joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016760
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x160], rax
movzx edi, dx
mov rsi, rcx
test r9, r9
je 0x140016876
mov edx, 1
mov rcx, r9
call fcn.14002a380
mov rbx, rax
test rax, rax
jne 0x1400167b0
lea eax, [rbx + 9]
jmp 0x1400168a0
mov rcx, qword [rax]
lea r9, [rsp + 0x34]
mov r8d, 0x12
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140016801
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x1400167ef
mov eax, eax
lea rcx, [0x140030680]
mov ecx, dword [rcx + rax*4]
jmp 0x1400167f4
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
mov rcx, rbx
call fcn.14002a1e0
cmp dword [rsp + 0x34], 0x12
je 0x14001681a
mov eax, 2
jmp 0x1400168a0
cmp byte [rsp + 0x40], 1
jne 0x1400168c5
cmp byte [rsp + 0x41], 0xb
jne 0x1400168c5
movzx eax, word [rsp + 0x48]
mov ecx, 0x534d
cmp ax, cx
je 0x140016876
lea r8, [rsp + 0x30]
mov word [rsp + 0x30], ax
lea rdx, str.WTsp_s.dll
mov byte [rsp + 0x32], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
movzx r8d, di
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016b00
test ax, ax
je 0x1400168a0
lea r8, str.WTLI.dll
lea rdx, [0x140030a5c]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
movzx r8d, di
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140016b00
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14002c160
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov eax, 0x14
jmp 0x1400168a0
Function at 0x1400168d0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x1a0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbp, rcx
xor r14d, r14d
test r8, r8
je 0x140016912
mov rdx, qword [r8 + 8]
jmp 0x140016915
mov rdx, r14
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x10
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001696e
mov word [rax], r14w
mov qword [rax + 8], r14
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x140016971
inc eax
movsxd rcx, eax
call qword [sym.imp.mfc140u.dll_operator_1]
mov qword [rbx + 8], rax
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x140016971
mov rbx, r14
mov edx, 1
mov rcx, rbx
call fcn.14002a380
mov rdi, rax
test rax, rax
jne 0x140016997
mov eax, 9
mov word [rbp + 0x150], ax
jmp 0x140016ad7
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov r8d, 0x12
lea rdx, [rsp + 0x40]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400169e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x1400169d2
mov eax, eax
lea rcx, [0x140030680]
mov ecx, dword [rcx + rax*4]
jmp 0x1400169d7
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
cmp dword [rsp + 0x30], 0x12
je 0x1400169fc
mov eax, 2
mov word [rbp + 0x150], ax
jmp 0x140016ad7
mov rcx, rdi
call fcn.14002a1e0
test rbx, rbx
je 0x140016a25
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140016a18
call qword [sym.imp.mfc140u.dll_operator]
mov edx, 0x10
mov rcx, rbx
call fcn.14002c9cc
cmp byte [rsp + 0x50], 0x57
jne 0x140016a37
cmp byte [rsp + 0x51], 0x50
je 0x140016ac7
mov edi, r14d
lea rax, [rsp + 0x60]
cmp byte [rsp + 0x60], dil
je 0x140016a5b
nop word [rax + rax]
lea rax, [rax + 1]
inc edi
cmp byte [rax], 0
jne 0x140016a50
movzx eax, di
lea rsi, [rsp + 0x60]
add rsi, rax
lea rbx, [rsi - 0xa]
cmp rbx, rsi
jae 0x140016a88
nop
movzx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_islower]
test eax, eax
je 0x140016a80
add byte [rbx], 0xe0
inc rbx
cmp rbx, rsi
jb 0x140016a70
movzx eax, di
sub eax, 0xa
movsxd rcx, eax
lea rax, [rsp + 0x60]
add rcx, rax
mov r8d, 4
lea rdx, [0x140030a60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strnicmp]
mov edx, 0x5053
xor r9d, r9d
mov rcx, rbp
call fcn.140016760
test ax, ax
jne 0x140016ac7
movzx eax, r14w
jmp 0x140016ad7
xor r9d, r9d
mov edx, 0x5053
mov rcx, rbp
call fcn.140016760
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14002c160
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14001ae30
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x30]
lea rax, [rsp + 0x30]
sub rcx, rax
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14001ae70
mov ecx, 0x10
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov rbx, rax
mov qword [rsp + 0x28], rax
xor edi, edi
test rax, rax
je 0x14001aecd
mov word [rax], di
mov qword [rax + 8], rdi
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x14001aed0
inc eax
movsxd rcx, eax
call qword [sym.imp.mfc140u.dll_operator_1]
mov qword [rbx + 8], rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x14001aed0
mov rbx, rdi
mov edx, 1
mov rcx, rbx
call fcn.14002a380
mov rsi, rax
test rax, rax
jne 0x14001aefb
mov dword [0x14003e168], edi
mov word [0x14003e1c0], di
mov word [0x14003e1bc], di
jmp 0x14001af43
test rbx, rbx
je 0x14001af1c
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001af0f
call qword [sym.imp.mfc140u.dll_operator]
mov edx, 0x10
mov rcx, rbx
call fcn.14002c9cc
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x14003e168], eax
mov word [0x14003e1c0], di
mov word [0x14003e1bc], di
mov rcx, rsi
call fcn.14002a1e0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002c160
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400239e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x458
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
mov rsi, rdx
xor ecx, ecx
lea rdx, [0x140033178]
lea r8d, [rcx + 0x32]
call qword [0x140041ab0]
test ax, ax
je 0x140023a24
mov eax, 6
jmp 0x140023b06
mov qword [rsp + CGlobalUtils::~CGlobalUtils], rbx
mov qword [rsp + 0x488], rbp
xor ebp, ebp
mov qword [rsp + CDialog::~CDialog], r14
lea r14, [0x140030680]
nop word [rax + rax]
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
mov r8d, 0x400
mov qword [rsp + 0x20], rbp
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140023a97
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140023a85
mov eax, eax
mov ecx, dword [r14 + rax*4]
jmp 0x140023a8a
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], bpl
mov ebx, dword [rsp + 0x30]
lea r9, [rsp + 0x34]
mov rcx, qword [rsi]
lea rdx, [rsp + 0x40]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140023adf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140023acd
mov eax, eax
mov ecx, dword [r14 + rax*4]
jmp 0x140023ad2
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], bpl
cmp ebx, 0x400
je 0x140023a50
mov r14, qword [rsp + 0x450]
movzx eax, bp
mov rbp, qword [rsp + 0x488]
mov rbx, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14002c160
add rsp, 0x458
pop rdi
pop rsi
ret
Function at 0x140023b20
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov word [rsp + 0x20], r9w
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov r14, rcx
mov rcx, qword [rcx]
xor edx, edx
mov r15, r8
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [r14]
xor r9d, r9d
xor r8d, r8d
mov esi, eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r12, [0x140030680]
mov ebx, operator
inc eax
test eax, 0xfffffffe
jne 0x140023b95
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140023b86
mov eax, eax
mov ecx, dword [r12 + rax*4]
jmp 0x140023b88
mov ecx, ebx
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi], rax
test rax, rax
jne 0x140023bbd
mov eax, 4
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [r14]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x60], rbp
mov r8d, esi
xor ebp, ebp
mov rdx, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140023bff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140023bf2
mov eax, eax
mov ebx, dword [r12 + rax*4]
mov dword [0x140042de8], ebx
mov byte [0x1400433b0], bpl
mov eax, dword [rsp + 0x78]
mov dword [r15], eax
mov rcx, qword [rdi]
cmp word [rcx], bp
je 0x140023c1e
nop
not byte [rcx]
not byte [rcx + 1]
lea rcx, [rcx + 2]
cmp word [rcx], bp
jne 0x140023c10
mov rbx, qword [rsp + 0x68]
movzx eax, bp
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400248b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x470
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r14, r8
movzx esi, dx
mov rbp, rcx
call fcn.140024a30
test ax, ax
je 0x1400248eb
mov eax, 0x64
jmp 0x140024a11
mov qword [rsp + 0x468], rbx
mov ebx, 0xa
mov qword [rsp + 0x458], r12
lea r12, [0x140030680]
mov qword [rsp + CDialog::~CDialog], r15
xor r15d, r15d
mov qword [rsp + CDockingPanesRow::~CDockingPanesRow], rdi
nop word [rax + rax]
inc bx
cmp bx, 0x64
jbe 0x14002492d
movzx ebx, r15w
xor ecx, ecx
lea rdx, [0x140033178]
movzx r8d, bx
call qword [0x140041ab0]
test ax, ax
jne 0x1400249ec
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
lea r8, [rsp + 0x40]
movzx edx, si
mov rcx, rbp
call fcn.140024cd0
mov edi, eax
test sil, 0x10
jne 0x14002498f
lea rcx, [rsp + 0x40]
cmp word [rsp + 0x40], r15w
je 0x14002498f
not byte [rcx]
not byte [rcx + 1]
lea rcx, [rcx + 2]
cmp word [rcx], r15w
jne 0x140024980
mov rcx, qword [r14]
lea r9, [rsp + 0x30]
mov r8d, eax
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400249d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x1400249c1
mov eax, eax
mov ecx, dword [r12 + rax*4]
jmp 0x1400249c6
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], r15b
cmp edi, 4
jg 0x140024920
cmp edi, 0xffffffff
jne 0x1400249e6
lea eax, [rdi + 0x65]
jmp 0x1400249f1
movzx eax, r15w
jmp 0x1400249f1
mov eax, 6
mov rdi, qword [rsp + 0x460]
mov r12, qword [rsp + 0x458]
mov rbx, qword [rsp + 0x468]
mov r15, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14002c160
add rsp, 0x470
pop r14
pop rsi
pop rbp
ret
Function at 0x140025300
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
lea r9, [rsp + 0x40]
mov ebx, 1
xor edi, edi
mov r8d, ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140025356
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140025344
mov eax, eax
lea rcx, [0x140030680]
mov ecx, dword [rcx + rax*4]
jmp 0x140025349
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], dil
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x14002537e
cmp ecx, ebx
je 0x140025370
or eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
movzx eax, di
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
movzx eax, bx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140025430
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov eax, 0xf0
xor r15d, r15d
mov r14, rcx
cmp dx, ax
jae 0x14002555d
mov ebx, 1
mov r8d, ebx
mov edx, ebx
call fcn.14002a520
mov rcx, qword [r14]
lea r9, [rsp + 0x70]
mov r8d, ebx
mov qword [rsp + 0x20], r15
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rdi, [0x140000000]
mov esi, operator
test eax, eax
jne 0x1400254b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x1400254a4
mov eax, eax
mov ecx, dword [rdi + rax*4 + 0x30680]
jmp 0x1400254a6
mov ecx, esi
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], r15b
mov ecx, dword [rsp + 0x70]
test ecx, ecx
je 0x140025546
cmp ecx, ebx
je 0x1400254da
or ecx, 0xffffffff
movzx eax, cx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [r14]
lea r9, [rsp + 0x70]
movzx ebp, byte [rsp + 0x68]
lea rdx, [rsp + 0x68]
mov r8d, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002551f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140025512
mov eax, eax
mov esi, dword [rdi + rax*4 + 0x30680]
mov dword [0x140042de8], esi
mov byte [0x1400433b0], r15b
mov ecx, dword [rsp + 0x70]
test ecx, ecx
je 0x140025546
cmp ecx, ebx
jne 0x1400254c3
movzx eax, byte [rsp + 0x68]
mov ecx, 0x100
mov edx, eax
mov r8d, ebx
imul edx, ecx
sub dx, 4
add dx, bp
jmp 0x140025593
movzx ecx, bx
movzx eax, cx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov eax, 0xf5
or ecx, 0xffffffff
cmp dx, ax
ja 0x14002557e
movzx eax, dx
lea rdi, [0x140000000]
movzx edx, byte [rax + rdi + 0x3034a]
jmp 0x140025580
mov edx, ecx
movsx eax, dx
cmp eax, 0xffff
je 0x140025549
mov r8d, 1
dec dx
movzx edx, dx
mov rcx, r14
call fcn.14002a520
mov rbx, qword [rsp + 0x60]
movzx eax, r15w
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400255c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov word [rsp + 0x10], dx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rcx
lea r14, [0x140030680]
xor edi, edi
mov esi, 1
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx]
lea r9, [rsp + 0x50]
mov r8d, esi
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140025634
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140025622
mov eax, eax
mov ecx, dword [r14 + rax*4]
jmp 0x140025627
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], dil
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x14002568d
cmp ecx, esi
jne 0x14002567c
movzx eax, byte [rsp + 0x58]
cmp al, 0xf1
je 0x14002566b
cmp al, 0xd0
jb 0x1400255f0
movzx edx, al
mov rcx, rbx
call fcn.140025430
test ax, ax
je 0x1400255f0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
movzx eax, di
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
movzx eax, si
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140026d80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
mov dword [rsp + 0x40], 0x435057ff
mov word [rsp + 0x4e], cx
lea r9, [rsp + 0x30]
mov word [rsp + 0x58], cx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r8d, 0x200
mov rcx, qword [rbx]
mov dword [rsp + 0x44], 0x200
mov word [rsp + 0x48], 0xa01
mov dword [rsp + 0x4a], 2
mov qword [rsp + 0x50], 0x20002
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140026e31
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140026e1f
mov eax, eax
lea rcx, [0x140030680]
mov ecx, dword [rcx + rax*4]
jmp 0x140026e24
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002c160
add rsp, 0x250
pop rbx
ret
Function at 0x140026e50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x250
mov rax, qword [0x14003c008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
xor r9d, r9d
mov rcx, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r14, [0x140030680]
mov ebx, operator
inc eax
test eax, 0xfffffffe
jne 0x140026ec0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140026eb1
mov eax, eax
mov ecx, dword [r14 + rax*4]
jmp 0x140026eb3
mov ecx, ebx
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
mov r8d, 0x200
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140026f08
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140026ef9
mov eax, eax
mov ecx, dword [r14 + rax*4]
jmp 0x140026efb
mov ecx, ebx
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
cmp dword [rsp + 0x30], 0x200
je 0x140026f1c
mov eax, 0x6a
jmp 0x140026fd6
xor edx, edx
mov qword [rsp + 0x268], rsi
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.14002a520
mov rcx, qword [rdi]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
lea ecx, [rax + 1]
test ecx, 0xfffffffe
jne 0x140026f75
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140026f66
mov ecx, eax
mov edx, dword [r14 + rcx*4]
jmp 0x140026f68
mov edx, ebx
mov dword [0x140042de8], edx
mov byte [0x1400433b0], 0
xor r8d, r8d
mov dword [rsp + 0x54], esi
xor edx, edx
mov rcx, rdi
call fcn.14002a520
mov rcx, qword [rdi]
lea r9, [rsp + 0x30]
mov r8d, 0x200
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rsi, qword [rsp + 0x268]
test eax, eax
jne 0x140026fd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140026fc5
mov eax, eax
mov ebx, dword [r14 + rax*4]
mov dword [0x140042de8], ebx
mov byte [0x1400433b0], 0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002c160
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140028200
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov r8, qword [r8 + 0x10]
mov r15, r9
mov rdx, qword [rdx + 0x10]
mov r12, rcx
call qword [0x140042648]
mov r13, qword [rsp + 0x88]
mov word [r13], ax
test ax, ax
jne 0x140028404
movzx eax, word [rsp + 0x80]
imul r8, rax, 0x58
mov qword [rsp + 0x68], r8
nop dword [rax]
mov rax, qword [rbp + 8]
mov rdx, qword [r14 + 8]
mov ecx, dword [rax + 4]
add dword [rdx + 4], ecx
mov rax, qword [0x140041cc8]
movzx r9d, word [r8 + rax + 0x52]
lea rdi, [r8 + rax]
mov r8, qword [r8 + rax + 0x30]
movzx eax, r9w
lea r10, [r9 + r8]
mov qword [rdi + 0x18], r10
test r9w, r9w
je 0x1400282b7
movzx edx, word [rdi + 0x38]
add ax, 8
cmp ax, dx
jae 0x1400282b7
movzx ecx, ax
movzx eax, word [r10]
add ecx, eax
movzx eax, dx
cmp ecx, eax
jl 0x1400283b5
add dword [rdi + 8], r9d
mov eax, dword [rdi + 0xc]
mov edx, dword [rdi + 8]
sub eax, edx
movzx ebx, word [rdi + 0x38]
cmp ebx, eax
jb 0x1400282d2
movzx ebx, word [rdi + 0xc]
sub bx, dx
test bx, bx
je 0x140028400
mov rcx, qword [rdi]
xor r9d, r9d
mov word [rdi + 0x38], bx
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
lea ecx, [rax + 1]
test ecx, 0xfffffffe
jne 0x140028329
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140028317
mov ecx, eax
lea rax, [0x140030680]
mov edx, dword [rax + rcx*4]
jmp 0x14002831c
mov edx, operator
mov dword [0x140042de8], edx
mov byte [0x1400433b0], 0
cmp esi, 0xffffffff
je 0x1400283f9
mov rcx, qword [rdi]
lea r9, [rsp + 0x88]
movzx esi, bx
mov rbx, qword [rdi + 0x30]
mov r8d, esi
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002838b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x58
jae 0x140028379
mov eax, eax
lea rcx, [0x140030680]
mov ecx, dword [rcx + rax*4]
jmp 0x14002837e
mov ecx, operator
mov dword [0x140042de8], ecx
mov byte [0x1400433b0], 0
mov rcx, rsi
test esi, esi
jle 0x14002839e
not byte [rbx]
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x140028392
cmp dword [rsp + 0x88], esi
jne 0x1400283f9
mov r8, qword [rdi + 0x30]
xor eax, eax
mov qword [rdi + 0x18], r8
mov word [rdi + 0x52], ax
add word [rdi + 0x52], 8
movzx edx, word [rdi + 0x52]
lea rax, [r8 + rdx]
mov qword [rdi + 0x20], rax
mov rax, qword [rdi + 0x18]
movzx ecx, word [rax]
add cx, dx
mov word [rdi + 0x52], cx
mov rcx, r12
mov r8, qword [rbp + 0x10]
mov rdx, qword [r14 + 0x10]
call qword [0x140042648]
mov word [r13], ax
test ax, ax
jne 0x140028404
mov r8, qword [rsp + 0x68]
jmp 0x140028260
mov dword [r15], 3
xor eax, eax
jmp 0x140028409
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140029640
Capabilities:
Get file size

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov r15, r9
mov rsi, rdx
mov r14, qword [rsp + 0x70]
mov dword [r14], 1
xor edi, edi
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], rdi
lea rbp, [0x140042660]
mov r8, rbp
sub rcx, rbp
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
mov byte [r8], al
lea r8, [r8 + 1]
test al, al
jne 0x140029690
mov ecx, 0x10
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonLinkCtrl::XElementButtonLinkCtrl]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400296e9
mov word [rax], di
mov qword [rax + 8], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x1400296ec
inc eax
movsxd rcx, eax
call qword [sym.imp.mfc140u.dll_operator_1]
mov qword [rbx + 8], rax
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1400296ec
mov rbx, rdi
mov edx, 1
mov rcx, rbx
call fcn.14002a380
mov qword [r14 + 8], rax
test rax, rax
je 0x14002976f
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [r15], eax
cmp eax, 0xffffffff
je 0x14002976f
test rbx, rbx
je 0x140029736
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140029729
call qword [sym.imp.mfc140u.dll_operator]
mov edx, 0x10
mov rcx, rbx
call fcn.14002c9cc
mov rdx, rbp
sub rsi, rbp
nop dword [rax]
movzx eax, byte [rsi + rdx]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140029740
mov rcx, rbp
call fcn.14002a700
mov rbx, rax
mov edx, 0xa
mov rcx, rax
call fcn.14002a380
mov qword [r14 + 0x10], rax
test rax, rax
jne 0x140029774
mov edi, 2
test rbx, rbx
je 0x140029795
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140029788
call qword [sym.imp.mfc140u.dll_operator]
mov edx, 0x10
mov rcx, rbx
call fcn.14002c9cc
test edi, edi
je 0x1400297b7
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400297a7
call fcn.14002a1e0
mov rcx, qword [r14 + 0x10]
test rcx, rcx
je 0x1400297f2
call fcn.14002a1e0
jmp 0x1400297f2
lea rcx, [0x140028f80]
mov rax, qword [rsp + 0x78]
mov qword [rax], rcx
lea rcx, [0x140029070]
mov qword [rax + 8], rcx
lea rcx, [0x140029330]
mov qword [rax + 0x10], rcx
lea rcx, [0x1400291f0]
mov qword [rax + 0x18], rcx
lea rcx, [0x1400292b0]
mov qword [rax + 0x20], rcx
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret