joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ef68
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001ef7e
mov al, 1
jmp 0x14001efde
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14001ef8f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14001efdc
mov ecx, dword [rcx + 0x18]
nop
call fcn.140019b4c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001efdc
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001efdc
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001efdc
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001efde
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400203ec
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140067770]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140020443
cmp word [rdx], r13w
jne 0x140020443
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140020448
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14002056d
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14002058e
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140020481
mov rdx, r9
mov word [rbx], cx
jmp 0x1400204a8
cmp r9, r8
jae 0x1400204b8
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140020462
jmp 0x14002056d
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140020562
cmp dword [rsp + 0x80], esi
je 0x140020562
lea r8, [0x140067770]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14002053a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14002050a
mov word [rbx], r13w
jmp 0x14002056a
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140020517
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14002056a
cmp word [rsp + 0x70], r13w
jne 0x140020547
cmp rbx, r14
je 0x140020504
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14002030c
cmp word [rsp + 0x70], r13w
je 0x14002056d
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140067770]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140020567
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14002056d
Function at 0x14002215c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14002030c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14002030c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400222ac
cmp rax, 0xffffffffffffffff
je 0x1400222ac
xor edi, edi
test rbp, rbp
jle 0x140022257
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001622c
mov rbx, rax
test rax, rax
jne 0x1400221e4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002224d
mov edx, 0x8000
mov ecx, r14d
call fcn.1400157a0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001a584
cmp eax, 0xffffffff
je 0x14002222d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400221f4
mov edx, r15d
mov ecx, r14d
call fcn.1400157a0
jmp 0x14002224d
cmp byte [rsi + 0x38], dil
je 0x140022244
cmp dword [rsi + 0x34], 5
jne 0x140022244
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002224d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400162a4
jmp 0x1400222c0
jns 0x1400222c0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14002030c
cmp rax, 0xffffffffffffffff
jne 0x140022278
cmp byte [rsi + 0x30], dil
je 0x1400222c0
mov edi, dword [rsi + 0x2c]
jmp 0x1400222c0
mov ecx, r14d
call fcn.140019b4c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400222c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400222c0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400222b9
mov eax, dword [rsi + 0x2c]
jmp 0x1400222be
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14002030c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400230d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400230f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400230f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180064c00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x48
mov rbx, rcx
lea rax, [0x1800cfd18]
mov qword [rcx], rax
lea rax, [0x1800cfd40]
mov qword [rcx], rax
mov qword [rcx + 8], 0x20
xor edi, edi
mov qword [rcx + 0x10], rdi
mov qword [0x1800ec540], rcx
mov dword [rsp + 0x70], 4
mov dword [rsp + 0x68], edi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1800c82d0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180064ca7
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, [0x1800c8300]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
mov dword [rbx + 0x18], eax
test eax, eax
cmovne rdi, qword [0x1800ec540]
mov qword [0x1800ec538], rdi
mov rax, rbx
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x180064d40
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov esi, edx
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebp, ebp
lea r14, [rbp - 1]
cmp dword [0x1800eb3b0], 0xffffffff
jne 0x180064dd1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1800eb3b0], eax
cmp eax, 0xffffffff
je 0x180064ed9
mov ecx, dword [rbx + 8]
mov dword [rbx + 0xc], ecx
mov eax, 8
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.180066fec
mov qword [rbx + 0x10], rax
mov edx, ebp
cmp dword [rbx + 0xc], edx
jbe 0x180064dd1
nop word [rax + rax]
mov ecx, edx
mov rax, qword [rbx + 0x10]
mov qword [rax + rcx*8], rbp
inc edx
cmp edx, dword [rbx + 0xc]
jb 0x180064dc0
mov ecx, 0xc
call fcn.180066fb0
mov rdi, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x180064df6
mov dword [rax], ebp
mov byte [rax + 4], 0
mov dword [rax + 8], esi
jmp 0x180064df9
mov rdi, rbp
test rdi, rdi
je 0x180064ed9
mov rdx, rdi
mov ecx, dword [0x1800eb3b0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, ebp
mov r8d, dword [rbx + 0xc]
test r8d, r8d
je 0x180064e38
mov r9, qword [rbx + 0x10]
mov eax, ecx
lea rdx, [r9 + rax*8]
cmp qword [rdx], 0
je 0x180064e35
inc ecx
cmp ecx, r8d
jb 0x180064e20
jmp 0x180064e38
mov qword [rdx], rdi
mov edx, dword [rbx + 0xc]
cmp ecx, edx
jne 0x180064ecc
mov ecx, dword [rbx + 8]
add ecx, edx
mov eax, 8
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.180066fec
mov rsi, rax
mov r8d, ebp
mov edx, dword [rbx + 0xc]
test edx, edx
je 0x180064e92
nop dword [rax]
mov ecx, r8d
lea rdx, [rcx*8]
mov rcx, qword [rbx + 0x10]
mov rax, qword [rdx + rcx]
mov qword [rdx + rsi], rax
inc r8d
mov edx, dword [rbx + 0xc]
cmp r8d, edx
jb 0x180064e70
mov ecx, dword [rbx + 8]
add ecx, edx
cmp edx, ecx
jae 0x180064eb2
nop dword [rax + rax]
mov eax, edx
mov qword [rsi + rax*8], rbp
inc edx
mov eax, dword [rbx + 8]
add eax, dword [rbx + 0xc]
cmp edx, eax
jb 0x180064ea0
mov rcx, qword [rbx + 0x10]
call fcn.180066ff4
mov eax, dword [rbx + 0xc]
mov qword [rsi + rax*8], rdi
mov qword [rbx + 0x10], rsi
mov eax, dword [rbx + 8]
add dword [rbx + 0xc], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x180064edc
mov rdi, rbp
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x180064f00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x50
movzx edi, dl
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x1800eb3b0]
cmp ecx, 0xffffffff
je 0x180065000
cmp qword [rbx + 0x10], 0
je 0x180065000
test dil, dil
je 0x180064f9b
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
mov edx, esi
mov r9d, dword [rbx + 0xc]
test r9d, r9d
je 0x180064f87
mov r10, qword [rbx + 0x10]
nop dword [rax + rax]
mov ecx, edx
lea r8, [r10 + rcx*8]
cmp qword [r8], rax
je 0x180064f84
inc edx
cmp edx, r9d
jb 0x180064f70
jmp 0x180064f87
mov qword [r8], rsi
test rax, rax
je 0x180065000
mov edx, 0xc
mov rcx, rax
call fcn.180066cec
jmp 0x180065000
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x1800eb3b0], 0xffffffff
xor esi, esi
mov edi, esi
cmp dword [rbx + 0xc], esi
jbe 0x180064ff0
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
lea r14, [rax*8]
mov rax, qword [rbx + 0x10]
mov rcx, qword [r14 + rax]
test rcx, rcx
je 0x180064fe9
mov edx, 0xc
call fcn.180066cec
mov rax, qword [rbx + 0x10]
mov qword [r14 + rax], rsi
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180064fc0
mov rcx, qword [rbx + 0x10]
call fcn.180066ff4
mov qword [rbx + 0x10], rsi
mov dword [rbx + 0xc], esi
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret

Function at 0x180065120
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1800eb3b0]
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x1800ec530]
test rax, rax
cmovne ecx, ebx
mov dword [0x1800ec530], ecx
add rsp, 0x20
pop rbx
ret
Function at 0x1800b1f4c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800b1f7c
xor eax, eax
jmp 0x1800b203f
mov rbp, rbx
cmp word [rax], si
je 0x1800b1fa1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800b1f88
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800b1f84
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800b1dfc
movsxd r14, eax
test eax, eax
jne 0x1800b1fdf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800b1f75
mov rcx, r14
call fcn.1800a65f0
mov rdi, rax
test rax, rax
jne 0x1800b1ff8
xor ecx, ecx
call fcn.1800a66d0
jmp 0x1800b1fd4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800b1dfc
test eax, eax
jne 0x1800b2029
mov rcx, rdi
call fcn.1800a66d0
jmp 0x1800b2033
xor ecx, ecx
call fcn.1800a66d0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800bdcd4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1800ed240]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1800bdd32
cmp word [rdx], r12w
jne 0x1800bdd32
or byte [rax + r8*8 + 0x38], cl
jmp 0x1800bdd38
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x1800bde93
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x1800bde6e
lea r9, [rcx + 2]
cmp ax, r13w
je 0x1800bdd71
mov rcx, r9
jmp 0x1800bdd94
cmp r9, rdx
jae 0x1800bddab
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x1800bdd55
jmp 0x1800bde93
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800bde68
cmp dword [rsp + 0x80], edi
je 0x1800bde68
mov rdx, r14
lea r11, [0x1800ed240]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x1800bde41
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x1800bde14
mov word [rbx], r12w
jmp 0x1800bde8f
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x1800bde1d
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x1800bde8f
cmp word [rsp + 0x70], r12w
jne 0x1800bde4e
cmp rbx, rsi
je 0x1800bde0e
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.1800bd9a0
cmp word [rsp + 0x70], r12w
je 0x1800bde93
mov word [rbx], r13w
jmp 0x1800bde8f
lea r11, [0x1800ed240]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x1800bde8b
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1800bde93
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800c28fc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800bd9a0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800bd9a0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1800c2a4c
cmp rax, 0xffffffffffffffff
je 0x1800c2a4c
xor edi, edi
test rbp, rbp
jle 0x1800c29f7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1800a6650
mov rbx, rax
test rax, rax
jne 0x1800c2984
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1800c29ed
mov edx, 0x8000
mov ecx, r14d
call fcn.1800c24f4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800ada48
cmp eax, 0xffffffff
je 0x1800c29cd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800c2994
mov edx, r15d
mov ecx, r14d
call fcn.1800c24f4
jmp 0x1800c29ed
cmp byte [rsi + 0x38], dil
je 0x1800c29e4
cmp dword [rsi + 0x34], 5
jne 0x1800c29e4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1800c29ed
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800a66d0
jmp 0x1800c2a60
jns 0x1800c2a60
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800bd9a0
cmp rax, 0xffffffffffffffff
jne 0x1800c2a18
cmp byte [rsi + 0x30], dil
je 0x1800c2a60
mov edi, dword [rsi + 0x2c]
jmp 0x1800c2a60
mov ecx, r14d
call fcn.1800b7940
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800c2a60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800c2a60
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800c2a59
mov eax, dword [rsi + 0x2c]
jmp 0x1800c2a5e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800bd9a0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400059d0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
lea rax, [0x1400ae310]
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x20]
mov edx, 0xfa0
mov qword [rsp + 0x38], rax
lea r12, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call fcn.14000cd00
mov rax, qword [rsp + 0x20]
mov rbp, qword [0x1400d4e60]
mov qword [rsp + 0x40], rax
mov rbx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
test rbx, rbx
jle 0x140005bb8
nop word [rax + rax]
mov rax, qword [rsp + 0x48]
mov r9, rsi
mov r8d, 0xfa0
mov edx, 1
lea rcx, [rax + 8]
call sub.msvcrt.dll_fread
mov rbx, rax
cmp rax, 0xfa0
je 0x140005b40
mov rcx, rsi
call sub.msvcrt.dll_ferror
test eax, eax
je 0x140005a87
mov rcx, rsi
call fcn.140005660
mov rcx, rbp
call fcn.14009cf40
cmp byte [rax], 0
jne 0x140005bf0
test rbx, rbx
js 0x140005c10
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140009e00
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.140009b00
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test rbx, rbx
jle 0x140005b18
mov rax, rbx
add rax, 1
jo 0x140005beb
test rax, rax
js 0x140005c2e
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
lea r9, [r8 + rdx + 8]
lea rdx, [rcx + 8]
mov r8, rax
mov rcx, r9
call sub.msvcrt.dll_memcpy
add rbx, qword [rsp + 0x30]
jo 0x140005beb
mov qword [rsp + 0x30], rbx
mov rcx, qword [rsp + 0x48]
nop dword [rax]
test rcx, rcx
je 0x140005b27
test byte [rcx + 7], 0x40
je 0x140005c00
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, rdi
movups xmmword [rdi], xmm0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbp
call fcn.14009cf40
cmp byte [rax], 0
jne 0x140005bf0
mov rdx, qword [rsp + 0x40]
mov rcx, r12
call fcn.140009b00
mov rbx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
test rbx, rbx
jle 0x140005bb8
mov rcx, rbx
add rcx, 1
jo 0x140005bcd
test rcx, rcx
js 0x140005bd8
mov r8, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
add rdx, 8
lea rax, [r8 + rax + 8]
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
add rbx, qword [rsp + 0x30]
jo 0x140005bcd
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jg 0x140005a48
nop dword [rax + rax]
xor ecx, ecx
lea rdx, [rbx - 1]
call fcn.14000bc90
mov rcx, qword [rsp + 0x48]
jmp 0x140005b18
call fcn.140008c20
jmp 0x140005ba5
movabs r8, 0x7fffffffffffffff
xor edx, edx
call fcn.140009260
jmp 0x140005ba5
call fcn.140008c20
mov rcx, qword [rsp + 0x48]
jmp 0x140005b18
call fcn.140008960
jmp 0x140005b27
movabs r8, 0x7fffffffffffffff
mov rcx, rbx
xor edx, edx
call fcn.140009260
mov rcx, qword [rsp + 0x48]
jmp 0x140005b18
movabs r8, 0x7fffffffffffffff
mov rcx, rax
xor edx, edx
call fcn.140009260
mov rcx, qword [rsp + 0x48]
jmp 0x140005b18
Function at 0x140005c50
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
test r8, r8
js 0x140005d40
lea r14, [rsp + 0x20]
mov rdx, r8
mov rcx, r14
call fcn.14000cd00
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rdx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
test rdx, rdx
jle 0x140005d90
mov rax, qword [rsp + 0x38]
mov r9, rsi
mov r8, rbx
mov edx, 1
lea rcx, [rax + 8]
call sub.msvcrt.dll_fread
mov rbp, rax
cmp rbx, rax
je 0x140005cd1
mov rcx, rsi
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x140005d60
mov rcx, qword [0x1400d4e60]
call fcn.14009cf40
cmp byte [rax], 0
mov r12, rax
jne 0x140005d21
mov rcx, rsi
call sub.msvcrt.dll_fgetc
mov rdx, rsi
mov ecx, eax
mov r13d, eax
call sub.msvcrt.dll_ungetc
cmp byte [r12], 0
jne 0x140005d21
test r13d, r13d
jns 0x140005da0
cmp rbx, rbp
jle 0x140005d21
test rbp, rbp
js 0x140005d70
lea rcx, [rsp + 0x30]
mov rdx, rbp
call fcn.140009e00
movdqa xmm0, xmmword [rsp + 0x30]
mov rax, rdi
movups xmmword [rdi], xmm0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
call fcn.140009260
jmp 0x140005d21
mov rcx, rsi
call fcn.140005660
jmp 0x140005cd1
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbp
call fcn.140009260
jmp 0x140005d21
sub rdx, 1
xor ecx, ecx
call fcn.14000bc90
jmp 0x140005d21
mov rdx, rsi
mov rcx, r14
call fcn.1400059d0
cmp byte [r12], 0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jne 0x140005e06
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.140009b00
test rbx, rbx
jle 0x140005e06
mov rcx, rbx
add rcx, 1
jo 0x140005e26
test rcx, rcx
js 0x140005e30
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov r8, rcx
lea rax, [rdx + rax + 8]
lea rdx, [rsi + 8]
mov rcx, rax
call sub.msvcrt.dll_memcpy
add rbx, qword [rsp + 0x30]
jo 0x140005e26
mov qword [rsp + 0x30], rbx
test rsi, rsi
je 0x140005d21
test byte [rsi + 7], 0x40
jne 0x140005d21
mov rcx, rsi
call fcn.140008960
jmp 0x140005d21
call fcn.140008c20
jmp 0x140005e06
movabs r8, 0x7fffffffffffffff
xor edx, edx
call fcn.140009260
jmp 0x140005e06