joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140739b70
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x150
mov rsi, r8
mov r15, rdx
lea r8, str.nsc_regen
xor edx, edx
mov rbp, r9
mov rbx, rcx
mov edi, 1
call fcn.140739620
mov r14d, eax
test eax, eax
js 0x140739d2b
mov r9, qword [rbx + 0x28]
lea r8, str._s.tmp
lea edx, [rdi + 0x7f]
lea rcx, [rsp + 0x50]
call fcn.140729470
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll__unlink
mov edx, 0x101
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x7f]
call sub.msvcrt.dll__open
mov dword [rsp + 0x40], eax
test eax, eax
js 0x140739cef
lea r8d, [rdi + 0x1b]
mov ecx, eax
lea rdx, str._Netscape_HTTP_Cookie_File_n
call sub.msvcrt.dll__write
cmp eax, 0x1c
jne 0x140739ce2
test rsi, rsi
je 0x140739c4c
mov ecx, dword [rsp + 0x40]
mov r8d, ebp
mov rdx, rsi
call sub.msvcrt.dll__write
movsxd rcx, eax
cmp rcx, rbp
jne 0x140739ce2
mov ecx, dword [rsp + 0x40]
lea rdx, [0x140750ca8]
mov r8d, edi
call sub.msvcrt.dll__write
cmp eax, edi
jne 0x140739ce2
mov qword [rbx + 0x88], 0
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rbp
call fcn.140732700
lea r9, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea r8, [0x140739d50]
mov byte [rsp + 0x44], 0
mov edx, r14d
mov qword [rbx + 0x90], 0
mov rcx, rbx
call fcn.140739f20
test eax, eax
jne 0x140739ce2
mov ecx, dword [rsp + 0x40]
call sub.msvcrt.dll__close
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x40], 0xffffffff
call sub.msvcrt.dll__unlink
mov rdx, qword [rbx + 0x28]
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_rename
mov r8, qword [rbx + 0x90]
test r8, r8
je 0x140739cde
lea rdx, [0x1407395d0]
mov rcx, rbx
call fcn.140737c20
xor edi, edi
jmp 0x140739cef
mov ecx, dword [rsp + 0x40]
test ecx, ecx
js 0x140739cef
call sub.msvcrt.dll__close
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll__unlink
mov r9, qword [rbx + 0x28]
lea r8, str._s.LCK
mov edx, 0x80
lea rcx, [rsp + 0xd0]
call fcn.140729470
mov ecx, r14d
call sub.msvcrt.dll__close
lea rcx, [rsp + 0xd0]
call sub.msvcrt.dll__unlink
lea r11, [rsp + 0x150]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140739f20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov rbp, r8
mov ecx, edx
xor edi, edi
xor r8d, r8d
xor edx, edx
mov r13, r9
xor esi, esi
xor r12d, r12d
xor r15b, r15b
lea r14d, [rdi + 1]
call sub.msvcrt.dll__lseek
cmp eax, 0xffffffff
jne 0x140739f6a
jmp 0x14073a0c3
mov qword [rsp + 0x188], rbx
xor ebx, ebx
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x178]
lea rdx, [rsp + 0x30]
movsxd rax, esi
mov r8d, 0x100
sub r8d, esi
add rdx, rax
call sub.msvcrt.dll__read
test eax, eax
jg 0x140739fb1
mov r15b, 1
cmp edi, esi
je 0x14073a0b7
jmp 0x140739fb3
add esi, eax
movsxd rcx, esi
lea rax, [rsp + 0x30]
nop dword [rax + rax]
cmp rbx, rcx
jge 0x14073a03c
inc rbx
inc edi
cmp byte [rax + rbx - 1], 0xa
jne 0x140739fc0
cmp byte [rsp + 0x30], 0x23
movsxd rbx, edi
jne 0x140739fdf
xor ebp, ebp
jmp 0x14073a003
mov rcx, qword [rsp + 0x170]
lea rax, [rbx - 1]
or r14d, 2
mov qword [rsp + 0x20], rax
mov r8d, r14d
lea r9, [rsp + 0x30]
mov rdx, r13
call rbp
mov ebp, eax
sub esi, edi
lea rdx, [rsp + 0x30]
movsxd r8, esi
lea rcx, [rsp + 0x30]
add rdx, rbx
mov r14d, 1
xor r12d, r12d
call sub.msvcrt.dll_memmove
xor edi, edi
xor ebx, ebx
test ebp, ebp
jne 0x14073a0b9
mov rbp, qword [rsp + 0x180]
jmp 0x140739f80
test edi, edi
je 0x14073a0a6
test r12d, r12d
jne 0x14073a09d
cmp r14d, 1
jne 0x14073a056
test esi, esi
je 0x14073a067
cmp byte [rsp + 0x30], 0x23
je 0x14073a09d
cmp esi, edi
jne 0x14073a067
test r15b, r15b
je 0x14073a067
mov r8d, 2
jmp 0x14073a06a
xor r8d, r8d
mov rcx, qword [rsp + 0x170]
lea r9, [rsp + 0x30]
movsxd rax, edi
or r8d, r14d
mov rdx, r13
mov qword [rsp + 0x20], rax
call rbp
xor edi, edi
xor ebx, ebx
xor esi, esi
mov ebp, eax
test eax, eax
jne 0x14073a0b9
mov rbp, qword [rsp + 0x180]
jmp 0x14073a0a3
mov r12d, 1
xor r14d, r14d
test r15b, r15b
je 0x140739f80
cmp esi, edi
jne 0x140739f80
xor ebp, ebp
mov rbx, qword [rsp + 0x188]
mov eax, ebp
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140740f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r15
sub rsp, 0x30
mov r9, qword [rcx + 0x10]
xor r10d, r10d
mov rax, qword [rdx]
mov rdi, r8
mov r15, rdx
mov rbx, rcx
mov ebp, r10d
mov r8, qword [r9 + 0x18]
test r8, r8
jne 0x140740fcb
mov rcx, qword [rcx]
mov r8d, dword [rcx + 0x7ec]
mov rsi, qword [rbx + 0xd0]
mov ecx, r8d
mov rdx, qword [rsi + 0x130]
cmp rcx, rdx
cmovbe edx, r8d
mov ecx, edx
cmp rcx, rdi
cmovbe edi, edx
test edi, edi
jne 0x140740ff6
xor eax, eax
jmp 0x1407411b9
test byte [rsi + 0x124], 4
mov qword [rsp + 0x58], r14
mov r14, rax
jne 0x1407410bd
movzx edx, byte [rsi + 0x141]
mov ecx, edx
and ecx, 3
movzx r8d, byte [rcx + rsi + 0x128]
lea rcx, [rdx + 1]
and ecx, 3
mov byte [rsp + 0x50], r8b
movzx r9d, byte [rcx + rsi + 0x128]
lea rcx, [rdx - 2]
and ecx, 3
mov byte [rsp + 0x51], r9b
movzx r11d, byte [rcx + rsi + 0x128]
lea rcx, [rdx - 1]
and ecx, 3
mov byte [rsp + 0x52], r11b
movzx edx, byte [rcx + rsi + 0x128]
mov ecx, edi
shr ecx, 2
mov byte [rsp + 0x53], dl
test ecx, ecx
je 0x140741087
nop dword [rax + rax]
xor byte [rax], r8b
xor byte [rax + 1], r9b
xor byte [rax + 2], r11b
xor byte [rax + 3], dl
add rax, 4
sub ecx, 1
jne 0x140741070
mov edx, edi
and edx, 3
je 0x1407410a4
mov ebp, edx
movzx ecx, byte [rsp + r10 + 0x50]
inc r10
xor byte [rax], cl
lea rax, [rax + 1]
cmp r10, rdx
jl 0x140741090
mov rcx, qword [rbx + 0xd0]
movzx eax, dil
add al, byte [rcx + 0x141]
and al, 3
mov byte [rcx + 0x141], al
mov esi, edi
add qword [r15], rsi
mov rax, qword [rbx + 0xd0]
sub qword [rax + 0x130], rsi
mov rcx, qword [rbx + 0xd0]
mov eax, dword [rcx + 0x124]
bt eax, 0xa
jae 0x140741168
bt eax, 0xb
jb 0x140741168
add rcx, 0x146
mov r8d, esi
mov rdx, r14
call fcn.140729060
test eax, eax
je 0x140741112
lea r8, str.bad_utf8
mov r9d, 8
jmp 0x140741144
mov rax, qword [rbx + 0xd0]
cmp qword [rax + 0x130], 0
jne 0x140741168
test byte [rax + 0x124], 1
je 0x140741168
cmp byte [rax + 0x146], 0
je 0x140741168
test ebp, ebp
jne 0x140741168
lea r8, str.partial_utf8
lea r9d, [rbp + 0xc]
mov edx, 0x3ef
mov rcx, rbx
call fcn.1407336c0
movsxd r8, edi
mov rdx, r14
mov ecx, 8
call fcn.1407257b0
mov eax, 0xffffffff
jmp 0x1407411b4
mov rax, qword [rbx + 0x10]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1407411a1
cmp dword [rbx + 0x404], 0
jne 0x1407411a1
mov r9, qword [rbx + 0x3d8]
mov r8d, 6
mov qword [rsp + 0x28], rsi
mov rdx, rbx
mov qword [rsp + 0x20], r14
call fcn.1407231f0
test eax, eax
jne 0x140741161
mov rax, qword [rbx + 0xd0]
and dword [rax + 0x124], 0xffffbfff
mov eax, edi
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x1407411d0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov r15d, dword [rsp + 0x38]
xor ebp, ebp
mov r11, rdx
mov r14, rcx
test r8d, r8d
je 0x1407412d0
lea esi, [rbp + 4]
xor r10d, r10d
test r8d, r8d
je 0x14074123c
movzx edi, byte [r11]
mov r10d, 1
inc r11
sub r8d, r10d
je 0x14074123f
movzx ecx, byte [r11]
inc r10d
inc r11
mov rdx, r11
sub r8d, 1
je 0x140741241
movzx edx, byte [rdx]
inc r11
inc r10d
dec r8d
jmp 0x140741243
xor dil, dil
xor cl, cl
xor dl, dl
cmp esi, r15d
jge 0x1407412d8
movzx ebx, cl
movzx ecx, dil
and ecx, 3
movzx eax, dil
shr rax, 2
shl ecx, 4
movzx eax, byte [rax + r14]
mov byte [r9], al
mov eax, ebx
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r14]
mov byte [r9 + 1], al
cmp r10d, 1
jbe 0x1407412b0
and ebx, 0xf
movzx eax, dl
shr rax, 6
shl ebx, 2
mov ecx, ebx
or rcx, rax
movzx eax, byte [rcx + r14]
mov byte [r9 + 2], al
add r9, 3
cmp r10d, 2
jbe 0x1407412b9
and edx, 0x3f
movzx eax, byte [rdx + r14]
jmp 0x1407412bb
mov byte [r9 + 2], 0x3d
add r9, 3
mov al, 0x3d
mov byte [r9], al
add ebp, 4
inc r9
add esi, 4
test r8d, r8d
jne 0x140741201
lea eax, [rbp + 1]
cmp eax, r15d
jl 0x1407412df
mov eax, 0xffffffff
jmp 0x1407412e5
mov byte [r9], 0
mov eax, ebp
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x1407419a0
Capabilities:
Hash data using sha1

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rbp
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0xa0
xorps xmm0, xmm0
mov dword [rbp - 0x29], 0x67452301
xor eax, eax
mov dword [rbp - 0x25], 0xefcdab89
xor ebx, ebx
mov dword [rbp + 0x3b], eax
mov dword [rbp - 0x21], 0x98badcfe
mov r15, r8
mov dword [rbp - 0x1d], 0x10325476
mov rsi, rdx
mov dword [rbp - 0x19], 0xc3d2e1f0
mov r14, rcx
movups xmmword [rbp - 0x15], xmm0
movups xmmword [rbp - 5], xmm0
movups xmmword [rbp + 0xb], xmm0
movups xmmword [rbp + 0x1b], xmm0
movups xmmword [rbp + 0x2b], xmm0
test rdx, rdx
je 0x140741a76
mov qword [r11 + 8], rdi
nop
movzx ecx, byte [rbp + 0x37]
lea rdx, [rbx + r14]
and ecx, 0x3f
mov edi, 0x40
sub rdi, rcx
mov rax, rsi
sub rax, rbx
cmp rdi, rax
cmovae rdi, rax
lea rax, [rbp - 9]
add rcx, rax
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp - 0x11]
movzx edx, dil
add dl, byte [rbp + 0x37]
and dl, 0x3f
mov byte [rbp + 0x37], dl
lea rcx, [rax + rdi*8]
mov qword [rbp - 0x11], rcx
test dl, 0x3f
jne 0x140741a66
lea rcx, [rbp - 0x29]
call fcn.140741d10
add rbx, rdi
cmp rbx, rsi
jb 0x140741a10
mov rdi, qword [rsp + 0xc0]
lea rcx, [rbp - 0x29]
call fcn.140741b40
movzx eax, byte [rbp - 0x1d]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov byte [rbp - 0x2a], al
movzx eax, byte [rbp - 0x1c]
mov byte [rbp - 0x2b], al
movzx eax, byte [rbp - 0x1b]
mov byte [rbp - 0x2c], al
movzx eax, byte [rbp - 0x1a]
mov byte [rbp - 0x2d], al
movzx eax, byte [rbp - 0x21]
mov byte [rbp - 0x2e], al
movzx eax, byte [rbp - 0x20]
mov byte [rbp - 0x2f], al
movzx eax, byte [rbp - 0x1f]
mov byte [rbp - 0x30], al
movzx eax, byte [rbp - 0x1e]
mov byte [rbp - 0x31], al
movzx eax, byte [rbp - 0x25]
mov byte [rbp - 0x32], al
movzx eax, byte [rbp - 0x24]
mov byte [rbp - 0x33], al
movzx eax, byte [rbp - 0x23]
mov byte [rbp - 0x34], al
movzx eax, byte [rbp - 0x22]
mov byte [rbp - 0x35], al
movzx eax, byte [rbp - 0x29]
mov byte [rbp - 0x36], al
movzx eax, byte [rbp - 0x28]
mov byte [rbp - 0x37], al
movzx eax, byte [rbp - 0x27]
mov byte [rbp - 0x38], al
movzx eax, byte [rbp - 0x26]
mov byte [rbp - 0x39], al
movzx eax, byte [rbp - 0x16]
movdqa xmm0, xmmword [rbp - 0x39]
mov byte [r15 + 0x10], al
movzx eax, byte [rbp - 0x17]
mov byte [r15 + 0x11], al
movzx eax, byte [rbp - 0x18]
mov byte [r15 + 0x12], al
movzx eax, byte [rbp - 0x19]
mov byte [r15 + 0x13], al
mov rax, r15
movdqu xmmword [r15], xmm0
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140744698
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1407446e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1407446e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1407446e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1407446e2
cmp dword [rcx + 0x84], 0xe
jbe 0x1407446e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1407446e4
xor al, al
add rsp, 0x28
ret
Function at 0x14074a2d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x14075c4c0]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14074a30c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.140744504
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14074a3c8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14074a42e
test ebx, ebx
jne 0x14074a42e
lea ecx, [rax + 2]
call fcn.140744504
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140743ce0
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret

Function at 0x14074a810
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x60], 0
xor ecx, ecx
mov dword [rsp + 0x68], 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14074a872
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14074a872
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x14074a872
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x14074a872
cmp dword [rdx + 0x84], 0xe
jbe 0x14074a872
cmp dword [rdx + 0xf8], 0
je 0x14074a872
mov ecx, ebx
call fcn.14074a6d0
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x140aa4fa8]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.14074a550
cmp dword [rsp + 0x60], 0
jne 0x14074a8b5
mov ecx, ebx
call fcn.14074a680
int3
add rsp, 0x40
pop rbx
ret
Function at 0x14074a900
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14074a95c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14074a95c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14074a95c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14074a95c
cmp dword [rcx + 0x84], 0xe
jbe 0x14074a95c
cmp dword [rcx + 0xf8], 0
je 0x14074a95c
mov ecx, ebx
call fcn.14074a6d0
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x140aa4fa8]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.14074a550
cmp dword [rsp + 0x60], 0
jne 0x14074a99f
mov ecx, ebx
call fcn.14074a680
int3
add rsp, 0x40
pop rbx
ret

Function at 0x14074aed0
Capabilities:
Get disk information

Disassembly:
push rbp
sub rsp, 0x250
mov rax, qword [0x14075c4c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x140755bd8]
mov rbp, rcx
call sub.msvcrt.dll_wcspbrk
test rax, rax
je 0x14074b091
mov qword [rsp + 0x268], rbx
xor ebx, ebx
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], rdi
call sub.msvcrt.dll__errno
mov esi, dword [rax]
call sub.msvcrt.dll__errno
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], ebx
call sub.msvcrt.dll__wfullpath
mov rdi, rax
test rax, rax
je 0x14074af4f
call sub.msvcrt.dll__errno
mov dword [rax], esi
jmp 0x14074af80
call sub.msvcrt.dll__errno
cmp dword [rax], 0x22
jne 0x14074b06f
call sub.msvcrt.dll__errno
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], esi
call sub.msvcrt.dll__wfullpath
mov rbx, rax
mov rdi, rax
test rax, rax
je 0x14074b06f
mov rax, 0xffffffffffffffff
mov rcx, rax
nop word [rax + rax]
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x14074af90
cmp rcx, 3
je 0x14074b055
inc rax
cmp word [rdi + rax*2], 0
jne 0x14074afa4
cmp rax, 5
jb 0x14074b06f
movzx eax, word [rdi]
cmp ax, 0x5c
je 0x14074afcb
cmp ax, 0x2f
jne 0x14074b06f
movzx eax, word [rdi + 2]
cmp ax, 0x5c
je 0x14074afdf
cmp ax, 0x2f
jne 0x14074b06f
movzx eax, word [rdi + 4]
cmp ax, 0x5c
je 0x14074b06f
cmp ax, 0x2f
je 0x14074b06f
movzx eax, word [rdi + 6]
lea rcx, [rdi + 6]
test ax, ax
je 0x14074b06f
cmp ax, 0x5c
je 0x14074b019
cmp ax, 0x2f
je 0x14074b019
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14074b000
test ax, ax
je 0x14074b06f
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
je 0x14074b06f
nop dword [rax + rax]
cmp ax, 0x5c
je 0x14074b049
cmp ax, 0x2f
je 0x14074b049
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14074b030
test ax, ax
je 0x14074b055
cmp word [rcx + 2], 0
jne 0x14074b06f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, rbx
cmp eax, 1
jbe 0x14074b072
call fcn.14074a1a5
mov al, 1
jmp 0x14074b079
mov rcx, rbx
call fcn.14074a1a5
xor al, al
mov rsi, qword [rsp + 0x270]
mov rbx, qword [rsp + 0x268]
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140743ce0
add rsp, 0x250
pop rbp
ret
Function at 0x141b93058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141b931df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141b93089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b9306f
add dl, dl
jne 0x141b93096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b930f6
xor eax, eax
add dl, dl
jne 0x141b930a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b931ad
add dl, dl
jne 0x141b930b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b930c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b930d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b930dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141b930ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141b9307e
mov eax, 1
add dl, dl
jne 0x141b93106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b93113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b930fb
sub eax, ebx
mov ebx, 1
jne 0x141b9314c
mov ecx, 1
add dl, dl
jne 0x141b9312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b9313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b93123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b9307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141b93168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b93175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b9315d
cmp eax, 0x7d00
jae 0x141b9319b
cmp eax, 0x500
jb 0x141b93196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b9307e
cmp eax, 0x7f
ja 0x141b9319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b9307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141b931d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141b9307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400074a0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400074b0]
mov dword [rax], 1
mov rax, qword [0x1400074c0]
mov dword [rax], 1
mov rax, qword [0x140007430]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140007490]
mov dword [0x14000a00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140007570]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140007550]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400073f0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a