword [rsi + 8], rdx
mov qword [rsi], 1
jmp 0x14013f27c
mov r14, qword [rbp - 0x28]
mov qword [rsi + 8], rdi
mov qword [rsi], 1
jmp 0x14013f262
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdi, rdi
je 0x14013f262
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call fcn.1400648d0
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x14013f27c
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.1400648d0
mov rax, rsi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x14013f800
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14023ac90]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14013f844
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14013f8a3
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x14013f8b2
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14013f8ea
cmp eax, 0x103
je 0x14013f8f4
test eax, eax
js 0x14013f8cf
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14013f8ea
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x14023acf0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1401348c0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140006650
mov ecx, 7
int 0x29
ud2

Function at 0x14013f960
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14023ac90]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14013f9a4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14013fa0a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14013fa41
test eax, eax
js 0x14013fa1b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14013fa34
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x14023acf0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1401348c0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140006650
mov ecx, 7
int 0x29
ud2