joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400610c0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14006111e
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x1400610ee
cmp byte [0x1400ed7fd], al
jne 0x1400610fa
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea rdx, str.File_does_not_exist_at__s
mov r8, rsi
mov rax, qword [rax + 8]
call qword [case.0x140049d6d.0]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
mov qword [rsp + 0x40], rbp
mov rcx, rsi
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14006114a
mov bpl, 1
movzx eax, bpl
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [0x1400ed828]
mov dword [rbx], eax
test rdi, rdi
je 0x14006116c
cmp byte [0x1400ed7fd], bpl
jne 0x140061178
call fcn.14005c3a0
mov rdi, qword [0x1400ed828]
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rsi
lea rdx, str.Failed_to_delete_file_at_path:_ls_error:_d
mov r9d, eax
mov rcx, rdi
mov rax, qword [rbx + 8]
call qword [case.0x140049d6d.0]
mov rdi, qword [rsp + 0x48]
movzx eax, bpl
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret

Function at 0x1400611c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1400611d9
add rsp, 0x30
pop rsi
ret
mov rcx, rsi
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140061251
mov qword [rsp + 0x48], rdi
mov rdi, qword [0x1400ed828]
test rdi, rdi
je 0x140061208
cmp byte [0x1400ed7fd], 0
jne 0x140061214
call fcn.14005c3a0
mov rdi, qword [0x1400ed828]
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9, rsi
mov rax, qword [rbx + 0x48]
lea r8, str.Failed_to_get_the_directory_attributes_for____s._Error_is__d.
lea rdx, [0x1400c3148]
mov rcx, rdi
call qword [case.0x140049d6d.0]
mov rdi, qword [rsp + 0x48]
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rsi
ret
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x140061266
cmp byte [0x1400ed7fd], 0
jne 0x140061272
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea rdx, str.The_file_attributes_of_directory____s_is__d
mov r9d, ebx
mov r8, rsi
mov rax, qword [rax + 8]
call qword [case.0x140049d6d.0]
shr ebx, 4
and bl, 1
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rsi
ret
Function at 0x1400626f0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx], 0
mov esi, r9d
mov rbx, r8
mov r14, rdx
mov rdi, rcx
jne 0x140062756
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x140062731
cmp byte [0x1400ed7fd], 0
jne 0x14006273d
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea rdx, str.file_handler_not_initialized
mov rax, qword [rax + 8]
call qword [case.0x140049d6d.0]
jmp 0x140062878
add rcx, 0x18
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140062816
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
xor r14d, r14d
mov r8d, esi
mov rdx, rbx
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
cmp dword [rsp + 0x30], esi
jb 0x1400627a7
test eax, eax
jne 0x140062802
mov dword [rdi + 0x40], 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [0x1400ed828]
mov dword [rdi + 0x44], eax
test rsi, rsi
je 0x1400627cc
cmp byte [0x1400ed7fd], r14b
jne 0x1400627d8
call fcn.14005c3a0
mov rsi, qword [0x1400ed828]
mov rbx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.failed_to_write_data._Error_code____d
mov rcx, rsi
mov r9d, eax
lea rdx, [0x1400c3148]
mov rax, qword [rbx + 0x48]
call qword [case.0x140049d6d.0]
mov ebx, r14d
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 1
jne 0x140062878
movzx eax, bl
jmp 0x14006288a
mov dword [rdi + 0x40], 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [0x1400ed828]
mov dword [rdi + 0x44], eax
test rsi, rsi
je 0x14006283b
cmp byte [0x1400ed7fd], 0
jne 0x140062847
call fcn.14005c3a0
mov rsi, qword [0x1400ed828]
mov rbx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.file_pointer_set_error____d
mov rcx, rsi
mov r9d, eax
lea rdx, [0x1400c3148]
mov rax, qword [rbx + 0x48]
call qword [case.0x140049d6d.0]
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rdi + 0x50]
lea rdx, str.Failed_to_write_the_segment_in_the_file_which_is_to_be_downloaded
call fcn.140002cb0
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140079b50
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400628b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx], 0
mov ebx, r9d
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
jne 0x140062916
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x1400628f1
cmp byte [0x1400ed7fd], 0
jne 0x1400628fd
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea rdx, str.file_handler_to_read_not_initialized
mov rax, qword [rax + 8]
call qword [case.0x140049d6d.0]
jmp 0x140062a34
add rcx, 0x18
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400629d2
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
xor eax, eax
mov r8d, ebx
mov rdx, rbp
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, eax
cmp dword [rsp + 0x30], ebx
jb 0x140062965
test eax, eax
jne 0x1400629bd
mov dword [rdi + 0x40], 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [0x1400ed828]
mov dword [rdi + 0x44], eax
test rsi, rsi
je 0x14006298a
cmp byte [0x1400ed7fd], 0
jne 0x140062996
call fcn.14005c3a0
mov rsi, qword [0x1400ed828]
mov rbx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.failed_to_read_data._Error_code____d
mov rcx, rsi
mov r9d, eax
lea rdx, [0x1400c3148]
mov rax, qword [rbx + 0x48]
call qword [case.0x140049d6d.0]
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebp, 1
jne 0x140062a34
movzx eax, bpl
jmp 0x140062a46
mov dword [rdi + 0x40], 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [0x1400ed828]
mov dword [rdi + 0x44], eax
test rsi, rsi
je 0x1400629f7
cmp byte [0x1400ed7fd], 0
jne 0x140062a03
call fcn.14005c3a0
mov rsi, qword [0x1400ed828]
mov rbx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.file_pointer_set_error____d
mov rcx, rsi
mov r9d, eax
lea rdx, [0x1400c3148]
mov rax, qword [rbx + 0x48]
call qword [case.0x140049d6d.0]
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rdi + 0x50]
lea rdx, str.Failed_to_read_the_segment_from_the_downloaded_file
call fcn.140002cb0
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140079b50
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140064c20
Capabilities:
Read http header

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r14d, r14d
lea rax, [rsp + 0x58]
mov rbp, r8
mov qword [rsp + 0x28], r14
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x100]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x58], r14d
mov esi, edx
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x24
jne 0x140064c7d
cmp eax, 0x2f76
je 0x140064c8c
cmp eax, 0x7a
je 0x140064c93
mov edx, eax
mov rcx, rdi
call fcn.140063f00
xor al, al
jmp 0x140064deb
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x140064cde
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x140064cb0
cmp byte [0x1400ed7fd], r14b
jne 0x140064cbc
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea r8, str.retrieveHeaderFromHttpRequest:_Zero_buffer_required....
lea rdx, [0x1400c3148]
mov rax, qword [rax + 0x48]
call qword [case.0x140049d6d.0]
xor al, al
jmp 0x140064deb
mov rcx, rax
mov qword [rsp + 0x70], rbx
shr rcx, 1
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
lea rdx, [0x1400b4220]
cmovo rax, rcx
mov rcx, rax
call fcn.140079ee8
mov rbx, rax
test rax, rax
jne 0x140064d8d
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x140064d28
cmp byte [0x1400ed7fd], r14b
jne 0x140064d34
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea r8, str.failed_to_allocate_memory
lea rdx, [0x1400c3148]
mov rax, qword [rax + 0x48]
call qword [case.0x140049d6d.0]
mov r8d, 0x18
mov qword [rsp + 0x30], r14
lea rdx, str.Memory_Allocation_Failed
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], r14
call fcn.140003250
xor r8d, r8d
lea r9, [rsp + 0x30]
mov rcx, rdi
lea edx, [r8 + 0x14]
call fcn.140063d50
xor al, al
jmp 0x140064de6
mov rcx, qword [rdi + 0x100]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], r14
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, esi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x140064dd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rdi
call fcn.140063f00
mov rcx, rbx
call fcn.140079b70
xor al, al
jmp 0x140064de6
mov rdx, rbx
mov rcx, rbp
call fcn.140002cb0
mov rcx, rbx
call fcn.140079b70
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140079b50
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140064e10
Capabilities:
Read http header

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x28], 0
mov rdi, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x16]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140064eff
mov r8d, dword [rsp + 0x30]
mov rcx, 0xffffffffffffffff
shr r8, 1
mov eax, 2
mul r8
mov qword [rsp + 0x58], rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140079f1c
mov rcx, qword [rdi]
mov rbx, rax
xor r8d, r8d
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
lea edx, [r8 + 0x16]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x140064ef2
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x140064ecf
cmp byte [0x1400ed7fd], 0
jne 0x140064edb
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea rdx, str.Header_contents:__n_s
mov r8, rbx
mov rax, qword [rax + 0x28]
call qword [case.0x140049d6d.0]
mov rcx, rbx
call fcn.140079b70
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140079b50
add rsp, 0x40
pop rdi
ret
Function at 0x140066220
Capabilities:
Receive http response

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx eax, byte [rcx + 0x38]
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test al, al
je 0x140066381
movzx eax, byte [rcx + 0x48]
test al, al
je 0x140066381
xor eax, eax
lea rdx, [rsp + 0x58]
mov dword [r8], eax
mov rcx, qword [rcx + 0x100]
mov dword [rsp + 0x58], eax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x1400662d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140063f00
mov rdi, qword [0x1400ed828]
test rdi, rdi
je 0x14006629c
cmp byte [0x1400ed7fd], 0
jne 0x1400662a8
call fcn.14005c3a0
mov rdi, qword [0x1400ed828]
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Error__d_in_WinHttpQueryDataAvailable._n
mov rcx, rdi
mov r9d, eax
lea rdx, [0x1400c3148]
mov rax, qword [rbx + 0x48]
call qword [case.0x140049d6d.0]
xor eax, eax
jmp 0x1400663f4
mov ecx, dword [rsp + 0x58]
cmp ecx, dword [rsp + 0xb0]
cmova ecx, dword [rsp + 0xb0]
mov dword [rsp + 0x58], ecx
test ecx, ecx
jne 0x1400662f9
lea eax, [rcx + 2]
jmp 0x1400663f4
mov r8d, ecx
xor edx, edx
mov rcx, qword [rsi]
call fcn.14007cb40
mov r8d, dword [rsp + 0x58]
mov r9, rdi
mov rdx, qword [rsi]
mov rcx, qword [rbx + 0x100]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x140066374
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x140066336
cmp byte [0x1400ed7fd], al
jne 0x140066342
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea r8, str.Error__u_in_WinHttpReadData._n
lea rdx, [0x1400c3148]
mov rax, qword [rax + 0x48]
call qword [case.0x140049d6d.0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140063f00
xor eax, eax
jmp 0x1400663f4
mov eax, dword [rsp + 0x58]
neg eax
sbb eax, eax
add eax, 2
jmp 0x1400663f4
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x140066396
cmp byte [0x1400ed7fd], 0
jne 0x1400663a2
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea rdx, str.downloader_is_not_initialized
mov rax, qword [rax + 8]
call qword [case.0x140049d6d.0]
xor eax, eax
lea rdx, [0x1400c3148]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.140003250
xor r8d, r8d
lea r9, [rsp + 0x30]
mov rcx, rbx
lea edx, [r8 + 0x13]
call fcn.140063d50
mov eax, 3
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140079b50
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140067840
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx], 0
mov rdi, rcx
mov esi, edx
jne 0x140067896
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x140067869
cmp byte [0x1400ed7fd], 0
jne 0x140067875
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea rdx, str.AAMDFileManager:_unintialized._Invalid_params
mov rax, qword [rax + 0x28]
call qword [case.0x140049d6d.0]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9d, r8d
mov qword [rsp + 0x30], rbx
lea r8, str._20lu_n
mov edx, 0x1f
add rcx, 0x178
call fcn.140018a90
imul rdx, rsi, 0x15
lea rcx, [rdi + 8]
mov r9d, eax
add rdx, 0x12
lea r8, [rdi + 0x178]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400626f0

Function at 0x140069f20
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [rcx + 8]
mov rbx, rcx
test al, al
jne 0x140069f6c
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x140069f54
cmp byte [0x1400ed7fd], al
jne 0x140069f60
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
lea r8, str.Thread_is_not_initialized__so_it_cannot_run
jmp 0x14006a011
cmp qword [rcx + 0x40], 0
mov dword [rcx + 0x60], 1
je 0x140069fbb
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x140069f8f
cmp byte [0x1400ed7fd], 0
jne 0x140069f9b
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea rdx, str.thread___d__is_already_running._Closing_it_first
mov r8d, dword [rbx + 0x64]
mov rax, qword [rax + 8]
call qword [case.0x140049d6d.0]
mov rcx, rbx
call fcn.14006a2f0
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140069c00]
xor edx, edx
mov dword [rsp + 0x20], 4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x40], rax
test rax, rax
jne 0x14006a03a
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x140069ffe
cmp byte [0x1400ed7fd], al
jne 0x14006a00a
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
lea r8, str.failed_to_create_a_new_thread._Fatal_Error
mov rax, qword [rcx]
lea rdx, [0x1400c3148]
mov rax, qword [rax + 0x48]
call qword [case.0x140049d6d.0]
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140079b50
add rsp, 0x40
pop rbx
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x14006a0ab
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x14006a05d
cmp byte [0x1400ed7fd], 0
jne 0x14006a069
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea r8, str.thread_failed_to_resumed._fatal_error
lea rdx, [0x1400c3148]
mov rax, qword [rax + 0x48]
call qword [case.0x140049d6d.0]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov qword [rbx + 0x40], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140079b50
add rsp, 0x40
pop rbx
ret
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x64], eax
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140079b50
add rsp, 0x40
pop rbx
ret
Function at 0x14006a2f0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
movzx eax, byte [rcx + 8]
mov rbx, rcx
test al, al
je 0x14006a4a3
mov dword [rcx + 0x60], 2
add rcx, 0x18
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14006a414
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140049d6d.0]
mov rax, qword [rbx + 0x48]
xor edi, edi
cmp dword [rax + 0xc], 3
je 0x14006a414
nop word [rax + rax]
cmp dword [rax + 0xc], 5
je 0x14006a414
inc edi
cmp edi, 0x12c
jne 0x14006a3b4
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x14006a379
cmp byte [0x1400ed7fd], 0
jne 0x14006a385
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rdx, qword [rbx + 0x48]
mov rax, qword [rcx]
mov r8d, dword [rdx + 8]
lea rdx, str.forcing_the_job___d__to_terminate.
mov rax, qword [rax + 0x28]
call qword [case.0x140049d6d.0]
mov rcx, qword [rbx + 0x48]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x140049d6d.0]
jmp 0x14006a3bc
cmp edi, 0x3e8
je 0x14006a3d7
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 0x48]
cmp dword [rax + 0xc], 3
jne 0x14006a350
jmp 0x14006a414
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x14006a3ec
cmp byte [0x1400ed7fd], 0
jne 0x14006a3f8
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rdx, qword [rbx + 0x48]
mov rax, qword [rcx]
mov r8d, dword [rdx + 8]
lea rdx, str.job___d__is_still_not_terminated._Closing_the_thread_handle_now
mov rax, qword [rax + 0x28]
call qword [case.0x140049d6d.0]
lea rcx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx + 0x40]
mov rsi, qword [rsp + 0x40]
test rcx, rcx
je 0x14006a497
mov edx, 0x61a8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test eax, eax
je 0x14006a485
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x14006a452
cmp byte [0x1400ed7fd], 0
jne 0x14006a45e
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea rdx, str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged._Error____d
mov r8d, dword [rbx + 0x64]
mov r9d, edi
mov rax, qword [rax + 0x28]
call qword [case.0x140049d6d.0]
mov rcx, qword [rbx + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x40], 0
mov rdi, qword [rsp + 0x48]
mov dword [rbx + 0x60], 3
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1400708e0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140070902
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140070983
mov rdi, r14
mov rcx, rbx
call fcn.14001de10
test rax, rax
jle 0x140070954
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14007c470
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140070973
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x140049d6d.0]
cmp eax, 0xffffffff
je 0x14007097b
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140070916
sub r14, rdi
jmp 0x140070a61
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14007099a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14007099c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400709ce
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14007c470
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140070a5e
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140070a09
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140070a3f
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140090eb4
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140070a5e
cmp rbp, rax
ja 0x140070a12
test rbp, rbp
je 0x140070a5e
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140090eb4
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x14007ac14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007ac5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007ac5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007ac5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007ac5e
cmp dword [rcx + 0x84], 0xe
jbe 0x14007ac5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007ac60
xor al, al
add rsp, 0x28
ret

Function at 0x140081138
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140080fa3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140080fa3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140080fa3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140080fa3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140080fa3
cmp dword [rcx + 0x84], 0xe
jbe 0x140080fa3
cmp dword [rcx + 0xf8], 0
je 0x140080fa3
mov ecx, ebx
call fcn.140081054
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140080e30
nop
cmp dword [rbp + 0x20], 0
je 0x140080ff1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140080ffc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140080f34