joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f8930
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x1b0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r14, rdx
mov ebp, ecx
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.1800f9060
nop
cmp byte [0x180131281], 0
je 0x1800f8a60
mov byte [rsp + 0x90], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rsp + 0x91]
call sub.MSVCR120.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp qword [r14 + 0x18], 0x10
jb 0x1800f89c4
mov r15, qword [r14]
jmp 0x1800f89c7
mov r15, r14
lea rsi, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rsi, qword [rsp + 0x68]
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov r9d, ebx
lea rdx, str.__d._d._s._s___s_n
lea rcx, [rsp + 0x48]
call fcn.1800f97e0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp qword [rsp + 0x60], 0x10
jb 0x1800f8a49
mov rcx, qword [rsp + 0x48]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x60], 0xf
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x48], 0
mov rcx, qword [0x180131288]
test rcx, rcx
jne 0x1800f8aa2
mov ecx, 0x28
call sub.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [0x180131288], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x180131288]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.1801008f0
mov r8, qword [rax]
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [r8 + 0x40]
test rax, rax
jne 0x1800f8aca
xor edx, edx
xor ecx, ecx
call fcn.1800f8550
mov rcx, qword [0x180131288]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.1801008f0
mov rbx, rax
cmp qword [r14 + 0x10], 0
je 0x1800f8b36
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
cmp ebp, eax
jg 0x1800f8b36
test ebp, ebp
je 0x1800f8b2a
dec ebp
je 0x1800f8b1d
dec ebp
je 0x1800f8b10
dec ebp
jne 0x1800f8b36
mov rdx, r14
mov rcx, rbx
call fcn.1801006d0
jmp 0x1800f8b36
mov rdx, r14
mov rcx, rbx
call fcn.180100f70
jmp 0x1800f8b36
mov rdx, r14
mov rcx, rbx
call fcn.1801009d0
jmp 0x1800f8b36
mov rdx, r14
mov rcx, rbx
call fcn.1801001e0
nop
cmp qword [rsp + 0x80], 0x10
jb 0x1800f8b4b
mov rcx, qword [rsp + 0x68]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.180106980
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1800f9b50
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rax, qword [0x180127050]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
call fcn.1800f9da0
cmp qword [rbx + 0x18], 8
jb 0x1800f9b8c
mov rcx, qword [rbx]
jmp 0x1800f9b8f
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne dil
cmp qword [rbx + 0x18], 8
jb 0x1800f9baa
mov rcx, qword [rbx]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rbx + 0x18], 7
xor eax, eax
mov qword [rbx + 0x10], rax
mov word [rbx], ax
movzx eax, dil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180106980
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180106030
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1801313f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x18010609c
lea ecx, [rax + 0x20]
mov qword [rsp + 0x20], rbx
call sub.MSVCR120.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x180106064
mov rcx, rax
call fcn.1801058d0
mov rbx, rax
jmp 0x180106066
xor ebx, ebx
mov ecx, dword [0x1801313f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180106085
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov ecx, dword [0x1801313f0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x140002380
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000e580]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400023a0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1400023a8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x1400023c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000e580]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400023e0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1400023e8
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400023e0
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x1400023e0
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002424
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002438
add rax, 0x28
cmp r9, rax
jne 0x140002410
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x140002450
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14000e580]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002472
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002480
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002472
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002472
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x140002472
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400024cd
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400024e0
add rdx, 0x28
cmp r10, rdx
jne 0x1400024b8
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400024ef
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400024ff
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400024d6
test ecx, ecx
jg 0x1400024e8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret

Function at 0x140003b70
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14000e600]
mov rax, qword [rsi]
test rax, rax
je 0x140003c00
cmp qword [rax + 0x30], 0
jne 0x140003c20
lea rbx, [0x14000d308]
mov qword [rax + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [rsi]
test rax, rax
je 0x140003bd0
cmp qword [rax + 0x30], 0
jne 0x140003bf0
lea rdx, [0x14000d308]
mov qword [rax + 0x30], rdx
mov rax, rdx
cmp dword [rax], 0xffffffff
je sym.pthread_tls_init.cold
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x140003bb2
test rax, rax
jne 0x140003bf0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rax, qword [rax + 0x30]
jmp 0x140003bc0
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x140003b90
test rax, rax
jne 0x140003c20
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rbx, qword [rax + 0x30]
jmp 0x140003b9b
Function at 0x1400077f0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14000e600]
mov rax, qword [rbx]
mov r12, rcx
mov esi, edx
test rax, rax
je 0x1400078c0
cmp qword [rax + 0x60], 0
jne 0x1400078e0
lea rcx, [0x14000d2f8]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_lock
mov rcx, r12
call sym.__pthread_get_pointer
test rax, rax
je 0x1400078f0
cmp qword [rax + 0x1d8], r12
jne 0x1400078f0
test byte [rax + 0x40], 0xc
jne 0x1400078f0
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x1400078f0
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x1400078f0
mov rax, qword [rbx]
test rax, rax
je 0x140007950
cmp qword [rax + 0x60], 0
jne 0x140007970
lea rcx, [0x14000d2f8]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
test esi, esi
je 0x140007980
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x140007988
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
jmp sym.pthread_cancel
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x14000781b
test rax, rax
jne 0x1400078e0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007826
mov rax, qword [rbx]
test rax, rax
je 0x140007920
cmp qword [rax + 0x60], 0
jne 0x140007940
lea rcx, [0x14000d2f8]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rbx]
cmp qword [r8 + 0x60], 0
je 0x1400078ff
test rax, rax
jne 0x140007940
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x14000790a
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x14000788a
test rax, rax
jne 0x140007970
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007895
xor eax, eax
jmp 0x140007914
mov eax, 0x16
jmp 0x140007914
Function at 0x14002fe60
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x14002fea6
mov r14, r12
test r14, r14
je 0x14002ffa8
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x14002ff08
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x14002fef4
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1400b56c0
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x14002fe82
mov rax, r12
sub rax, r15
sar rax, 2
cmp r12, r15
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x14002ffce
lea rcx, [r13*8]
call fcn.1400b2768
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, r12
mov r14, rcx
sub rdx, rbx
je 0x14002ff6e
lea r14, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x14002ffa8
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x14002ff56
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], rdx
cmp r12, rbx
je 0x14002ff8e
add r12, 0xfffffffffffffff8
jne 0x14002ff81
jmp 0x14002ffbb
test r15, r15
je 0x14002fe82
mov rcx, r15
call fcn.1400b27a4
mov r14, qword [rsi + 0x10]
jmp 0x14002fe82
lea rcx, [0x14016425a]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
call fcn.1400eae10
lea rcx, [0x14016425a]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.1400eae10
call fcn.1400e8640
int3

Function at 0x140036de0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x14018f028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea r8, [rsp + 0x38]
mov dword [r8], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140036e68
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x140036e52
cmp dword [rsp + 0x38], 4
jne 0x140036e52
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b3c20
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x140036e52
Function at 0x140036e70
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.1400b3bc0
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14018f028]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.1400b5d70
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140036f23
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x140036f27
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.140036780
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400b3c20
mov eax, edi
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edi, eax
jmp 0x140036f04
cmp eax, 2
jne 0x140036f6f
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.1400b5d70
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x140036f76
lea rdx, [rsp + 0x40]
jmp 0x140036efa
mov edi, 0x3f4
jmp 0x140036f04
mov edi, 0xea
jmp 0x140036f04

Function at 0x1400376e0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x140037727
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140037741
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14003771f
mov qword [rsi], rdi
call fcn.140089ca0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x140037757
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.140089ca0
mov rcx, qword [rsi]
call fcn.14007df20
mov qword [rsi], 0
jmp 0x14003770d
int3

Function at 0x140037790
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r14, qword [rdx]
mov qword [rdx], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x1400377ba
call fcn.140089ca0
cmp qword [rsi], r14
je 0x1400377e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003780e
cmp r15, 2
jb 0x1400377e1
mov qword [rsi], r14
call fcn.140089ca0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rdi + 8]
mov byte [rsi + 8], al
mov byte [rdi + 8], 0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140037824
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140089ca0
mov rcx, qword [rsi]
call fcn.14007df20
mov qword [rsi], 0
jmp 0x1400377d3
mov rcx, rdi
call fcn.140079a10
jmp 0x1400377ff
Function at 0x1400389c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14018f028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [0x140164170]
lea r14, [rsp + 0x50]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, [0x140170cfc]
lea r15, [rsp + 0x30]
mov rcx, r15
mov r9d, 0xa5
call fcn.140089c80
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400806a0
test esi, esi
js 0x140038ac6
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.140091b50
test al, al
jne 0x140038acd
lea r14, [rsp + 0x2c]
mov dword [r14], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [r14]
lea rcx, [rsp + 0x30]
call fcn.1400920e0
lea rcx, [rsp + 0x50]
call fcn.140080720
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400b3c20
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x140038a9b
mov r9d, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1401296a0
jmp 0x140038a60

Function at 0x140038af0
Capabilities:
Get file size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x14018f028]
xor rax, rsp
mov qword [rsp + 0x90], rax
movabs r14, 0xaaaaaaaaaaaaaaaa
movaps xmm0, xmmword [0x140164170]
lea rdi, [rsp + 0x50]
movaps xmmword [rdi + 0x30], xmm0
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
lea rdx, str.GetLength
lea r8, [0x140170cfc]
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r9d, 0xba
call fcn.140089c80
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400806a0
mov qword [rbx + 8], r14
mov qword [rbx], 0
call fcn.140091b50
test al, al
jne 0x140038bcc
lea rdi, [rsp + 0x28]
mov qword [rdi], r14
mov rcx, qword [rsi]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.1400920e0
lea rcx, [rsp + 0x50]
call fcn.140080720
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400b3c20
mov rax, rsi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
xor r9d, r9d
call fcn.1401296a0
jmp 0x140038b79
Function at 0x140038bf0
Capabilities:
Clear file content

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14018f028]
xor rax, rsp
mov qword [rsp + 0x98], rax
movabs r15, 0xaaaaaaaaaaaaaaaa
movaps xmm0, xmmword [0x140164170]
lea rbx, [rsp + 0x50]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.SetLength
lea r8, [0x140170cfc]
lea r14, [rsp + 0x30]
mov rcx, r14
mov r9d, 0xc7
call fcn.140089c80
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.1400806a0
mov qword [r14 + 8], r15
mov qword [r14], 0
call fcn.140091b50
test al, al
jne 0x140038d18
lea r8, [rsp + 0x28]
mov qword [r8], r15
mov rcx, qword [rsi]
xor ebx, ebx
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140038cdf
mov rcx, qword [rsi]
xor ebx, ebx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140038cdf
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140038d14
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsi]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
lea rcx, [rsp + 0x30]
call fcn.1400920e0
lea rcx, [rsp + 0x50]
call fcn.140080720
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400b3c20
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x140038cdf
lea rdx, str.File::SetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
mov r9, rdi
call fcn.1401296a0
jmp 0x140038c82
Function at 0x140038e40
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14018f028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [0x140164170]
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
lea rdx, str.DoInitialize
lea r8, [0x140170cfc]
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x17f
call fcn.140089c80
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400806a0
mov eax, ebx
and eax, 1
neg eax
and eax, 3
test bl, 2
mov edx, 1
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov r8d, 2
cmove r8d, edx
test bl, 0x10
mov eax, 5
cmove eax, r8d
test eax, eax
je 0x1400390ac
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov r8d, ebx
rol r8d, 0x1a
and r8d, 0x80000100
or r8d, ecx
bt ebx, 0x12
jb 0x14003909a
mov edx, ebx
shr edx, 4
and edx, 0x10000
or edx, r8d
mov ecx, ebx
shr ecx, 8
and ecx, 3
mov r8d, ebx
shr r8d, 0xd
and r8d, 4
or r8d, ecx
xor r8d, 3
mov r15d, ebx
and r15d, 0x400
mov ecx, r15d
shl ecx, 0x14
mov r9d, ebx
shr r9d, 3
and r9d, 0x100
or r9d, ecx
mov ecx, ebx
shr ecx, 0xb
and ecx, 2
or ecx, r9d
mov r10d, ebx
shl r10d, 0xd
and r10d, 0x4000000
or r10d, ecx
mov r9d, ebx
shl r9d, 8
and r9d, 0xa000000
or r9d, r10d
cmp byte [rdi + 0x17], 0
mov rcx, rdi
jns 0x140038fa3
mov rcx, qword [rdi]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x30], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp qword [rsi], rax
je 0x140038ffd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x140039066
mov rax, r14
inc rax
cmp rax, 2
jb 0x140038ff2
mov qword [rsi], r14
call fcn.140089ca0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r14, qword [rsi]
inc r14
cmp r14, 2
jb 0x140039054
shr r15d, 0xa
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x29], r15b
test bl, 4
jne 0x14003907f
test bl, 0xa
je 0x140039023
mov byte [rsi + 0x28], 1
bt ebx, 0x15
jb 0x140039090
lea rcx, [rsp + 0x60]
call fcn.140080720
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400b3c20
nop
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140038d40
mov dword [rsi + 0x24], eax
jmp 0x140039029
call fcn.140089ca0
mov rcx, qword [rsi]
call fcn.14007df20
mov qword [rsi], 0
jmp 0x140038fde
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne byte [rsi + 0x28]
jmp 0x140039023
mov rcx, rdi
call fcn.14003a690
jmp 0x140039029
bt ebx, 0x15
jb 0x1400390c8
or r8d, 0x20000000
jmp 0x140038f21
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 0x24], 0xffffffff
call fcn.140109a40
jmp 0x140039029
int3