joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400101c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400101c0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x105c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0xa0d8], ebx
je 0x1400102d4
lea rcx, [rsp + 0xa0dc]
mov rax, 0xffffffffffffffff
nop
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x140010290
lea ecx, [rax + rax]
add rcx, 2
call fcn.140250fe4
lea rdx, [rsp + 0xa0dc]
mov r8, rax
sub r8, rdx
lea rcx, [rsp + 0xa0dc]
nop dword [rax]
movzx edx, word [rcx]
mov word [r8 + rcx], dx
lea rcx, [rcx + 2]
test dx, dx
jne 0x1400102c0
mov qword [rsi], rax
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140010450
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.1400143a0
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140010490
Function at 0x140010490
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov esi, r9d
call fcn.140249b10
mov dword [rsp + 0x30], 0x100d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbx
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x34], eax
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, rdi
lea rcx, [rsp + 0x1078]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a128]
xor ebx, ebx
mov dword [rsp + 0x20b8], esi
mov r8d, 0xa098
mov dword [rsp + 0x1a128], ebx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a118]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140010670
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400106a0

Function at 0x1400106a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x100c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbx
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x34], eax
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
test rdi, rdi
je 0x14001071c
movups xmm0, xmmword [rdi]
mov dword [rsp + 0x1090], 1
movsd xmm1, qword [rdi + 0x10]
movups xmmword [rsp + 0x1078], xmm0
movsd qword [rsp + 0x1088], xmm1
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a100]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400108b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9d, ebx
mov r8d, edi
mov rcx, rax
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400108f0

Function at 0x1400108f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov esi, r8d
mov rbx, rcx
mov r8d, 0xa090
lea rcx, [rsp + 0x38]
xor edx, edx
mov edi, r9d
call fcn.140249b10
mov dword [rsp + 0x30], 0x1039
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, qword [rsp + 0x1a120]
mov dword [rsp + 0x34], eax
test rdx, rdx
je 0x14001094d
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x1a110]
mov dword [rsp + 0x3c], edi
lea rdx, [rsp + 0x30]
xor edi, edi
mov dword [rsp + 0x38], esi
mov r8d, 0xa098
mov dword [rsp + 0x1a110], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], edi
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140010e80
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov ebx, r9d
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9d, ebx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.140010ec0
Function at 0x140010ec0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov ebx, r8d
mov rdi, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov esi, r9d
call fcn.140249b10
mov dword [rsp + 0x30], 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rdi
mov dword [rsp + 0x1078], ebx
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x38]
mov eax, dword [rsp + 0x1a138]
mov dword [rsp + 0x1080], eax
mov eax, dword [rsp + 0x1a140]
mov dword [rsp + 0x1084], eax
mov dword [rsp + 0x107c], esi
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a120]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rsp + 0x1a120], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a128]
mov r8d, 0x10018
mov dword [rsp + 0x1a128], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140011aa0
Capabilities:
Create service

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [rsp + 0xe8]
mov r10, r9
mov r9d, dword [rsp + 0xa0]
mov r11, r8
mov qword [rsp + 0x60], rax
mov rcx, rdx
mov rax, qword [rsp + 0xe0]
mov r8, r10
mov qword [rsp + 0x58], rax
mov rdx, r11
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
add rsp, 0x70
pop rbx
ret

Function at 0x140011b40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rbx, r9
mov rdi, r8
mov rsi, rdx
call fcn.1400143a0
mov r10, rax
mov r9, rbx
mov r8, rdi
mov rdx, rsi
mov rcx, r10
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
jmp fcn.140011b90
Function at 0x140011b90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x19ff0]
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rsi, r8
mov rbx, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x2080
lea rcx, [rsp + 0x40]
mov rdi, r9
call fcn.140249b10
xor edx, edx
lea rcx, [rbp + 0x1fd0]
mov r8d, 0x7ff8
call fcn.140249b10
mov dword [rsp + 0x30], 0x103f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x34], eax
mov eax, dword [rbp + 0x1a030]
mov dword [rbp + 0x1fc0], eax
mov eax, dword [rbp + 0x1a038]
mov dword [rbp + 0x1fc4], eax
mov eax, dword [rbp + 0x1a040]
mov dword [rbp + 0x1fc8], eax
mov eax, dword [rbp + 0x1a048]
mov dword [rbp + 0x1fcc], eax
test rsi, rsi
je 0x140011c3f
mov rdx, rsi
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
test rdi, rdi
je 0x140011c54
mov rdx, rdi
lea rcx, [rbp + 0xf80]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, qword [rbp + 0x1a050]
test rdx, rdx
je 0x140011c6d
lea rcx, [rbp + 0x1fd0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, qword [rbp + 0x1a058]
test rdx, rdx
je 0x140011c86
lea rcx, [rbp + 0x3010]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, qword [rbp + 0x1a068]
test rdx, rdx
je 0x140011c9f
lea rcx, [rbp + 0x4050]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, qword [rbp + 0x1a070]
test rdx, rdx
je 0x140011cb8
lea rcx, [rbp + 0x5090]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rdx, qword [rbp + 0x1a078]
test rdx, rdx
je 0x140011cd1
lea rcx, [rbp + 0x60d0]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, qword [r14 + 0x10]
lea r9, [rbp + 0x1a010]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rbp + 0x1a010], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rbp + 0x9fd0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [r14 + 0x10]
lea r9, [rbp + 0x1a018]
mov r8d, 0x10018
mov dword [rbp + 0x1a018], ebx
lea rdx, [rbp + 0x9fd0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbp + 0x1a060]
test rcx, rcx
je 0x140011d4b
mov eax, dword [rbp + 0x9fe0]
mov dword [rcx], eax
mov ecx, dword [rbp + 0x9fd0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rbp + 0x9fd8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140011d90
Capabilities:
Create service

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [rsp + 0xe8]
mov r10, r9
mov r9d, dword [rsp + 0xa0]
mov r11, r8
mov qword [rsp + 0x60], rax
mov rcx, rdx
mov rax, qword [rsp + 0xe0]
mov r8, r10
mov qword [rsp + 0x58], rax
mov rdx, r11
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
add rsp, 0x70
pop rbx
ret

Function at 0x140011e30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
mov edi, edx
call fcn.1400143a0
mov r8d, ebx
mov edx, edi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140011e60
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov edi, r8d
mov ebx, edx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
call fcn.140249b10
mov dword [rsp + 0x30], 0x1047
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a108]
mov dword [rsp + 0x38], ebx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a108], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x3c], edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140012010
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.1400143a0
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.140012030
Function at 0x140012030
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x100a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbx
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x34], eax
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a108]
add rsp, 0x1a0f0
pop rdi
ret

Function at 0x140012130
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rbx, r9
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
jmp 0x140012170
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov ebx, r8d
mov rdi, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov rsi, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x100b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a110]
mov dword [rsp + 0x40], ebx
lea rdx, [rsp + 0x30]
mov ebx, dword [rsp + 0x1a130]
xor r14d, r14d
mov qword [rsp + 0x38], rdi
mov r8d, 0xa098
mov edi, dword [rsp + 0x1a140]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x1a110], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, ebx
mov qword [rsp + 0x20], r14
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbp + 0x10]
lea r9, [rsp + 0x1a120]
mov r8d, 0x10018
mov dword [rsp + 0x1a120], r14d
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rdx, qword [rsp + 0x1a138]
lea r9, [rsp + 0x1a120]
mov rcx, qword [rbp + 0x10]
mov r8d, edi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x1a148]
test rcx, rcx
je 0x14001229e
mov eax, dword [rsp + 0x1a120]
mov dword [rcx], eax
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140012340
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.1400143a0
mov r9d, ebx
mov r8, rdi
mov rcx, rax
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140012380
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov esi, r9d
call fcn.140249b10
mov dword [rsp + 0x30], 0x1050
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a128]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a128], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x1a130]
mov eax, dword [rsp + 0xa0dc]
test rcx, rcx
je 0x140012450
mov dword [rcx], eax
test rbp, rbp
je 0x140012476
cmp dword [rsp + 0xa0d8], ebx
je 0x140012476
cmp eax, esi
lea rdx, [rsp + 0xa0e0]
mov rcx, rbp
cmovb esi, eax
mov r8d, esi
call fcn.1402496a0
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a118]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012380
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.1400143a0
mov r9d, ebx
mov r8, rdi
mov rcx, rax
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140012380
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov esi, r9d
call fcn.140249b10
mov dword [rsp + 0x30], 0x1050
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a128]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a128], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x1a130]
mov eax, dword [rsp + 0xa0dc]
test rcx, rcx
je 0x140012450
mov dword [rcx], eax
test rbp, rbp
je 0x140012476
cmp dword [rsp + 0xa0d8], ebx
je 0x140012476
cmp eax, esi
lea rdx, [rsp + 0xa0e0]
mov rcx, rbp
cmovb esi, eax
mov r8d, esi
call fcn.1402496a0
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a118]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400124e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.1400143a0
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140012520
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov esi, r9d
call fcn.140249b10
mov dword [rsp + 0x30], 0x1051
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a128]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], eax
xor ebx, ebx
mov eax, dword [rsp + 0x1a138]
mov r8d, 0xa098
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x1a128], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x1a130]
mov eax, dword [rsp + 0xa0dc]
test rcx, rcx
je 0x1400125fb
mov dword [rcx], eax
test rbp, rbp
je 0x140012621
cmp dword [rsp + 0xa0d8], ebx
je 0x140012621
cmp eax, esi
lea rdx, [rsp + 0xa0e0]
mov rcx, rbp
cmovb esi, eax
mov r8d, esi
call fcn.1402496a0
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a118]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret