joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400104c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
xor esi, esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
mov edi, esi
mov r9d, 0x20019
lea r8, str.SOFTWAREPoliciesDigitalPersonaAltus
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.140010800
mov rbx, qword [rsp + 0x38]
test eax, eax
jne 0x140010579
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x78], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, str.NetworkSupport
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001055f
cmp dword [rsp + 0x80], 4
jne 0x14001055f
cmp dword [rsp + 0x70], esi
sete dil
test rbx, rbx
je 0x140010575
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rsi
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
test rbx, rbx
je 0x14001058c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rsi
mov eax, edi
mov dword [rsp + 0x40], esi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140010900
Capabilities:
Create directory

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x40
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x140030030]
xor rax, rbp
mov qword [rbp + 0x18], rax
mov r15, rcx
test rcx, rcx
je 0x140010a93
cmp word [rcx], 0
je 0x140010a93
xor esi, esi
mov ebx, esi
mov qword [rbp], rbx
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x140010953
add rdi, 0xa
lea r14, [rdi + rdi]
cmp r14, 0x400
ja 0x1400109a0
mov rcx, r14
call fcn.140011ed0
test al, al
je 0x1400109a0
lea rax, [r14 + 0xf]
cmp rax, r14
ja 0x14001098d
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140014e80
sub rsp, rax
lea r14, [rsp + 0x20]
jmp 0x1400109d2
or rax, 0xffffffffffffffff
sub rax, r14
cmp rax, 0x10
jb 0x140010a88
lea rcx, [r14 + 0x10]
call fcn.140012b48
test rax, rax
jne 0x1400109c4
mov r14, rsi
jmp 0x1400109d2
mov qword [rax], rsi
mov rbx, rax
mov qword [rbp], rax
lea r14, [rax + 0x10]
test r14, r14
jne 0x1400109e1
mov esi, 0x8007000e
jmp 0x140010a61
or r9, 0xffffffffffffffff
mov r8, r15
mov rdx, rdi
mov rcx, r14
call fcn.140014584
mov qword [rbp + 8], rsi
lea r8, [rbp + 8]
lea rdx, [0x140024c50]
mov rcx, r14
call fcn.14001484c
test rax, rax
je 0x140010a61
mov edi, 0x5c
mov rcx, r14
call fcn.1400105a0
test al, al
jne 0x140010a2f
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140010a4c
lea r8, [rbp + 8]
lea rdx, [0x140024c50]
xor ecx, ecx
call fcn.14001484c
test rax, rax
je 0x140010a61
mov word [rax - 2], di
jmp 0x140010a14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x140010a61
movzx esi, ax
or esi, 0x80070000
test rbx, rbx
je 0x140010a84
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp], rbx
call fcn.140012b08
test rbx, rbx
jne 0x140010a70
mov eax, esi
jmp 0x140010a98
mov ecx, 0x80070216
call fcn.14000d5a0
nop
mov eax, 0x80070057
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.140013760
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x20]
pop r15
pop r14
pop rbp
ret

Function at 0x140011530
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov rsi, r8
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
je 0x14001159a
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx eax, word [rbx + 5]
test ax, ax
je 0x14001157c
lea rdx, [rbx + 7]
movzx r8d, ax
mov rcx, rdi
call fcn.14000f3e0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400115b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x140030030]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor eax, eax
mov rdi, rcx
lea rcx, [rsp + 0x68]
xor esi, esi
mov qword [rsp + 0x6a], rax
mov dword [rsp + 0x72], eax
mov word [rsp + 0x68], si
mov word [rsp + 0x76], ax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, [rsp + 0x81]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x80], sil
call fcn.140014ee0
movzx ecx, word [rsp + 0x74]
movzx r8d, word [rsp + 0x72]
movzx r9d, word [rsp + 0x70]
movzx ebx, word [rsp + 0x6a]
movzx eax, word [rsp + 0x76]
movzx r10d, word [rsp + 0x68]
movzx r11d, word [rsp + 0x6e]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
or rbx, 0xffffffffffffffff
lea r9, str._02u__02u__04u__02u:_02u:_02u._03u_r_n
lea rcx, [rsp + 0x80]
mov edx, 0x104
mov r8, rbx
call fcn.140014d30
mov dword [rsp + 0x60], esi
lea rax, [rsp + 0x80]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], sil
jne 0x140011690
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x80]
mov r8, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140013760
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400116e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov qword [rbp + 0x2a0], rbx
mov rax, qword [0x140030030]
xor rax, rbp
mov qword [rbp + 0x240], rax
mov rbx, rdx
mov r13, rcx
lea rdx, str.VerQueryValueA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
jne 0x14001173d
xor al, al
jmp 0x140011945
lea rdx, str.GetFileVersionInfoSizeA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140011736
lea rdx, str.GetFileVersionInfoA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x140011736
mov byte [rbp + 0x20], 0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x21]
call fcn.140014ee0
call fcn.14000fd10
mov rcx, rax
mov r8d, 0x105
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140011736
xor edx, edx
lea rcx, [rbp + 0x20]
call rdi
mov r14d, eax
test eax, eax
je 0x140011736
xor ebx, ebx
mov qword [rbp + 8], rbx
or rdi, 0xffffffffffffffff
cmp r14d, 0x400
ja 0x1400117f2
mov ecx, r14d
call fcn.140011ed0
test al, al
je 0x1400117f2
lea rax, [r14 + 0xf]
cmp rax, r14
ja 0x1400117df
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140014e80
sub rsp, rax
lea rsi, [rsp + 0x40]
jmp 0x140011829
mov rcx, r14
mov rax, rdi
sub rax, r14
cmp rax, 0x10
jb 0x14001193a
add rcx, 0x10
call fcn.140012b48
test rax, rax
jne 0x140011817
xor esi, esi
jmp 0x140011829
mov qword [rax], 0
mov rbx, rax
mov qword [rbp + 8], rax
lea rsi, [rax + 0x10]
test rsi, rsi
je 0x14001190b
mov r9, rsi
mov r8d, r14d
xor edx, edx
lea rcx, [rbp + 0x20]
call r15
test eax, eax
je 0x14001190b
xor r14d, r14d
mov qword [rbp + 0x10], r14
mov dword [rbp], r14d
lea r9, [rbp]
lea r8, [rbp + 0x10]
lea rdx, [0x140025364]
mov rcx, rsi
call r12
test eax, eax
je 0x14001190b
mov byte [rbp + 0x130], r14b
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x131]
call fcn.140014ee0
mov dword [rbp + 4], r14d
mov r9, qword [rbp + 0x10]
movzx eax, word [r9 + 0x14]
movzx ecx, word [r9 + 0x16]
movzx r8d, word [r9 + 8]
movzx r9d, word [r9 + 0xa]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r9d
lea r9, str.FileVersion:__u._u._u._u_r_n
mov r8, rdi
mov edx, 0x104
lea rcx, [rbp + 0x130]
call fcn.140014d30
lea rax, [rbp + 0x130]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], r14b
jne 0x1400118e0
mov r8, rdi
mov qword [rsp + 0x20], r14
lea r9, [rbp + 4]
lea rdx, [rbp + 0x130]
mov rcx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dil, 1
jmp 0x14001190e
xor dil, dil
test rbx, rbx
je 0x140011934
nop dword [rax]
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 8], rbx
call fcn.140012b08
test rbx, rbx
jne 0x140011920
movzx eax, dil
jmp 0x140011945
mov ecx, 0x80070216
call fcn.14000d5a0
nop
mov rcx, qword [rbp + 0x240]
xor rcx, rbp
call fcn.140013760
mov rbx, qword [rbp + 0x2a0]
lea rsp, [rbp + 0x250]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011c70
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x140030030]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov rdi, rcx
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x50], 0
call fcn.140014ee0
xor esi, esi
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREDigitalPersonaProducts
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], esi
mov ebx, esi
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140011e90
lea rcx, [rbp + 0x61]
xor edx, edx
mov r8d, 0x104
mov byte [rbp + 0x60], bl
call fcn.140014ee0
mov rcx, qword [rsp + 0x30]
lea r8, [rbp + 0x60]
mov r9d, 0x104
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x140011e85
nop dword [rax]
lea rcx, [rbp + 0x171]
xor edx, edx
mov r8d, 0x104
mov byte [rbp + 0x170], sil
call fcn.140014ee0
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, [rbp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140011dfd
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x44]
lea rdx, str.Version
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x170]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x44], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rsp + 0x50]
test eax, eax
jne 0x140011dd7
lea rax, [rbp + 0x170]
lea r9, str.Product:__s__Version:__s_r_n
mov qword [rsp + 0x28], rax
jmp 0x140011de2
mov dword [rsp + 0x28], eax
lea r9, str.Product:__s__Version:_ERROR_0x_X__r_n
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.140014d30
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140011e24
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x60]
lea r9, str.Product:__s_ERROR_0x_X__r_n
lea rcx, [rsp + 0x50]
or r8, 0xffffffffffffffff
mov edx, 0x104
mov qword [rsp + 0x20], rax
call fcn.140014d30
movzx eax, word [0x1400250ec]
or r8, 0xffffffffffffffff
mov word [rbp + 0x52], ax
movzx eax, byte [0x1400250ee]
mov byte [rbp + 0x54], al
lea rax, [rsp + 0x50]
inc r8
cmp byte [rax + r8], sil
jne 0x140011e42
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x30]
inc ebx
lea r8, [rbp + 0x60]
mov r9d, 0x104
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x140011d30
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140013760
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140015748
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400155b0
Function at 0x140003eeb
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
sub rsp, 0x268
mov rsi, rcx
lea r8, [rsp + 0x2c]
mov dword [r8], 0x100
lea rdx, [rsp + 0x68]
mov ecx, 2
call sub.Secur32.dll_GetUserNameExW
test al, 1
je 0x140003f7c
mov eax, dword [rsp + 0x2c]
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8d, 0x100
mov rcx, rdi
mov rdx, rsi
call fcn.1400040a6
mov rax, qword [rdi]
lea rcx, [rsp + 0x40]
mov qword [rcx], rsi
mov qword [rcx + 8], rax
movups xmm0, xmmword [0x14002fe10]
movups xmmword [rcx + 0x10], xmm0
mov byte [rcx + 0x20], 0x5c
call fcn.140011488
mov rcx, rax
mov rax, rdx
test rcx, rcx
mov edx, 6
cmovne rdx, rax
lea rax, str.unknow
cmovne rax, rcx
jmp 0x140003f88
mov edx, 6
lea rax, str.unknow
add rsp, 0x268
pop rdi
pop rsi
ret

Function at 0x140003f92
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
sub rsp, 0x278
mov rsi, rcx
lea r8, [rsp + 0x34]
mov dword [r8], 0x100
lea rdx, [rsp + 0x76]
mov ecx, 2
call sub.Secur32.dll_GetUserNameExW
test al, 1
je 0x14000402e
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x38]
lea r9, [rsp + 0x76]
mov r8d, 0x100
mov rcx, rdi
mov rdx, rsi
call fcn.1400040a6
mov rax, qword [rdi]
lea rdi, [rsp + 0x48]
mov qword [rdi], rsi
mov qword [rdi + 8], rax
movups xmm0, xmmword [0x14002fe10]
movups xmmword [rdi + 0x10], xmm0
mov byte [rdi + 0x20], 0x5c
mov rcx, rdi
call fcn.140011488
mov rcx, rdi
call fcn.140011488
mov rcx, rax
mov rax, rdx
test rcx, rcx
mov edx, 6
cmovne rdx, rax
lea rax, str.unknow
cmovne rax, rcx
jmp 0x14000403a
mov edx, 6
lea rax, str.unknow
add rsp, 0x278
pop rdi
pop rsi
ret

Function at 0x1400041fb
Capabilities:
Initialize winsock library

Disassembly:
push rsi
sub rsp, 0x1c0
lea rcx, [0x140037140]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
lea rdx, [rsp + 0x28]
mov cx, 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x140004243
cmp ax, 0x2734
je 0x14000423d
movzx eax, ax
cmp eax, 0x2753
je 0x140004247
cmp eax, 0x276b
je 0x14000424d
cmp eax, 0x276c
mov si, 0xe
jmp 0x140004251
xor esi, esi
jmp 0x140004251
mov si, 0x12
jmp 0x140004251
mov si, 0x15
lea rcx, [0x140037140]
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov eax, esi
add rsp, 0x1c0
pop rsi
ret
Function at 0x140009034
Capabilities:
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rax, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0x12
lea rdx, [rsp + 0x98]
lea r8, [rsp + 0x30]
mov rcx, rax
mov r9d, 0x68
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
je 0x140009080
cmp eax, 0xc0000022
je 0x1400090f6
cmp eax, 0x80000005
jne 0x140009107
and word [rdi + 0x48], 0
mov rax, qword [rsp + 0x70]
mov qword [rdi], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 8], rax
xor eax, eax
cmp byte [rsp + 0x6d], 0
sete al
lea eax, [rax + rax*2]
add eax, 2
and al, 0xf
mov byte [rdi + 0x40], al
movabs rcx, 0xfe624e212ac18000
mov rax, qword [rsp + 0x38]
add rax, rcx
mov r8d, 0x64
imul r8
mov qword [rdi + 0x18], rdx
mov qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x40]
add rax, rcx
imul r8
mov qword [rdi + 0x28], rdx
add rcx, qword [rsp + 0x30]
mov qword [rdi + 0x20], rax
mov rax, rcx
imul r8
mov qword [rdi + 0x38], rdx
mov qword [rdi + 0x30], rax
jmp 0x14000910d
lea rsi, [0x14002f948]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
jmp 0x14000910d
mov word [rdi + 0x48], 0xe
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x140009f50
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rdi, rdx
mov qword [rsp + 0x60], rcx
lea r13, [rdx + 0x18]
mov rbp, qword [rdx + 8]
mov r14, qword [rdx + 0x10]
xor esi, esi
mov rbx, rbp
cmp rbp, r14
jb 0x140009fed
mov rcx, qword [rdi]
mov al, byte [rdi + 0x418]
mov byte [rsp + 0x50], al
mov byte [rsp + 0x40], sil
and qword [rsp + 0x48], 0
mov qword [rsp + 0x28], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 0x400
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtQueryDirectoryFile
mov byte [rdi + 0x418], sil
mov r14, qword [rsp + 0x70]
test r14, r14
je 0x14000a0e3
and qword [rdi + 8], 0
mov qword [rdi + 0x10], r14
test eax, eax
jne 0x14000a0b8
mov ebx, eax
lea r15, [rdi + rbx]
add r15, 0x76
mov eax, dword [r15 - 0x5e]
lea rbp, [rbx + rax]
test rax, rax
mov eax, 0x400
cmove rbp, rax
mov qword [rdi + 8], rbp
mov r12d, dword [r15 - 0x22]
shr r12, 1
mov r9d, 1
mov rcx, r15
mov rdx, r12
lea r8, [0x14002ff10]
call fcn.140009962
test al, 1
jne 0x140009f79
mov r9d, 2
mov rcx, r15
mov rdx, r12
lea r8, [0x14002ff28]
call fcn.140009962
test al, 1
jne 0x140009f79
lea rsi, [rdi + rbx]
add rsi, 0x18
add rdi, 0x419
mov qword [rsp + 0x20], r12
lea rbx, [rsp + 0x78]
mov r8d, 0x2fd
mov rcx, rbx
mov rdx, rdi
mov r9, r15
call fcn.1400040a6
mov eax, dword [rsi + 0x38]
bt eax, 0xa
setae cl
or cl, 4
test al, 0x10
movzx eax, cl
mov ecx, 2
cmove ecx, eax
mov rax, qword [rbx]
mov rdx, qword [rsp + 0x60]
and word [rdx + 0x20], 0
mov byte [rdx + 0x18], 1
mov qword [rdx], rdi
mov qword [rdx + 8], rax
mov byte [rdx + 0x10], cl
jmp 0x14000a104
cmp eax, 0xc0000022
jne 0x14000a0f9
movups xmm0, xmmword [0x14002fde8]
mov rax, qword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x14002fdd8]
movups xmmword [rax], xmm0
mov qword [rax + 0x20], 9
jmp 0x14000a104
xorps xmm0, xmm0
mov rax, qword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
and qword [rax + 0x20], 0
jmp 0x14000a104
mov rax, qword [rsp + 0x60]
mov word [rax + 0x20], 0xe
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000a79b
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r14d, 0xffffffff
cmp r9, r14
cmovb r14, r9
mov r12, qword [rsp + 0xc0]
lea r15, [rsp + 0x2c]
xorps xmm6, xmm6
lea r13, [rsp + 0x30]
cmp byte [r12 + 8], 0
je 0x14000a802
mov rax, qword [r12]
movaps xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x40], eax
shr rax, 0x20
mov dword [rsp + 0x44], eax
and qword [rsp + 0x48], 0
mov rax, r13
jmp 0x14000a804
xor eax, eax
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rdi
mov r8d, r14d
mov r9, r15
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x14000a840
call sub.KERNEL32.dll_GetLastError
cmp ax, 0x3e3
je 0x14000a7da
movzx eax, ax
cmp eax, 0x26
je 0x14000a83b
cmp eax, 0x40
je 0x14000a84e
cmp eax, 0x6d
jne 0x14000a85a
xorps xmm0, xmm0
jmp 0x14000a855
mov eax, dword [rsp + 0x2c]
mov qword [rsi], rax
and word [rsi + 8], 0
jmp 0x14000a860
movups xmm0, xmmword [0x14002fea0]
movups xmmword [rsi], xmm0
jmp 0x14000a860
mov word [rsi + 8], 0xe
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000a875
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rax, r8
mov rsi, rcx
mov r8d, 0xffffffff
cmp r9, r8
cmovb r8, r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x2c]
mov rcx, rdx
mov rdx, rax
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x14000a8b5
mov eax, dword [rsp + 0x2c]
mov qword [rsi], rax
and word [rsi + 8], 0
jmp 0x14000a915
call sub.KERNEL32.dll_GetLastError
cmp ax, 6
je 0x14000a8f0
movzx eax, ax
cmp eax, 8
je 0x14000a8e7
cmp eax, 0x21
je 0x14000a8f9
cmp eax, 0x6d
je 0x14000a902
cmp eax, 0x3e3
je 0x14000a90b
cmp eax, 0x6f8
je 0x14000a8e7
cmp eax, 0x718
jne 0x14000a91b
movups xmm0, xmmword [0x14002feb0]
jmp 0x14000a912
movups xmm0, xmmword [0x14002fee0]
jmp 0x14000a912
movups xmm0, xmmword [0x14002fef0]
jmp 0x14000a912
movups xmm0, xmmword [0x14002fed0]
jmp 0x14000a912
movups xmm0, xmmword [0x14002fec0]
movups xmmword [rsi], xmm0
add rsp, 0x30
pop rsi
ret
mov word [rsi + 8], 0xe
jmp 0x14000a915

Function at 0x14000adee
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov edx, 1
call sub.KERNEL32.dll_TerminateProcess
test eax, eax
je 0x14000ae04
xor eax, eax
jmp 0x14000ae0d
call sub.KERNEL32.dll_GetLastError
mov ax, 0xe
add rsp, 0x28
ret
Function at 0x14000dfe7
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, r9
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x38], rcx
mov rax, qword [r9 + 0x18]
mov rsi, qword [r9 + 0x28]
mov r15d, 0xffffffff
lea r12, [rsp + 0x34]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], r8
mov rcx, rax
sub rcx, rsi
cmp rcx, 0x1ff
ja 0x14000e16d
mov bp, 2
add rsi, 0x200
jb 0x14000e1e1
cmp rax, rsi
jae 0x14000e16d
mov rcx, rdi
call fcn.14000e625
dec rsi
je 0x14000e066
bsr rax, rsi
xor rax, 0x3f
jmp 0x14000e06b
mov eax, 0x40
test ax, ax
je 0x14000e1e1
mov cl, 0x40
sub cl, al
mov r13d, 1
shl r13, cl
test cl, 0x40
mov eax, 0
cmovne r13, rax
mov r15, qword [rdi + 0x18]
mov rsi, qword [rdi]
mov rax, qword [rdi + 8]
mov rbx, qword [rsp + 0xa8]
test r15, r15
je 0x14000e12a
mov r12, qword [rdi + 0x10]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov rdx, r12
mov r8, r15
xor r9d, r9d
mov qword [rsp + 0x40], rax
call qword [rax + 8]
test al, 1
jne 0x14000e155
mov rcx, rsi
mov rdx, r13
xor r8d, r8d
mov r9, rbx
mov rax, qword [rsp + 0x40]
call qword [rax]
test rax, rax
je 0x14000e1e1
mov r14, rax
cmp r13, r15
mov r8, r15
cmovb r8, r13
mov rcx, rax
mov rdx, r12
call fcn.1400027aa
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov rdx, r12
mov r8, r15
xor r9d, r9d
mov rax, qword [rsp + 0x40]
call qword [rax + 0x10]
mov r12, r14
mov r14, qword [rsp + 0x48]
jmp 0x14000e155
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x58]
mov rdx, rsi
mov r8, rax
mov r9, r13
call fcn.14000e6e3
movzx ebp, word [rsp + 0x60]
test bp, bp
jne 0x14000e1e1
mov r12, qword [rsp + 0x58]
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], r13
mov rbx, qword [rsp + 0x50]
mov r15d, 0xffffffff
lea r12, [rsp + 0x34]
mov rcx, rdi
call fcn.14000e751
cmp rdx, 0x1ff
ja 0x14000e18e
mov rcx, rdi
call fcn.14000e625
mov rcx, rdi
call fcn.14000e751
mov r8, rdx
cmp rdx, r15
cmovae r8, r15
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rax
mov r9, r12
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x14000e1c4
mov esi, dword [rsp + 0x34]
add rsi, qword [rdi + 0x28]
mov rax, qword [rdi + 0x18]
mov qword [rdi + 0x28], rsi
jmp 0x14000e022
call sub.KERNEL32.dll_GetLastError
cmp ax, 0x6d
je 0x14000e1eb
movzx eax, ax
cmp eax, 0x3e5
jne 0x14000e1fa
mov eax, dword [0x14002fe00]
jmp 0x14000e1f1
mov rax, qword [rsp + 0x38]
mov word [rax], bp
jmp 0x14000e204
mov eax, dword [0x14002f840]
mov rcx, qword [rsp + 0x38]
mov dword [rcx], eax
jmp 0x14000e204
mov rax, qword [rsp + 0x38]
mov word [rax], 0xe
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret