joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d35e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d46c0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d3fe2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f6108]
test eax, eax
je 0x2fc4d407a
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f6110]
mov qword [rbp - 8], rax
jmp 0x2fc4d405e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d4052
cmp qword [rbp - 0x10], 0
je 0x2fc4d4052
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d4018
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d407b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d4180
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d41a8
mov eax, 0
jmp 0x2fc4d41f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d41d1
mov eax, 0
jmp 0x2fc4d41f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d41f1
mov eax, 0
jmp 0x2fc4d41f6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d41fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d427a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d4271
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d4271
mov rax, qword [rbp - 8]
jmp 0x2fc4d428f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d4244
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14000d080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400c9118]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
mov rdi, rcx
xor ebx, ebx
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
jne 0x14000d112
mov rax, qword [rdi]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [rax + 0x230]
cmp qword [rsp + 0x38], 8
lea r8, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
movabs rcx, 0xcbf29ce484222325
cmovae r8, qword [rsp + 0x20]
lea r9, [rax + rax]
test r9, r9
je 0x14000d100
movzx eax, byte [r8 + rbx]
movabs r10, 0x100000001b3
xor rcx, rax
inc rbx
imul rcx, r10
cmp rbx, r9
jb 0x14000d0e2
mov rbx, rcx
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov dl, 1
call fcn.140004550
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140058200
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14000d888
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov r15b, r8b
mov rbx, rdx
mov rdi, rcx
and dword [rbp - 0x40], 0
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov dword [rbp - 0x40], 1
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
test al, al
jne 0x14000d9d6
and dword [rbp + 0x38], 0
and qword [rbp - 0x28], 0
lea r13, vtable.GlobalAllocBufferPtr_wchar_t____ptr64_.0
mov qword [rbp - 0x30], r13
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x1f0]
mov rcx, rax
lea rdx, [rbp + 0x38]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbx, rax
lea rcx, [rbp - 0x30]
mov rax, qword [rbp - 0x30]
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rbp - 0x28], rbx
xor r14d, r14d
cmp dword [rbp + 0x38], r14d
jle 0x14000d9c4
xor esi, esi
mov r8b, 1
mov rdx, qword [rsi + rbx]
lea rcx, [rbp - 0x20]
call fcn.140009b58
nop
cmp r15b, 1
jne 0x14000d98e
lea rdx, [0x1400cc5e0]
lea rcx, [rbp - 0x20]
call fcn.14000cac8
test al, al
je 0x14000d98e
mov r8b, r15b
lea rdx, [0x14008bc08]
lea rcx, [rbp - 0x20]
call fcn.14000d1c0
mov rdx, qword [rbp - 0x28]
mov rdx, qword [rsi + rdx]
lea rcx, [rbp - 0x20]
call fcn.14000b510
lea rdx, [0x14008bc08]
lea rcx, [rbp - 0x20]
call fcn.14000b510
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140019004
nop
lea rax, vtable.nsString::String.0
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x20]
call fcn.14000d05c
inc r14d
add rsi, 8
mov rbx, qword [rbp - 0x28]
cmp r14d, dword [rbp + 0x38]
jl 0x14000d92f
mov qword [rbp - 0x30], r13
test rbx, rbx
je 0x14000d9d6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, rdi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x140015ddc
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [rcx + 0x80]
movzx eax, word [rcx + 0x78]
bt edx, 0x16
jae 0x140015e0f
cmp eax, 0x44
je 0x140015e0c
add eax, 0xffffffad
cmp eax, 0x24
ja 0x140015e09
movabs rcx, 0x1100030011
bt rcx, rax
jb 0x140015e0c
mov al, 1
ret
xor al, al
ret
cmp eax, 0x2f
ja 0x140015e40
je 0x140015e3b
cmp eax, 0x22
je 0x140015e3b
cmp eax, 0x24
je 0x140015e09
cmp eax, 0x27
jbe 0x140015e0c
cmp eax, 0x29
jbe 0x140015e63
cmp eax, 0x2a
je 0x140015e09
cmp eax, 0x2b
je 0x140015e63
cmp eax, 0x2e
je 0x140015e09
jmp 0x140015e0c
shr edx, 0x18
jmp 0x140015e66
cmp eax, 0x3f
je 0x140015e63
cmp eax, 0x5a
jbe 0x140015e0c
cmp eax, 0x5c
jbe 0x140015e09
cmp eax, 0x5e
je 0x140015e09
cmp eax, 0x7b
je 0x140015e63
cmp eax, 0x7c
je 0x140015e09
cmp eax, 0x7d
jne 0x140015e0c
shr edx, 0x17
and edx, 1
mov al, dl
ret
Function at 0x14001f844
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400c9118]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov qword [rbp + 0x1f], 0xf
and qword [rbp + 0x17], 0
mov byte [rbp + 7], 0
or rbx, 0xffffffffffffffff
mov r9, rbx
xor r8d, r8d
mov rdx, rcx
lea rcx, [rbp + 7]
call fcn.140004850
nop
and dword [rbp - 9], 0
lea rdx, [rbp + 0x27]
lea rcx, [0x1400ccde0]
mov rax, qword [0x1400ccde0]
call qword [rax + 0x228]
nop
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.14001fe0c
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14001f8e4
inc rdx
lea r8d, [rbx + 2]
mov rcx, qword [rbp + 0x27]
call fcn.140002da0
mov rbx, qword [rbp + 0x17]
lea rdi, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdi, qword [rbp + 7]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
and qword [rsp + 0x20], 0
lea r9, [rbp - 9]
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001f931
mov ecx, 2
call fcn.140065708
mov rcx, rax
call fcn.140065944
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14001f94d
inc rdx
mov r8d, 1
mov rcx, qword [rbp + 7]
call fcn.140002da0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140058200
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140020ef4
Capabilities:
Enumerate threads

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x140
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400c9118]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov rsi, rcx
mov qword [rsp + 0x50], rcx
xor r15d, r15d
mov dword [rsp + 0x34], r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
call fcn.140022064
mov qword [rsi], rax
mov dword [rsp + 0x34], 1
xor edx, edx
lea ebx, [rdx + 0xf]
mov ecx, ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov qword [rsp + 0x40], rax
lea rax, vtable.OperatingSystemHandle.0
mov qword [rsp + 0x38], rax
lea rcx, [rdi - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140020f87
lock inc dword [0x1400cd120]
mov rdi, qword [rsp + 0x40]
cmp rdi, 0xffffffffffffffff
je 0x140021014
mov dword [rsp + 0x68], 0x1c
lea rdx, [rsp + 0x68]
mov rcx, rdi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x140020ff7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14d, eax
mov bl, byte [rsp + 0x30]
cmp dword [rsp + 0x68], 0x10
jb 0x140020fde
cmp r14d, dword [rsp + 0x74]
jne 0x140020fde
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.14002032c
mov dword [rsp + 0x68], 0x1c
lea rdx, [rsp + 0x68]
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x140020fb7
test rdi, rdi
je 0x14002100c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lock dec dword [0x1400cd120]
mov rax, rsi
jmp 0x1400210bc
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r15
mov word [rbp - 0x78], r15w
cmp word [0x1400a54e0], r15w
jne 0x140021034
mov rax, r15
jmp 0x140021040
lea rcx, [0x1400a54e0]
call fcn.140065008
mov r8, rax
lea rdx, [0x1400a54e0]
lea rcx, [rbp - 0x78]
call fcn.1400045d0
nop
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x48], r15
mov byte [rbp - 0x58], r15b
lea rcx, str..._nsThread.cpp
call fcn.1400653e0
mov r8, rax
lea rdx, str..._nsThread.cpp
lea rcx, [rbp - 0x58]
call fcn.140004720
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140023b78
mov edx, eax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x23a
lea r8, [rbp - 0x58]
lea rcx, [rbp - 0x30]
call fcn.140022e44
lea rdx, [0x1400c67e8]
lea rcx, [rbp - 0x30]
call fcn.14005b684
nop
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140058200
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400216ac
Capabilities:
Terminate thread

Disassembly:
mov rax, rsp
push rbp
sub rsp, 0x140
mov qword [rsp + 0x138], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400c9118]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov rbx, rcx
lea rdx, [rcx + 0x18]
mov r8b, 1
lea rcx, [rbp]
call fcn.140022784
nop
xor edx, edx
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400217ef
xor edx, edx
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edi, edi
test eax, eax
je 0x14002173d
mov dword [rbx + 0x58], edi
lea rcx, [rbp]
call fcn.14002291c
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400217ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rbp + 0x58], 7
mov qword [rbp + 0x50], rdi
mov word [rbp + 0x40], di
cmp word [0x1400a54e0], di
jne 0x140021763
mov rax, rdi
jmp 0x14002176f
lea rcx, [0x1400a54e0]
call fcn.140065008
mov r8, rax
lea rdx, [0x1400a54e0]
lea rcx, [rbp + 0x40]
call fcn.1400045d0
nop
mov qword [rbp + 0x78], 0xf
mov qword [rbp + 0x70], rdi
mov byte [rbp + 0x60], dil
lea rcx, str..._nsThread.cpp
call fcn.1400653e0
mov r8, rax
lea rdx, str..._nsThread.cpp
lea rcx, [rbp + 0x60]
call fcn.140004720
nop
mov ecx, ebx
call fcn.140023b78
mov edx, eax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x1be
lea r8, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140022e44
lea rdx, [0x1400c67e8]
lea rcx, [rbp + 0x80]
call fcn.14005b684
nop
lea rcx, [rbp]
call fcn.1400227dc
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140058200
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140021a78
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rbp
sub rsp, 0xc0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
lea rbp, [rax - 0x78]
and rbp, 0xffffffffffffffe0
mov rbx, rdx
mov r14, rcx
xor esi, esi
lea rdx, [rcx + 0x18]
mov r8b, 1
lea rcx, [rbp + 0x20]
call fcn.140022784
nop
xor edx, edx
mov rcx, qword [r14 + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x140021b41
mov rcx, qword [r14 + 0x68]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [rsi + 0x58]
call fcn.1400587d0
mov qword [rbp], rax
test rax, rax
je 0x140021afe
mov rdx, rbx
mov rcx, rax
call fcn.14002056c
mov rdx, rax
jmp 0x140021b01
mov rdx, rsi
lea rcx, [r14 + 8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [r14 + 0x48]
lea rax, [r14 + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, r14
lea r8, [0x140021c70]
xor edx, edx
xor ecx, ecx
call fcn.140065ad4
mov rdx, rax
lea rcx, [r14 + 0x48]
call qword [rdi + reloc.WS2_32.dll_htonl]
cmp qword [r14 + 0x50], rsi
setne sil
lea rcx, [rbp + 0x20]
call fcn.1400227dc
mov al, sil
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140024788
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
sub rsp, 0x180
mov qword [rsp + 0x178], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400c9118]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rbx, rcx
lea rdx, [rcx + 0x220]
mov r8b, 1
lea rcx, [rbp + 0x20]
call fcn.140022784
nop
lea rsi, [rbx + 0x208]
mov rax, qword [rsi]
mov r8d, 0x4e4
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [rax + 0x200]
nop
mov r14, qword [rbp + 0x70]
xor r15d, r15d
test r14, r14
je 0x14002497f
mov dword [rbp], r15d
lea rdx, str..._nsConsole.cpp
lea rcx, [rbp + 0x80]
call fcn.140009aa8
nop
mov rdi, qword [rbx + 0x28]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x1e8]
mov r9, rax
mov dword [rsp + 0x20], 0xe8
mov r8, r14
lea rdx, str.Flushing_StdOutputBuffer.Length_u___s:_d_
lea rcx, [rbx + 0x28]
call qword [rdi + 0x148]
nop
lea rcx, [rbp + 0x80]
call fcn.14000a3b0
lea rbx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rbx, qword [rbp + 0x60]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov qword [rsp + 0x20], r15
lea r9, [rbp]
mov r8d, r14d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140024976
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0x48]
mov qword [rbp + 0x98], 7
mov qword [rbp + 0x90], r15
mov word [rbp + 0x80], r15w
cmp word [0x1400a54e0], r15w
jne 0x1400248d5
mov eax, r15d
jmp 0x1400248e1
lea rcx, [0x1400a54e0]
call fcn.140065008
mov r8, rax
lea rdx, [0x1400a54e0]
lea rcx, [rbp + 0x80]
call fcn.1400045d0
nop
mov qword [rbp + 0xb8], 0xf
mov qword [rbp + 0xb0], r15
mov byte [rbp + 0xa0], r15b
lea rcx, str..._nsConsole.cpp
call fcn.1400653e0
mov r8, rax
lea rdx, str..._nsConsole.cpp
lea rcx, [rbp + 0xa0]
call fcn.140004720
nop
mov ecx, ebx
call fcn.140023b78
mov edx, eax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0xee
lea r8, [rbp + 0xa0]
lea rcx, [rbp + 0xc0]
call fcn.140022e44
lea rdx, [0x1400c67e8]
lea rcx, [rbp + 0xc0]
call fcn.14005b684
nop
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x48]
mov ecx, 1
call fcn.140065708
mov rcx, rax
call fcn.140065944
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x1400249ae
inc rdx
mov r8d, 1
mov rcx, qword [rbp + 0x60]
call fcn.140002da0
mov qword [rbp + 0x78], 0xf
mov qword [rbp + 0x70], r15
mov byte [rbp + 0x60], r15b
lea rcx, [rbp + 0x20]
call fcn.1400227dc
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140058200
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140024d30
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1400c9118]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rdx
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
lea rdx, str..._nsConsole.cpp
lea rcx, [rbp - 0x79]
call fcn.140009aa8
mov rcx, rax
cmp qword [rsi + 0x18], 0x10
jb 0x140024d8d
mov r14, qword [rsi]
jmp 0x140024d90
mov r14, rsi
mov rdi, qword [rbx + 0x28]
mov rax, qword [rax]
call qword [rax + 0x1e8]
mov r9, rax
mov dword [rsp + 0x20], 0x98
mov r8, r14
lea rdx, str.Writing_StdError_S___s:_d_
lea rcx, [rbx + 0x28]
call qword [rdi + 0x148]
nop
lea rcx, [rbp - 0x79]
call fcn.14000a3b0
mov rbx, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x140024dd4
mov rsi, qword [rsi]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x30]
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140024eae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rbp - 0x61], 7
mov qword [rbp - 0x69], r15
mov word [rbp - 0x79], r15w
cmp word [0x1400a54e0], r15w
jne 0x140024e28
mov rax, r15
jmp 0x140024e34
lea rcx, [0x1400a54e0]
call fcn.140065008
mov r8, rax
lea rdx, [0x1400a54e0]
lea rcx, [rbp - 0x79]
call fcn.1400045d0
nop
mov qword [rbp - 0x41], 0xf
mov qword [rbp - 0x49], r15
mov byte [rbp - 0x59], r15b
lea rcx, str..._nsConsole.cpp
call fcn.1400653e0
mov r8, rax
lea rdx, str..._nsConsole.cpp
lea rcx, [rbp - 0x59]
call fcn.140004720
nop
mov ecx, ebx
call fcn.140023b78
mov edx, eax
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x9d
lea r8, [rbp - 0x59]
lea rcx, [rbp - 0x39]
call fcn.140022e44
lea rdx, [0x1400c67e8]
lea rcx, [rbp - 0x39]
call fcn.14005b684
nop
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140058200
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002875c
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rbp, [rcx + 8]
xor ebx, ebx
mov rsi, rdx
test rbp, rbp
je 0x1400287be
lea rdi, [rdx + 8]
test rdi, rdi
je 0x1400287be
cmp byte [rcx + 0x4c], bl
je 0x1400287be
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1400287be
cmp byte [rsi + 0x4c], bl
je 0x1400287be
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1400287be
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x1400287c0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400293fc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
xor bl, bl
call qword [rax + 0x1f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140029423
mov ebx, eax
shr ebx, 4
and bl, 1
mov al, bl
add rsp, 0x20
pop rbx
ret

Function at 0x14002942c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
xor bl, bl
call qword [rax + 0x1f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140029455
mov ebx, eax
shr ebx, 4
not bl
and bl, 1
mov al, bl
add rsp, 0x20
pop rbx
ret
Function at 0x14002ea68
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 8]
sub rsp, 0x108
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400c9118]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14d, r9d
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov r15b, byte [rbp + 0x70]
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x1f0]
mov r8, rax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x38], rax
lea r13, vtable.OperatingSystemHandle.0
mov qword [rsp + 0x30], r13
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14002eaeb
lock inc dword [0x1400cd120]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14002ec0d
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x1f0]
mov r8, rax
mov edx, r12d
test r15b, r15b
setne dl
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rbx, rax
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x18]
mov qword [rsp + 0x38], rbx
test rbx, rbx
je 0x14002eb59
cmp rbx, 0xffffffffffffffff
je 0x14002eb49
lock inc dword [0x1400cd120]
mov rbx, qword [rsp + 0x38]
lea rax, [rbx + 1]
test rax, 0xfffffffffffffffe
jne 0x14002ec12
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
cmp word [0x1400a54e0], r12w
jne 0x14002eb7c
mov rax, r12
jmp 0x14002eb88
lea rcx, [0x1400a54e0]
call fcn.140065008
mov r8, rax
lea rdx, [0x1400a54e0]
lea rcx, [rsp + 0x50]
call fcn.1400045d0
nop
mov qword [rbp - 0x78], 0xf
mov qword [rbp - 0x80], r12
mov byte [rsp + 0x70], r12b
lea rcx, str..._nsMutex.cpp
call fcn.1400653e0
mov r8, rax
lea rdx, str..._nsMutex.cpp
lea rcx, [rsp + 0x70]
call fcn.140004720
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140023b78
mov edx, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x73
lea r8, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.140022e44
lea rdx, [0x1400c67e8]
lea rcx, [rbp - 0x70]
call fcn.14005b684
nop
mov rbx, qword [rsp + 0x38]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14002ec28
lock dec dword [0x1400cd120]
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x38], r12
mov rdx, rbx
mov rcx, rdi
call fcn.14002e710
nop
mov qword [rsp + 0x30], r13
mov rcx, qword [rsp + 0x38]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x14002ec5a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lock dec dword [0x1400cd120]
mov rax, rdi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140058200
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret