joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9040
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d9186
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x4d9176
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004e3ae0
xorps xmm15, xmm15
mov r14, qword [0x0079dd38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4d915b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x4d9171
cmp rsi, rcx
ja 0x4d9169
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x4d9161
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.004e3c20
xorps xmm15, xmm15
mov r14, qword [0x0079dd38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.0046ec40
mov rax, rsi
call fcn.0046ec40
call fcn.0046ec00
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.0046ec00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0046c8a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004d9040
Function at 0x4dea00
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4debb2
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rbx, [r9 + rsi]
lea rbx, [rbx + 7]
sar rbx, 3
cmp rcx, rbx
jl 0x4dea45
jae 0x4deabe
nop
jmp 0x4deba6
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
cmp rbx, 1
jne 0x4dea89
lea rax, [0x005431a0]
mov ebx, 1
mov rcx, rbx
call fcn.00468380
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x4deabe
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x005431a0]
nop
call fcn.00468380
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x4dead3
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x4deb05
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x4deac6
nop dword [rax + rax]
jmp 0x4deb9b
test rsi, rsi
jle 0x4deb12
xor r8d, r8d
xor r9d, r9d
jmp 0x4deb65
jmp 0x4deb17
dec rbx
test rbx, rbx
jle 0x4deb26
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x4deb14
cmp rbx, rcx
ja 0x4deb31
add rsp, 0x28
pop rbp
ret
mov rdx, rcx
mov rcx, rbx
call fcn.0046ec00
movzx r11d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r11, cl
lea r12, [rcx + 8]
cmp rcx, 0x40
sbb r13, r13
and r11, r13
or r9, r11
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x4deb75
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x4deb3c
jmp 0x4deb90
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x4deb85
mov qword [rax + rbx*8 - 8], r9
jmp 0x4deb12
mov rax, rsi
mov rcx, rbx
call fcn.0046eb80
mov rax, r10
mov rcx, rdx
call fcn.0046eb80
mov rax, r9
mov rcx, rbx
call fcn.0046eb80
mov rdx, rcx
mov rcx, rbx
call fcn.0046ec00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.0046c8a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004dea00
Function at 0x4e4360
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4e43e5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4e4546
cmp rcx, 0xe
jne 0x4e4460
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4e4546
cmp rcx, 0xf
jne 0x4e44d7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4e4546
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x4f1e00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f203b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
nop
call fcn.004d1cc0
xorps xmm15, xmm15
mov r14, qword [0x0079dd38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x4f1f4a
nop dword [rax]
cmp rdx, 0x40
ja 0x4f202d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x4f1eb9
mov rax, rdx
mov rcx, rsi
nop
call fcn.0046f520
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x4f1f21
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004f2580
xorps xmm15, xmm15
mov r14, qword [0x0079dd38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x4f2022
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x4f1f57
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x4f1fd5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004f2580
xorps xmm15, xmm15
mov r14, qword [0x0079dd38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x4f2018
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x4f2014
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call fcn.0046f520
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call fcn.0046ec40
mov rax, rdx
mov ecx, 0x40
call fcn.0046ec40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046c8a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004f1e00
Function at 0x50eb60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50ed6b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x50ec84
cmp rdx, 0x40
ja 0x50ed5d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x50ebf4
mov rax, rdx
mov rcx, rsi
call fcn.0046f520
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x50ec60
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0050efe0
xorps xmm15, xmm15
mov r14, qword [0x0079dd38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x50ed55
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x50ec87
mov r8, rcx
cmp r8, 0x40
jl 0x50ed05
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.0050efe0
xorps xmm15, xmm15
mov r14, qword [0x0079dd38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x50ed48
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x50ed44
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.0046f520
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.0046ec40
mov rax, rdx
mov ecx, 0x40
call fcn.0046ec40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0046c8a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0050eb60
Function at 0x140011d7c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
call fcn.140044280
test al, al
jne 0x140011e55
cmp qword [rdi + 0x18], 7
jbe 0x140011da8
mov rdi, qword [rdi]
and qword [rsp + 0x30], 0
mov esi, 2
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], esi
mov rcx, rdi
lea r8d, [rsi - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140011e55
and dword [rsp + 0x68], 0
lea r9, [rsp + 0x68]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x60]
mov eax, 0xfeff
mov r8d, esi
mov rcx, rdi
mov word [rsp + 0x60], ax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne sil
test eax, eax
je 0x140011e47
cmp qword [rbx + 0x10], 0
jbe 0x140011e47
mov r8d, dword [rbx + 0x10]
add r8d, r8d
cmp qword [rbx + 0x18], 7
jbe 0x140011e2a
mov rbx, qword [rbx]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne sil
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, sil
jmp 0x140011e57
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14001fd84
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
jmp 0x14001fdf6
cmp ecx, 0x7c
je 0x14001fdfb
cmp ecx, 0x29
jne 0x14001fe06
cmp dword [rbx + 0x1c], 0
jne 0x14001fdfb
test dword [rbx + 0x80], 0x10000000
je 0x14001ff26
cmp ecx, 0x5d
jne 0x14001fdcd
test dword [rbx + 0x80], 0x10000000
je 0x14001ff18
mov dl, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14001f3f0
mov dil, 1
mov rcx, rbx
call fcn.140023558
test dil, dil
je 0x14001fdf1
mov rcx, rbx
call fcn.1400238e0
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x14001fd98
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x2e
jne 0x14001fe23
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.140023500
mov rcx, rbx
call fcn.140023558
jmp 0x14001fde9
cmp ecx, 0x5c
jne 0x14001fe81
mov rcx, rbx
call fcn.140023558
test byte [rbx + 0x80], 0x80
je 0x14001fe74
mov al, byte [rbx + 0x78]
cmp al, 0x62
jne 0x14001fe58
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.140023500
mov rcx, rbx
call fcn.140023558
jmp 0x14001fdf1
cmp al, 0x42
jne 0x14001fe74
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.140023500
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x14001fe4e
mov rcx, rbx
call fcn.14001ff44
jmp 0x14001fde9
cmp ecx, 0x5b
jne 0x14001fea1
mov rcx, rbx
call fcn.140023558
mov rcx, rbx
call fcn.140020894
cmp dword [rbx + 0x7c], 0x5d
jne 0x14001ff18
jmp 0x14001fe19
cmp ecx, 0x28
jne 0x14001fec4
mov rcx, rbx
call fcn.140023558
mov rcx, rbx
call fcn.1400243d8
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x14001ff26
jmp 0x14001fddc
cmp ecx, 0x5e
jne 0x14001fed1
lea edx, [rcx - 0x5c]
jmp 0x14001fe45
cmp ecx, 0x24
jne 0x14001fede
lea edx, [rcx - 0x21]
jmp 0x14001fe45
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14001ff0a
cmp ecx, 0x3f
je 0x14001ff0a
cmp ecx, 0x7b
je 0x14001ff0a
cmp ecx, 0x7d
jne 0x14001fdb8
test dword [rbx + 0x80], 0x10000000
je 0x14001ff34
jmp 0x14001fdcd
mov edx, 0xa
mov rcx, rbx
call fcn.140021c40
int3
mov edx, 4
mov rcx, rbx
call fcn.140021c40
int3
mov edx, 5
mov rcx, rbx
call fcn.140021c40
int3
mov edx, 6
mov rcx, rbx
call fcn.140021c40
int3
Function at 0x14002b844
Capabilities:
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rdi, [rcx + 8]
mov rbx, rdx
mov rsi, rcx
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.140028a4c
mov r8, qword [rax]
cmp qword [r8 + 0x28], 0
je 0x14002b8a0
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.140028a4c
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.140028a4c
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x14002b8ef
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.140028a4c
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.140028a4c
mov rcx, qword [rax]
and qword [rcx + 0x30], 0
cmp qword [rbx + 0x18], 7
jbe 0x14002b8f9
mov rbx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], 0x20000
or rcx, 0xffffffffffffffff
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
mov rbx, rax
call fcn.140028a4c
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x10]
mov rcx, qword [rax]
mov qword [rcx + 0x28], rbx
mov rcx, rdi
call fcn.140028a4c
mov rcx, qword [rax]
cmp qword [rcx + 0x28], 0
je 0x14002b997
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.140028a4c
xor r9d, r9d
mov qword [rsp + 0x20], 0x20000
xor r8d, r8d
mov rcx, qword [rax]
lea edx, [r9 + 6]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
mov rbx, rax
call fcn.140028a4c
mov rdx, qword [rax]
mov qword [rdx + 0x30], rbx
lea r8, [rbp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x10]
call fcn.140028a4c
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
setne al
mov byte [rsi + 0x20], al
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x14002e814
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14002e842
xor eax, eax
jmp 0x14002e928
cmp qword [rcx + 0x68], 0
je 0x14002e853
call fcn.140026298
jmp 0x14002e928
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14002e86a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002e86c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002e89e
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400a0490
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14002e922
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14002e8d5
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14002e8fe
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14008a7c0
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14002e922
cmp rsi, rbx
ja 0x14002e8dc
test rsi, rsi
je 0x14002e922
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14008a7c0
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400314d4
Capabilities:
Load windows common language runtime

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp qword [0x1400ddcf0], rbx
jne 0x14003157f
and qword [rsp + 0x38], rbx
lea r8, [rsp + 0x38]
lea rdx, [0x1400aa3b8]
lea rcx, [0x1400aa3c8]
call sub.mscoree.dll_CLRCreateInstance
mov ebx, eax
test eax, eax
js 0x14003157f
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
and qword [rsp + 0x30], 0
lea r8, [0x1400aa3d8]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x140031574
mov rcx, qword [rsp + 0x30]
lea r9, [0x1400ddcf0]
lea r8, [0x1400aa3a8]
lea rdx, [0x1400aa398]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x140031569
mov rcx, qword [0x1400ddcf0]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140031588
Capabilities:
Load windows common language runtime

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp qword [0x1400ddcf0], rbx
jne 0x1400315d4
lea rax, [0x1400ddcf0]
xor edx, edx
lea r9, [0x1400aa3a8]
mov qword [rsp + 0x20], rax
lea r8, [0x1400aa398]
lea rcx, str.v2.0.50727
call sub.mscoree.dll_CorBindToRuntime
mov ebx, eax
test eax, eax
js 0x1400315d4
mov rcx, qword [0x1400ddcf0]
mov rdx, qword [rcx]
call qword [rdx + 0x50]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140035460
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1400db380]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov edi, r9d
mov r14d, r8d
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x48], rdx
xor r15d, r15d
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400354a9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp - 0x70]
call fcn.1400a0b30
mov r8d, r14d
lea rdx, [0x1400a6f60]
lea rcx, [rbp - 0x70]
call fcn.140028c18
mov r8, rbx
lea rdx, str..pipe_
lea rcx, [rsp + 0x70]
call fcn.140002b8c
nop
lea rcx, [rbp - 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], r15w
jne 0x1400354ea
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.1400245bc
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov r14d, 7
mov qword [rax + 0x18], r14
mov word [rax], r15w
lea rcx, [rsp + 0x70]
call fcn.140024228
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0xa
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], r14
cmova rcx, qword [rsp + 0x50]
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x14003557b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14003557b
test edi, edi
jg 0x14003553f
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], r14
cmova rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
setne dil
mov rdx, qword [rsp + 0x68]
cmp rdx, r14
jbe 0x1400355fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400355f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035638
call fcn.140078ab8
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r14
mov word [rsp + 0x50], r15w
mov rcx, rbx
call fcn.140024228
mov al, dil
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140078f30
mov rbx, qword [rsp + 0x168]
add rsp, 0x120
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14007faac
nop
int3

Function at 0x140037b28
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdi, [0x1400ddd80]
mov qword [rsp + 0x48], rdi
mov rcx, rdi
call fcn.14007691c
test eax, eax
jne 0x140037bbd
cmp dword [0x1400dddcc], 0x7fffffff
je 0x140037ba8
lea edx, [rax + 5]
mov rcx, rbx
call fcn.14003fc44
lea rax, [0x140037538]
mov qword [rsp + 0x50], rax
and dword [rsp + 0x48], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, 8
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140076924
mov dword [0x1400dddcc], 0x7ffffffe
mov ecx, 6
call fcn.140076b98
int3
mov ecx, 5
call fcn.140076b98
int3