joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400034e0
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov edx, 0x180
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wchmod]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov edi, eax
test eax, eax
je 0x140003534
movzx eax, byte [0x14005b818]
test al, al
je 0x14000353e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
lea rcx, [0x14005c900]
lea rdx, str.ensure_remove:_failed_to_remove_file:__S__rv:__d__err:__d
mov r8, rsi
mov r9d, edi
call fcn.140016400
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14005b818]
call fcn.1400174a0
test eax, eax
je 0x14000350f
lea rbx, [0x14005c900]
mov rcx, rbx
call fcn.140016350
lea rcx, [0x14000ad20]
lea r8, [0x14005b770]
mov rdx, rbx
call fcn.1400182f0
lea rcx, [0x14005b818]
call fcn.14001757b
jmp 0x14000350f

Function at 0x140004400
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov dx, 0x2f
call sub.api_ms_win_crt_private_l1_1_0.dll_wcsrchr
test rax, rax
je 0x140004435
mov rsi, rax
mov word [rax], 0
mov rcx, rdi
call fcn.140004400
mov ebx, eax
test eax, eax
je 0x140004441
mov word [rsi], 0x2f
jmp 0x140004437
xor ebx, ebx
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor ebx, ebx
cmp word [rdi], 0
je 0x14000442e
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
test eax, eax
jns 0x14000442e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x11
je 0x14000442e
movzx eax, byte [0x14005b818]
test al, al
je 0x140004492
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r9d, dword [rax]
lea rcx, [0x14005c900]
lea rdx, str.ensure_parent_dir:_failed_to_create_directory:__S__err:__d
mov r8, rdi
call fcn.140016400
mov ebx, 7
jmp 0x14000442e
lea rcx, [0x14005b818]
call fcn.1400174a0
test eax, eax
je 0x14000446c
lea rbx, [0x14005c900]
mov rcx, rbx
call fcn.140016350
lea rcx, [0x14000ad20]
lea r8, [0x14005b770]
mov rdx, rbx
call fcn.1400182f0
lea rcx, [0x14005b818]
call fcn.14001757b
jmp 0x14000446c
Function at 0x140006a30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov edi, edx
mov rbx, rcx
mov r14, qword [0x14003da78]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, str.MOZ_LAUNCHED_CHILD1
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wchdir]
test eax, eax
je 0x140006a96
movzx eax, byte [0x14005b818]
test al, al
je 0x140006b6e
lea rcx, [0x14005c900]
lea rdx, str.Warning:_chdir_failed
call fcn.140016400
mov rcx, qword [rsi]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov edx, edi
mov r8, rsi
xor r9d, r9d
call fcn.140005d90
test eax, eax
je 0x140006b48
mov rsi, qword [rsp + 0x28]
mov r15, qword [sym.imp.KERNEL32.dll_GetTickCount]
call r15
mov edi, eax
call r15
sub eax, edi
cmp eax, 0x270f
ja 0x140006b36
mov r12, qword [sym.imp.KERNEL32.dll_SetLastError]
mov r13, qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
nop word cs:[rax + rax]
mov ebx, 0x2710
sub ebx, eax
xor ecx, ecx
call r12
mov rcx, rsi
mov edx, ebx
call r13
cmp eax, 0xffffffff
jne 0x140006b36
call rbp
cmp eax, 0x5bf
jne 0x140006b36
mov ecx, 0xa
call r14
call r15
sub eax, edi
cmp eax, 0x2710
jb 0x140006b00
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [0x14003da78]
mov rax, qword [rsp + 0x30]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x140006b69
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140018700
lea rcx, [0x14005b818]
call fcn.1400174a0
test eax, eax
je 0x140006a83
lea rbx, [0x14005c900]
mov rcx, rbx
call fcn.140016350
lea rcx, [0x14000ad20]
lea r8, [0x14005b770]
mov rdx, rbx
call fcn.1400182f0
lea rcx, [0x14005b818]
call fcn.14001757b
jmp 0x140006a83
Function at 0x140007f90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rsi, rcx
mov rbx, qword [0x14003da78]
mov rax, qword [rbx]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
cmp byte [0x14005c498], 0
je 0x140007fee
lea rcx, [0x14005b840]
lea rdx, str..status
lea r8, [rsp + 0x30]
call fcn.140016e00
test eax, eax
jne 0x140008017
jmp 0x140008071
lea rax, str.update.status
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea r9, [0x14005b840]
lea rcx, [rsp + 0x30]
mov edx, 0x105
call fcn.140004fe0
lea rdx, [0x14003e05e]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
test rax, rax
je 0x140008071
mov rdi, rax
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r8d, 1
mov rcx, rsi
mov rdx, rax
mov r9, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, 1
jne 0x140008075
cmp byte [0x14005c498], 0
je 0x14000806c
lea rcx, [0x14005b840]
call fcn.140016e10
test eax, eax
je 0x140008075
mov sil, 1
jmp 0x140008077
xor esi, esi
jmp 0x14000807f
xor esi, esi
mov rcx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rax, qword [rsp + 0x248]
xor rax, rsp
mov rcx, qword [rbx]
cmp rcx, rax
jne 0x14000809f
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
call fcn.140018700
int3

Function at 0x140008120
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x260
mov rsi, rcx
mov r15, qword [0x14003da78]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x258], rax
xor edi, edi
lea rbx, [rsp + 0x40]
mov r8d, 0x20a
mov rcx, rbx
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [0x14005b840]
lea rdx, str..status
mov r8, rbx
call fcn.140016e00
test eax, eax
je 0x14000824c
lea rdx, [0x14003dc04]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
test rax, rax
je 0x14000823c
mov rbx, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1f
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov r14, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ferror
test eax, eax
sete dil
jne 0x140008244
mov byte [rsp + r14 + 0x20], 0
lea r14, [rsp + 0x20]
mov rcx, r14
mov edx, 0x3a
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
test rax, rax
jne 0x140008213
lea rcx, [rsp + 0x20]
mov edx, 0xa
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
test rax, rax
jne 0x140008213
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add rax, rsp
add rax, 0x20
sub rax, r14
cmp rax, 9
jne 0x140008240
movabs rax, 0x6564656563637573
xor rax, qword [rsp + 0x20]
movzx ecx, byte [rsp + 0x28]
xor rcx, 0x64
or rcx, rax
sete al
jmp 0x140008242
xor edi, edi
jmp 0x14000824c
xor eax, eax
mov byte [rsi], al
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rax, qword [rsp + 0x258]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x140008270
mov eax, edi
add rsp, 0x260
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140018700
int3
Function at 0x140008280
Capabilities:
Delete directory

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov ebx, edx
mov rsi, rcx
mov r15, qword [0x14003da78]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rdx, [rsp + 0x30]
call fcn.1400187b0
mov edi, eax
test eax, eax
jne 0x140008446
movzx eax, word [rsp + 0x36]
and eax, 0xf000
cmp eax, 0x4000
jne 0x140008396
mov rcx, rsi
call fcn.140017050
test rax, rax
je 0x1400083a5
mov r14, rax
mov rcx, rax
call fcn.1400170f0
test rax, rax
je 0x1400083ed
mov r13, rax
lea r15, [0x14003dc6e]
lea r12, [0x14003e1ca]
lea rbp, [rsp + 0x60]
xor edi, edi
jmp 0x140008334
mov rcx, r14
call fcn.1400170f0
mov r13, rax
test rax, rax
je 0x1400083d8
mov rcx, r13
mov rdx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
je 0x140008320
mov rcx, r13
mov rdx, r12
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
je 0x140008320
mov qword [rsp + 0x20], r13
mov edx, 0x104
mov rcx, rbp
lea r8, str._s__s
mov r9, rsi
call fcn.140004fe0
mov rcx, rbp
xor edx, edx
call fcn.140008280
mov edi, eax
test eax, eax
je 0x140008320
test bl, bl
jne 0x140008320
mov rcx, r14
call fcn.1400170c0
mov r15, qword [0x14003da78]
jmp 0x140008446
mov rcx, rsi
call fcn.1400034e0
mov edi, eax
jmp 0x140008446
movzx eax, byte [0x14005b818]
test al, al
je 0x140008478
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
lea rcx, [0x14005c900]
lea rdx, str.ensure_remove_recursive:_unable_to_open_directory:__S__rv:__d__err:__d
xor edi, edi
mov r8, rsi
xor r9d, r9d
jmp 0x140008441
mov rcx, r14
call fcn.1400170c0
test edi, edi
mov r15, qword [0x14003da78]
jne 0x140008446
jmp 0x1400083f5
mov rcx, r14
call fcn.1400170c0
mov rcx, rsi
mov edx, 0x180
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wchmod]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrmdir]
test eax, eax
je 0x14000846f
mov edi, eax
movzx eax, byte [0x14005b818]
test al, al
je 0x1400084c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
lea rcx, [0x14005c900]
lea rdx, str.ensure_remove_recursive:_unable_to_remove_directory:__S__rv:__d__err:__d
mov r8, rsi
mov r9d, edi
call fcn.140016400
mov rax, qword [rsp + 0x270]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x140008473
mov eax, edi
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor edi, edi
jmp 0x140008446
call fcn.140018700
lea rcx, [0x14005b818]
call fcn.1400174a0
test eax, eax
je 0x1400083b4
lea rdi, [0x14005c900]
mov rcx, rdi
call fcn.140016350
lea rcx, [0x14000ad20]
lea r8, [0x14005b770]
mov rdx, rdi
call fcn.1400182f0
lea rcx, [0x14005b818]
call fcn.14001757b
jmp 0x1400083b4
lea rcx, [0x14005b818]
call fcn.1400174a0
test eax, eax
je 0x140008421
lea rbx, [0x14005c900]
mov rcx, rbx
call fcn.140016350
lea rcx, [0x14000ad20]
lea r8, [0x14005b770]
mov rdx, rbx
call fcn.1400182f0
lea rcx, [0x14005b818]
call fcn.14001757b
jmp 0x140008421
Function at 0x140008510
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rbx, qword [0x14003da78]
mov rax, qword [rbx]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], r8
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14000b050]
xor esi, esi
xor ecx, ecx
xor edx, edx
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
cmp rax, 1
sbb esi, esi
mov rax, qword [rsp + 0x38]
xor rax, rsp
mov rcx, qword [rbx]
cmp rcx, rax
jne 0x14000857f
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.140018700
int3
Function at 0x14000b770
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, r8
mov r14, qword [rsp + 0x80]
movq xmm0, rcx
movq xmm1, rdx
punpcklqdq xmm1, xmm0
movq xmm0, r14
movq xmm2, r8
punpcklqdq xmm2, xmm0
pxor xmm0, xmm0
pcmpeqd xmm2, xmm0
pshufd xmm3, xmm2, 0xb1
pand xmm3, xmm2
pcmpeqd xmm1, xmm0
pshufd xmm0, xmm1, 0xb1
pand xmm0, xmm1
packssdw xmm0, xmm3
movmskps eax, xmm0
test eax, eax
jne 0x14000b814
mov rbx, qword [rsp + 0x90]
test rbx, rbx
je 0x14000b814
mov ebp, dword [rsp + 0x88]
test ebp, ebp
je 0x14000b814
mov esi, r9d
test r9d, r9d
je 0x14000b86b
mov r8, rdx
mov r9d, esi
mov rdx, rdi
call fcn.14000d930
test eax, eax
je 0x14000b83b
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, [0x14003fab3]
jmp 0x14000b881
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Invalid_parameter_specified._n
mov edx, 0x24
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
jmp 0x14000b88c
mov r15d, ebp
xor r12d, r12d
nop word cs:[rax + rax]
mov rcx, qword [r14 + r12*8]
mov rdx, rdi
mov r8d, esi
call sub.nss3.dll_VFY_Update
test eax, eax
jne 0x14000b86f
inc r12
cmp r15, r12
jne 0x14000b850
xor eax, eax
jmp 0x14000b891
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.ERROR:_Could_not_update_verify_context_for__s_n
mov rcx, rax
mov r8, rbx
call fcn.140018b90
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14000b8a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov esi, r9d
mov r15, qword [0x14003da78]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov ebp, r9d
test r9d, r9d
je 0x14000b9a4
test rcx, rcx
je 0x14000b9a4
mov r14, rdx
test rdx, rdx
je 0x14000b9a4
mov rbx, r8
test r8, r8
je 0x14000b9a4
mov qword [rsp + 0x30], rcx
xor edi, edi
lea r15, [rsp + 0x38]
nop
mov rax, qword [r14 + rdi*8]
mov ecx, dword [rbx + rdi*4]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], ecx
test rax, rax
je 0x14000b9d4
call sub.nss3.dll_CERT_GetDefaultCertDB
mov dword [rsp + 0x20], 1
mov rcx, rax
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call sub.nss3.dll_CERT_NewTempCertificate
test rax, rax
je 0x14000b9d4
mov r12, rax
mov rcx, rax
call sub.nss3.dll_CERT_ExtractPublicKey
mov r13, rax
mov qword [rsp + rdi*8 + 0x50], rax
mov rcx, r12
call sub.nss3.dll_CERT_DestroyCertificate
test r13, r13
je 0x14000b9d4
inc rdi
cmp rbp, rdi
jne 0x14000b920
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov r9d, esi
call fcn.14000ba60
mov edi, eax
jmp 0x14000b9fe
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Invalid_parameter_specified._n
mov edx, 0x24
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov edi, 0xffffffff
test esi, esi
jne 0x14000ba09
jmp 0x14000ba29
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_Could_not_load_public_key._n
mov edx, 0x22
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov edi, 0xffffffff
mov r15, qword [0x14003da78]
test esi, esi
je 0x14000ba29
xor esi, esi
jmp 0x14000ba18
inc rsi
cmp rbp, rsi
je 0x14000ba29
mov rcx, qword [rsp + rsi*8 + 0x50]
test rcx, rcx
je 0x14000ba10
call sub.nss3.dll_SECKEY_DestroyPublicKey
jmp 0x14000ba10
mov rax, qword [rsp + 0x90]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x14000ba52
mov eax, edi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140018700
int3
Function at 0x14000c290
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rbx, rcx
mov r14, qword [0x14003da78]
mov rax, qword [r14]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 1
mov r8d, 0x20
mov rcx, rdi
mov r9, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov esi, 6
cmp rax, 0x20
jne 0x14000c32f
mov ecx, dword [rdi + 8]
mov r15, qword [sym.imp.WS2_32.dll_ntohl]
call r15
mov dword [rdi + 8], eax
mov ecx, dword [rdi + 0xc]
call r15
mov dword [rdi + 0xc], eax
mov ecx, dword [rdi + 0x10]
call r15
mov dword [rdi + 0x10], eax
mov ecx, dword [rdi + 0x14]
call r15
mov dword [rdi + 0x14], eax
mov ecx, dword [rdi + 0x18]
call r15
mov dword [rdi + 0x18], eax
mov ecx, dword [rdi + 0x1c]
call r15
mov dword [rdi + 0x1c], eax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll__fileno
lea rdx, [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64]
cmp eax, 0xffffffff
je 0x14000c32f
test eax, eax
je 0x14000c34d
mov rax, qword [rsp + 0x58]
xor rax, rsp
mov rcx, qword [r14]
cmp rcx, rax
jne 0x14000c395
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
movabs rax, 0x303146464944424d
mov esi, 0x29
cmp qword [rdi], rax
jne 0x14000c32f
mov rax, qword [rsp + 0x38]
mov ecx, eax
and ecx, 0xffffffe0
je 0x14000c32f
cdqe
add rax, 0xffffffffffffffe0
mov ecx, dword [rdi + 0x14]
sub rax, rcx
jb 0x14000c32f
mov ecx, dword [rdi + 0x18]
sub rax, rcx
jb 0x14000c32f
mov ecx, dword [rdi + 0x1c]
cmp rax, rcx
jb 0x14000c32f
xor edx, edx
cmp rax, rcx
cmove esi, edx
jmp 0x14000c32f
call fcn.140018700
int3
Function at 0x14000c3a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
mov r15, rdx
mov r14, rcx
mov ebx, dword [rcx + 8]
mov r12d, dword [rcx + 0x18]
add r12d, dword [rcx + 0x14]
add r12d, dword [rcx + 0x1c]
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x14000c449
mov rdi, rax
test r12, r12
je 0x14000c42a
movabs rsi, 0x7fffffffffffffff
mov r13, rdi
nop word cs:[rax + rax]
cmp r12, rsi
mov rbp, rsi
cmovb rbp, r12
mov edx, 1
mov rcx, r13
mov r8, rbp
mov r9, r15
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, rbp
jne 0x14000c453
add r13, rbp
sub r12, rbp
jne 0x14000c400
mov eax, dword [r14 + 0x14]
imul ecx, eax, 0xaaaaaaab
ror ecx, 2
cmp ecx, 0x15555555
jbe 0x14000c45d
mov ebp, 0x29
jmp 0x14000c5aa
mov ebp, 0xc
jmp 0x14000c5b2
mov ebp, 6
jmp 0x14000c5aa
test rax, rax
je 0x14000c5a8
mov r13, qword [rsp + 0x20]
add rbx, r13
mov r15, rdi
add r15, rax
mov eax, dword [r14 + 0x18]
mov ecx, dword [r14 + 0x1c]
add rax, r15
add rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rax
mov r14, rax
mov qword [rsp + 0x30], r15
mov rsi, rdi
nop word [rax + rax]
mov ecx, dword [rsi]
mov r12, qword [sym.imp.WS2_32.dll_ntohl]
call r12
mov dword [rsi], eax
mov ecx, dword [rsi + 4]
call r12
mov dword [rsi + 4], eax
mov ecx, dword [rsi + 8]
call r12
mov dword [rsi + 8], eax
mov eax, dword [rsi]
mov rcx, rbx
sub rcx, r13
cmp rcx, rax
jb 0x14000c43f
mov rcx, qword [rsp + 0x40]
sub rcx, r15
cmp rcx, rax
jb 0x14000c43f
test eax, eax
je 0x14000c510
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [r13 + rcx]
add byte [r15 + rcx], al
inc rcx
mov eax, dword [rsi]
cmp rcx, rax
jb 0x14000c4f0
jmp 0x14000c512
xor eax, eax
mov r8d, eax
mov edx, 1
mov rcx, r15
mov r9, qword [rsp + 0x28]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r12, rax
mov ebp, 0x40
cmp dword [rsi], r12d
jne 0x14000c5aa
mov r8d, dword [rsi + 4]
mov rax, qword [rsp + 0x38]
sub rax, r14
cmp rax, r8
jb 0x14000c43f
mov edx, 1
mov rcx, r14
mov r9, qword [rsp + 0x28]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp dword [rsi + 4], eax
jne 0x14000c5aa
mov edx, r12d
add r13, rdx
movsxd rcx, dword [rsi + 8]
mov r8, qword [rsp + 0x20]
sub r8, r13
cmp r8, rcx
jg 0x14000c43f
mov r8, rbx
sub r8, r13
cmp r8, rcx
jl 0x14000c43f
add r15, rdx
mov eax, eax
add r14, rax
add r13, rcx
add rsi, 0xc
xor ebp, ebp
cmp rsi, qword [rsp + 0x30]
jb 0x14000c4a0
jmp 0x14000c5aa
xor ebp, ebp
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000c870
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov r14, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov r12, qword [0x14003da78]
mov rax, qword [r12]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
lea rdx, [0x14004003a]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
test rax, rax
je 0x14000c9e4
mov r15, rax
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14000d6a0
mov edi, eax
mov rcx, r15
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
test edi, edi
je 0x14000c910
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_could_not_read_file_in_get_mar_file_info___n
mov edx, 0x32
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov esi, 0xffffffff
jmp 0x14000c9c3
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov r8, rbx
mov r9, rsi
call fcn.14000d9d0
mov esi, eax
mov rcx, qword [rdi]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor ebx, ebx
jmp 0x14000c96c
inc rbx
cmp rbx, 0x100
je 0x14000c9af
mov rcx, qword [rdi + rbx*8 + 0x10]
test rcx, rcx
je 0x14000c960
nop word cs:[rax + rax]
mov r14, qword [rcx]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, r14
test r14, r14
jne 0x14000c980
jmp 0x14000c960
mov rax, qword [rcx]
mov qword [rdi + 0x810], rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [rdi + 0x810]
test rcx, rcx
jne 0x14000c9a0
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, qword [rsp + 0x50]
xor rax, rsp
mov rcx, qword [r12]
cmp rcx, rax
jne 0x14000ca16
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str.ERROR:_could_not_open_file_in_mar_open___n
mov edx, 0x29
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, rdi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_perror
jmp 0x14000c8e1
call fcn.140018700
int3
Function at 0x14000ca20
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
mov r12, qword [0x14003da78]
mov rax, qword [r12]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov esi, 0xffffffff
test r8, r8
je 0x14000cbcb
mov rbx, r8
mov rdi, rcx
mov rcx, qword [r8]
test rcx, rcx
je 0x14000cbcb
mov r15, qword [rbx + 8]
test r15, r15
je 0x14000cbcb
mov r14, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rax, 0x3f
ja 0x14000cbcb
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp rax, 0x1f
ja 0x14000cbcb
test r14, r14
je 0x14000caa1
add dword [r14 + 0x10], 0x68
mov ecx, 0x68
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x28]
mov edx, 4
mov r8d, 1
mov r9, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, 1
jne 0x14000cbcb
mov ecx, dword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_ntohl]
mov r14d, eax
mov ecx, 1
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
mov edx, 4
mov r8d, 1
mov r9, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, 1
jne 0x14000cbcb
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_ntohl]
mov r15, qword [rbx]
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rdx, [rax + 1]
mov r8d, 1
mov rcx, r15
mov r9, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, 1
jne 0x14000cbcb
mov r15, qword [rbx + 8]
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rdx, [rax + 1]
mov r8d, 1
mov rcx, r15
mov r9, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, 1
jne 0x14000cbcb
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rsi, rax
mov rcx, qword [rbx + 8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, esi
sub r14d, eax
add r14d, 0xfffffff6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x7e], xmm0
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, r14
mov r9, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
xor esi, esi
cmp rax, 1
setne sil
neg esi
mov rax, qword [rsp + 0x90]
xor rax, rsp
mov rcx, qword [r12]
cmp rcx, rax
jne 0x14000cbf2
mov eax, esi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140018700
int3