joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014520
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.1400143a0
mov rcx, rax
add rsp, 0x28
jmp 0x140014540
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x105a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x1a100]
xor edi, edi
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], edi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], edi
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
ret

Function at 0x140014540
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.1400143a0
mov rcx, rax
add rsp, 0x28
jmp 0x140014540
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x105a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x1a100]
xor edi, edi
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], edi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], edi
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a110]
add rsp, 0x1a0f0
pop rdi
ret

Function at 0x140014920
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.1400143a0
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.140014940
Function at 0x140014940
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x100e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbx
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x34], eax
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a108]
add rsp, 0x1a0f0
pop rdi
ret

Function at 0x140014aa0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140014bd0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xa098
lea rcx, [rsp + 0x30]
call fcn.140249b10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], 0x1003
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test rsi, rsi
je 0x140014c94
mov eax, dword [rsp + 0xa0dc]
mov dword [rsi], eax
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140014bd0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140014bd0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xa098
lea rcx, [rsp + 0x30]
call fcn.140249b10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a100]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a100], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], 0x1003
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a108]
mov r8d, 0x10018
mov dword [rsp + 0x1a108], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test rsi, rsi
je 0x140014c94
mov eax, dword [rsp + 0xa0dc]
mov dword [rsi], eax
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140014ce0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8, rdi
mov rcx, rax
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140014d20
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov r14, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov rsi, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x1014
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a110]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a110], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test r14, r14
je 0x140014de7
mov rax, qword [rsp + 0xa0dc]
mov qword [r14], rax
test rsi, rsi
je 0x140014df7
mov rax, qword [rsp + 0xa0e4]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x1a130]
test rcx, rcx
je 0x140014e0f
mov rax, qword [rsp + 0xa0ec]
mov qword [rcx], rax
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop r14
pop rdi
pop rsi
ret
Function at 0x140014d20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8, rdi
mov rcx, rax
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140014d20
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov r14, r8
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov rsi, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x1014
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a110]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a110], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test r14, r14
je 0x140014de7
mov rax, qword [rsp + 0xa0dc]
mov qword [r14], rax
test rsi, rsi
je 0x140014df7
mov rax, qword [rsp + 0xa0e4]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x1a130]
test rcx, rcx
je 0x140014e0f
mov rax, qword [rsp + 0xa0ec]
mov qword [rcx], rax
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop r14
pop rdi
pop rsi
ret

Function at 0x140014fe0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
call fcn.1400143a0
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140015010

Function at 0x140015010
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
xor esi, esi
mov rdi, rdx
mov rbx, rcx
test r8, r8
je 0x140015038
mov dword [r8], esi
xor edx, edx
lea rcx, [rsp + 0x34]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x30], 0x1009
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rdi
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x34], eax
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x1a100]
mov r8d, 0xa098
mov dword [rsp + 0x1a100], esi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x1a110]
mov r8d, 0x10018
mov dword [rsp + 0x1a110], esi
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0d8]
lea r11, [rsp + 0x1a0f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140015120
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9d, ebx
mov r8d, edi
mov rcx, rax
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140015160

Function at 0x140015160
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1a100
call fcn.140247340
sub rsp, rax
mov ebx, r9d
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
test r9d, r9d
je 0x140015270
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x40], 0x1013
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbp
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x44], eax
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x1088], esi
lea rdx, [rsp + 0x40]
xor esi, esi
mov dword [rsp + 0x108c], ebx
mov r8d, 0xa098
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0e0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a128]
mov r8d, 0x10018
mov dword [rsp + 0x1a128], esi
lea rdx, [rsp + 0xa0e0]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rdx, qword [rsp + 0x1a130]
lea r9, [rsp + 0x1a128]
mov rcx, qword [rdi + 0x10]
mov r8d, ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0e0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0e8]
jmp 0x140015272
xor eax, eax
lea r11, [rsp + 0x1a100]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140015780
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400157e0
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a100
call fcn.140247340
sub rsp, rax
mov rbx, r9
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
test r8d, r8d
jne 0x14001580d
xor eax, eax
jmp 0x140015906
mov qword [rsp + 0x1a120], r14
xor r14d, r14d
test rbx, rbx
je 0x140015820
mov dword [r9], r14d
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x40], 0x1065
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rsp + 0x44], eax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0e0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a130]
mov r8d, 0x10018
mov dword [rsp + 0x1a130], r14d
lea rdx, [rsp + 0xa0e0]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0xa0ec]
mov r14, qword [rsp + 0x1a120]
test eax, eax
je 0x1400158eb
mov rdx, qword [rdi + 0x10]
mov r8, rbp
imul r9d, eax, 0x820
mov rcx, rdi
lea rax, [rsp + 0x1a130]
mov qword [rsp + 0x20], rax
call fcn.14001e4f0
mov eax, dword [rsp + 0xa0ec]
test rbx, rbx
je 0x1400158f2
mov dword [rbx], eax
mov ecx, dword [rsp + 0xa0e0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0e8]
mov rbx, qword [rsp + 0x1a128]
add rsp, 0x1a100
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400157e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400157e0
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a100
call fcn.140247340
sub rsp, rax
mov rbx, r9
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
test r8d, r8d
jne 0x14001580d
xor eax, eax
jmp 0x140015906
mov qword [rsp + 0x1a120], r14
xor r14d, r14d
test rbx, rbx
je 0x140015820
mov dword [r9], r14d
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0xa094
call fcn.140249b10
mov dword [rsp + 0x40], 0x1065
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x30]
mov r8d, 0xa098
mov dword [rsp + 0x44], eax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0e0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rdi + 0x10]
lea r9, [rsp + 0x1a130]
mov r8d, 0x10018
mov dword [rsp + 0x1a130], r14d
lea rdx, [rsp + 0xa0e0]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0xa0ec]
mov r14, qword [rsp + 0x1a120]
test eax, eax
je 0x1400158eb
mov rdx, qword [rdi + 0x10]
mov r8, rbp
imul r9d, eax, 0x820
mov rcx, rdi
lea rax, [rsp + 0x1a130]
mov qword [rsp + 0x20], rax
call fcn.14001e4f0
mov eax, dword [rsp + 0xa0ec]
test rbx, rbx
je 0x1400158f2
mov dword [rbx], eax
mov ecx, dword [rsp + 0xa0e0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0xa0e8]
mov rbx, qword [rsp + 0x1a128]
add rsp, 0x1a100
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015950
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8, rdi
mov rcx, rax
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140015990
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov rbp, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x104a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a110], ebx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbp, rbp
je 0x140015a95
lea rcx, [rsp + 0xa0dc]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x140015a70
mov ecx, dword [rsp + 0x1a130]
cmp rax, rcx
ja 0x140015a95
lea rdx, [rsp + 0xa0dc]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015990
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8, rdi
mov rcx, rax
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140015990
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov rbp, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x104a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a110], ebx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbp, rbp
je 0x140015a95
lea rcx, [rsp + 0xa0dc]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x140015a70
mov ecx, dword [rsp + 0x1a130]
cmp rax, rcx
ja 0x140015a95
lea rdx, [rsp + 0xa0dc]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015af0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8, rdi
mov rcx, rax
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140015b30
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov rbp, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x1049
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a110], ebx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbp, rbp
je 0x140015c36
lea rcx, [rsp + 0xa0dc]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140015c10
mov ecx, dword [rsp + 0x1a130]
cmp rax, rcx
ja 0x140015c36
lea rdx, [rsp + 0xa0dc]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140015b30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rdx
call fcn.1400143a0
mov r9, rbx
mov r8, rdi
mov rcx, rax
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x140015b30
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1a0f0
call fcn.140247340
sub rsp, rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0xa094
lea rcx, [rsp + 0x34]
mov rbp, r9
call fcn.140249b10
mov dword [rsp + 0x30], 0x1049
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a110]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov r8d, 0xa098
mov dword [rsp + 0x1a110], ebx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0xa0d0]
mov r8d, 0x10018
call fcn.140249b10
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x1a118]
mov r8d, 0x10018
mov dword [rsp + 0x1a118], ebx
lea rdx, [rsp + 0xa0d0]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0xa0d0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbp, rbp
je 0x140015c36
lea rcx, [rsp + 0xa0dc]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140015c10
mov ecx, dword [rsp + 0x1a130]
cmp rax, rcx
ja 0x140015c36
lea rdx, [rsp + 0xa0dc]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov eax, dword [rsp + 0xa0d8]
mov rbx, qword [rsp + 0x1a120]
add rsp, 0x1a0f0
pop rdi
pop rsi
pop rbp
ret