joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005187
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140017eb0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x14019c998]
xor rax, rsp
mov qword [rsp + 0x28], rax
movzx eax, word [rdx]
xor r9d, r9d
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test ax, ax
je 0x140017f7e
mov edi, r9d
nop dword [rax]
movzx eax, ax
cmp eax, 0x7f
ja 0x140017f03
mov byte [rsp + 0x20], al
mov eax, 1
jmp 0x140017f46
movzx edx, al
mov ecx, eax
and dl, 0x3f
shr ecx, 6
add dl, 0x80
cmp eax, 0x7ff
ja 0x140017f2a
sub cl, 0x40
mov byte [rsp + 0x21], dl
mov byte [rsp + 0x20], cl
mov eax, 2
jmp 0x140017f46
shr eax, 0xc
and cl, 0x3f
sub al, 0x20
mov byte [rsp + 0x22], dl
add cl, 0x80
mov byte [rsp + 0x20], al
mov byte [rsp + 0x21], cl
mov eax, 3
movsxd r8, eax
lea rbx, [r8 + r9]
test rsi, rsi
je 0x140017f69
cmp rbx, rbp
jae 0x140017f8d
test eax, eax
jle 0x140017f6c
lea rcx, [rsi + r9]
lea rdx, [rsp + 0x20]
call fcn.140003814
mov r9, rbx
movzx eax, word [r14 + rdi*2 + 2]
inc rdi
test ax, ax
jne 0x140017ef0
test rsi, rsi
je 0x140017f8d
cmp r9, rbp
jae 0x140017f8d
mov byte [rsi + r9], 0
mov rax, r9
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400037fb
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140005ef7
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1400b28f0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x14016b148]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x14016b140]
call fcn.1400b2368
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1400b2930
call qword [0x1401c3020]
jmp 0x1400b2936
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140006037
Capabilities:
Set environment variable

Disassembly:
jmp 0x1401353f8
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140002ea5
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140135482
cmp byte [rbp - 0x21], r15b
je 0x14013547d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1401354b8
call fcn.140006712
test eax, eax
jne 0x1401354a4
cmp byte [rbp - 0x21], r15b
je 0x14013549c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1401354b8
cmp byte [rbp - 0x21], r15b
je 0x1401354b5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140006a9b
test eax, eax
jne 0x140135558
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140002ea5
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1401354f7
cmp byte [rbp - 0x21], r15b
je 0x14013552c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14013552c
call fcn.140006712
test eax, eax
jne 0x140135518
cmp byte [rbp - 0x21], r15b
je 0x140135511
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14013552c
cmp byte [rbp - 0x21], r15b
je 0x140135529
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140006a9b
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140135558
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14013555b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140135569
mov rcx, rdi
call fcn.140001271
cmp byte [rbp + 0x3f], r15b
je 0x140135578
mov rcx, qword [rbp + 0x27]
call fcn.140001271
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400061ef
Capabilities:
Parse pe header

Disassembly:
jmp 0x14010d054
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14010cdb0

Function at 0x140006a82
Capabilities:
Get system information on windows

Disassembly:
jmp 0x14006a500
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
add rsp, 0x58
ret
Function at 0x140006ac3
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x140093be0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x1401a9e50]
movzx eax, dl
and al, 7
mov rbx, rdx
mov rdi, rcx
cmp al, 6
jne 0x140093c23
mov rax, qword [rdx + 2]
cmp rax, qword [0x1401a9e40]
je 0x140093c12
cmp rax, r8
jne 0x140093c23
mov rcx, qword [rdx - 6]
mov rax, qword [0x1401a9fb8]
cmp qword [rcx + 0x40], rax
jne 0x140093c2f
lea rcx, str.send
call fcn.140005777
mov rax, qword [rbx - 6]
mov rcx, qword [rax + 0x40]
test cl, 0x1f
jne 0x140093c43
call fcn.140004764
jmp 0x140093c47
mov rax, qword [rcx - 6]
xor r9d, r9d
movsxd rcx, eax
mov rdx, rdi
lea r8d, [r9 + 1]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.WS2_32.dll_send]
Function at 0x1400172c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400172c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12, rcx
test r8, r8
jne 0x1400172ea
xor al, al
jmp 0x1400172f6
cmp r8, 0x20
jne 0x140017472
mov al, 1
movsxd rdi, dword [rsp + 0xa0]
mov r8d, 0xff
movzx ecx, al
movzx eax, cl
xor al, 1
cmp dword [r9 + 0x58], 0
movzx r13d, al
mov rax, qword [rdx - 6]
cmovne r13d, ecx
xor ebx, ebx
test r13b, r13b
mov esi, ebx
mov rcx, qword [rax + 0x18]
cmovne r8d, ebx
mov rax, qword [r9 + 0x28]
cqo
mov dword [rsp + 0x20], r8d
and edx, 7
mov r10, qword [rcx - 2]
add rax, rdx
mov rcx, qword [r9 + 0x30]
add r10, 0x10
sar rax, 3
add rcx, 7
shr rcx, 3
mov r11, rax
mov qword [rsp + 0x30], r10
mov r14, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rcx
cmp rax, rcx
jge 0x14001744e
lea eax, [rbx + 8]
nop word [rax + rax]
movzx r15d, byte [r14 + r10]
cmp r15b, r8b
je 0x140017442
mov rbp, rax
lea rax, [rcx - 1]
cmp r14, rax
jne 0x1400173b6
mov rax, qword [r9 + 0x30]
cqo
and edx, 7
lea rbp, [rdx + rax]
mov eax, 8
and ebp, 7
sub rbp, rdx
cmove rbp, rax
cmp r14, r11
jne 0x1400173ce
mov rax, qword [r9 + 0x28]
cqo
and edx, 7
lea rbx, [rdx + rax]
and ebx, 7
sub rbx, rdx
cmp rbx, rbp
jge 0x14001743d
nop dword [rax]
nop word [rax + rax]
movzx edx, r15b
movzx ecx, bl
shr dl, cl
and dl, 1
cmp dl, r13b
jne 0x140017419
mov eax, edi
test edi, edi
je 0x14001745c
sub eax, 1
je 0x1400174cf
cmp eax, 1
je 0x140017416
mov rdx, rdi
mov rcx, r12
shl rdx, 5
call fcn.140001497
jmp 0x140017419
inc rsi
inc rbx
cmp rbx, rbp
jl 0x1400173e0
mov r9, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x20]
mov r10, qword [rsp + 0x30]
mov r11, qword [rsp + 0x38]
xor ebx, ebx
lea eax, [rbx + 8]
inc r14
cmp r14, rcx
jl 0x140017380
cmp edi, 2
jne 0x140017466
shl rsi, 5
mov rax, rsi
jmp 0x1400174b7
lea rax, [rbx + r14*8]
shl rax, 5
jmp 0x1400174b7
mov rsi, qword [0x1401a9fb8]
mov rax, rsi
jmp 0x1400174b7
movsxd rdx, dword [rsp + 0xa0]
mov ecx, edx
test edx, edx
je 0x1400174dc
sub ecx, 1
je 0x1400174a9
cmp ecx, 1
je 0x140017498
shl rdx, 5
mov rcx, r12
call fcn.140001497
jmp 0x1400174b7
cmp dword [r9 + 0x58], 0
jne 0x1400174e3
mov rax, qword [r9 + 0x30]
shl rax, 5
jmp 0x1400174b7
cmp dword [r9 + 0x58], 0
je 0x1400174d7
mov rax, qword [0x1401a9fb8]
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rsp + 0x90]
mov rax, r8
jmp 0x1400174b7
cmp dword [r9 + 0x58], 0
jne 0x1400174b0
xor eax, eax
jmp 0x1400174b7
Function at 0x1400902f0
Capabilities:
Get hostname

Disassembly:
jmp 0x1400902f0
sub rsp, 0x58
mov rax, qword [0x14019c998]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x140090338
mov rax, qword [0x1401a9fb8]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400037fb
add rsp, 0x58
ret
lea rcx, [rsp + 0x28]
call fcn.1400050e7
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400037fb
add rsp, 0x58
ret

Function at 0x140093300
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x1400932f0
xor edx, edx
jmp 0x140093300
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov r8, qword [0x1401a9e50]
movzx eax, cl
and al, 7
mov esi, edx
mov rbx, rcx
cmp al, 6
jne 0x14009334c
mov rax, qword [rcx + 2]
cmp rax, qword [0x1401a9e40]
je 0x14009333b
cmp rax, r8
jne 0x14009334c
mov rcx, qword [rcx - 6]
mov rax, qword [0x1401a9fb8]
cmp qword [rcx + 0x40], rax
jne 0x14009335b
mov rdx, rbx
lea rcx, str.receive
call fcn.140005777
mov rax, qword [rbx - 6]
mov rcx, qword [rax + 0x40]
test cl, 0x1f
jne 0x14009336f
call fcn.140004764
jmp 0x140093372
mov eax, dword [rcx - 6]
movsxd rdi, eax
xor ebp, ebp
nop word [rax + rax]
mov r9d, esi
lea rdx, [rsp + 0x30]
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
je 0x1400933dc
cmp eax, 0xffffffff
jne 0x1400933af
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1400933dc
mov ecx, dword [0x1401a7c2c]
inc ecx
mov dword [0x1401a7c2c], ecx
cmp ecx, 0x400
jle 0x1400933d0
call fcn.140005bfa
mov dword [0x1401a7c2c], ebp
cmp ebx, 1
jl 0x140093380
movzx eax, byte [rsp + 0x30]
je 0x1400933e1
mov eax, 0xffff
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140093be0
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x140093be0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x1401a9e50]
movzx eax, dl
and al, 7
mov rbx, rdx
mov rdi, rcx
cmp al, 6
jne 0x140093c23
mov rax, qword [rdx + 2]
cmp rax, qword [0x1401a9e40]
je 0x140093c12
cmp rax, r8
jne 0x140093c23
mov rcx, qword [rdx - 6]
mov rax, qword [0x1401a9fb8]
cmp qword [rcx + 0x40], rax
jne 0x140093c2f
lea rcx, str.send
call fcn.140005777
mov rax, qword [rbx - 6]
mov rcx, qword [rax + 0x40]
test cl, 0x1f
jne 0x140093c43
call fcn.140004764
jmp 0x140093c47
mov rax, qword [rcx - 6]
xor r9d, r9d
movsxd rcx, eax
mov rdx, rdi
lea r8d, [r9 + 1]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.WS2_32.dll_send]
Function at 0x140093c90
Capabilities:
Send data
Send data on socket

Disassembly:
jmp 0x140093c90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, r8b
mov rbx, r8
mov r8, qword [0x1401a9e50]
and al, 7
mov edi, edx
mov rsi, rcx
cmp al, 6
jne 0x140093cdb
mov rax, qword [rbx + 2]
cmp rax, qword [0x1401a9e40]
je 0x140093cca
cmp rax, r8
jne 0x140093cdb
mov rcx, qword [rbx - 6]
mov rax, qword [0x1401a9fb8]
cmp qword [rcx + 0x40], rax
jne 0x140093cea
mov rdx, rbx
lea rcx, str.send
call fcn.140005777
mov rax, qword [rbx - 6]
mov rcx, qword [rax + 0x40]
test cl, 0x1f
jne 0x140093d01
call fcn.140004764
mov rbx, rax
jmp 0x140093d05
mov rbx, qword [rcx - 6]
mov r8d, 0x3ff
lea rdx, [0x1401ac790]
mov rcx, rsi
call fcn.140001406
mov rdx, rax
movsxd rcx, ebx
xor r9d, r9d
mov r8d, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.WS2_32.dll_send]
Function at 0x140093d70
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor edi, edi
movzx eax, dl
and al, 7
mov qword [rsp + 0x78], rdi
mov rbp, r8
mov r8, qword [0x1401a9e50]
mov r14, r9
mov rsi, rdx
mov rbx, rcx
cmp al, 6
jne 0x140093dcf
mov rax, qword [rdx + 2]
cmp rax, qword [0x1401a9e40]
je 0x140093dbe
cmp rax, r8
jne 0x140093dcf
mov rcx, qword [rdx - 6]
mov rax, qword [0x1401a9fb8]
cmp qword [rcx + 0x40], rax
jne 0x140093dd7
mov rcx, rbx
call fcn.140005777
mov rax, qword [rsi - 6]
mov rcx, qword [rax + 0x40]
test cl, 0x1f
jne 0x140093dee
call fcn.140004764
mov r12, rax
jmp 0x140093df2
mov r12d, dword [rcx - 6]
mov rdx, rbp
mov rcx, rbx
call fcn.140006118
mov rdx, qword [rsp + 0x90]
lea r8, [rsp + 0x78]
mov rbp, r14
mov rcx, rbx
shr rbp, 5
mov r15, rax
call fcn.140093190
mov rcx, qword [rsp + 0x80]
mov r13, rax
mov qword [rsp + 0x88], rax
mov rcx, qword [rcx - 2]
mov rdx, qword [rcx + 8]
shr rdx, 5
cmp edx, ebp
jge 0x140093e4a
mov rdx, r14
mov rcx, rbx
call fcn.1400069b0
test r13, r13
lea r14, [rsp + 0x78]
cmove r14, rdi
cmp ebp, 0x400
jl 0x140093e6f
lea eax, [rbp + 1]
movsxd rcx, eax
call qword [0x14019a240]
mov rbx, rax
jmp 0x140093e76
lea rbx, [0x1401ac790]
mov rcx, qword [rsi - 6]
mov r13d, edi
mov rax, qword [0x1401a9fb8]
mov r8d, ebp
mov qword [rsp + 0x28], r14
mov rdx, rbx
cmp qword [rcx + 0x50], rax
mov rax, qword [rsp + 0x88]
setne r13b
movsxd rcx, r12d
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jle 0x140093eb8
mov esi, eax
jmp 0x140093ec3
mov esi, edi
test eax, eax
jne 0x140093ec3
test r13d, r13d
jne 0x140093ee3
mov eax, dword [0x1401a7c2c]
inc eax
mov dword [0x1401a7c2c], eax
cmp eax, 0x400
jle 0x140093ee3
call fcn.140005bfa
mov dword [0x1401a7c2c], edi
movsxd r14, esi
mov byte [r14 + rbx], dil
test esi, esi
jle 0x140093fa0
cmp esi, 0x20
jb 0x140093fa0
lea eax, [rsi - 1]
movsxd rcx, eax
lea rax, [rcx + rbx]
lea rdx, [r15 + rcx*2]
cmp r15, rax
ja 0x140093f17
cmp rdx, rbx
jae 0x140093fa0
mov eax, esi
and eax, 0x8000001f
jge 0x140093f27
dec eax
or eax, 0xffffffe0
inc eax
sub esi, eax
lea rcx, [rbx + 0x10]
mov r8, 0xfffffffffffffff0
movsxd r9, esi
sub r8, rbx
lea rdx, [r15 + 0x20]
nop
movq xmm0, qword [rcx - 0x10]
add edi, 0x20
movq xmm1, qword [rcx - 8]
lea rcx, [rcx + 0x20]
punpcklbw xmm0, xmm0
lea rax, [r8 + rcx]
punpcklbw xmm1, xmm1
lea rdx, [rdx + 0x40]
psraw xmm0, 8
psraw xmm1, 8
movdqu xmmword [rdx - 0x60], xmm0
movq xmm0, qword [rcx - 0x20]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rdx - 0x50], xmm1
movq xmm1, qword [rcx - 0x18]
punpcklbw xmm1, xmm1
psraw xmm1, 8
movdqu xmmword [rdx - 0x40], xmm0
movdqu xmmword [rdx - 0x30], xmm1
cmp rax, r9
jl 0x140093f40
movsxd rcx, edi
cmp rcx, r14
jge 0x140093fc1
nop dword [rax + rax]
movsx eax, byte [rcx + rbx]
mov word [r15 + rcx*2], ax
inc rcx
cmp rcx, r14
jl 0x140093fb0
cmp ebp, 0x400
jl 0x140093fd2
mov rcx, rbx
call qword [0x14019a248]
mov rbx, qword [rsp + 0x70]
shl r14, 5
mov rax, r14
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a4778
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400a4778
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a47c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a47c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a47c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a47c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a47c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a47c4
xor al, al
add rsp, 0x28
ret

Function at 0x1400e8920
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140001ea1
sub rsp, rax
mov rax, qword [0x14019c998]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1400063e3
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400e896f
mov rax, rbp
jmp 0x1400e8a77
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x1af8e0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140002c8e
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x1af8e0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400e8a73
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e8a73
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140002c8e
test rax, rax
js 0x1400e8a73
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400e8a73
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400e8a65
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400e8a65
cmp byte [rcx], 0xd
jne 0x1400e8a4b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400e8a5a
cmp byte [rcx + 1], 0xa
jne 0x1400e8a5a
inc rcx
jmp 0x1400e8a5a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x19cda0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400e8a2d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400e8a77
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400037fb
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140108984
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x14019c998]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x140171878]
mov rbp, rcx
call fcn.14000309e
xor edi, edi
test rax, rax
je 0x140108a6a
mov ebx, edi
call fcn.140002da1
mov r14d, dword [rax]
call fcn.140002da1
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.140002964
mov rsi, rax
test rax, rax
je 0x1401089fb
call fcn.140002da1
mov dword [rax], r14d
jmp 0x140108a25
call fcn.140002da1
cmp dword [rax], 0x22
jne 0x140108a62
call fcn.140002da1
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140002964
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x140108a62
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x140108a29
cmp rax, 3
je 0x140108a44
mov rcx, rsi
call fcn.1401088a0
test al, al
je 0x140108a55
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140108a55
mov dil, 1
mov rcx, rbx
call fcn.140002d1a
mov al, dil
jmp 0x140108a6c
mov rcx, rbx
call fcn.140002d1a
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400037fb
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14012ba10
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1401af8e0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x14012ba6e
cmp word [rdx], r12w
jne 0x14012ba6e
or byte [rax + r8*8 + 0x38], cl
jmp 0x14012ba74
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x14012bbcf
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x14012bbaa
lea r9, [rcx + 2]
cmp ax, r13w
je 0x14012baad
mov rcx, r9
jmp 0x14012bad0
cmp r9, rdx
jae 0x14012bae7
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x14012ba91
jmp 0x14012bbcf
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14012bba4
cmp dword [rsp + 0x80], edi
je 0x14012bba4
mov rdx, r14
lea r11, [0x1401af8e0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x14012bb7d
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x14012bb50
mov word [rbx], r12w
jmp 0x14012bbcb
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x14012bb59
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x14012bbcb
cmp word [rsp + 0x70], r12w
jne 0x14012bb8a
cmp rbx, rsi
je 0x14012bb4a
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.140001d57
cmp word [rsp + 0x70], r12w
je 0x14012bbcf
mov word [rbx], r13w
jmp 0x14012bbcb
lea r11, [0x1401af8e0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x14012bbc7
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x14012bbcf
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4156a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415846
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431780
xorps xmm15, xmm15
mov r14, qword [0x0062ffd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41570b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415720
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x415745
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415759
cmp rbx, 0x1000
jae 0x415715
nop dword [rax]
jmp 0x4157c9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41576d
xor edx, edx
jmp 0x4157c0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00431780
xorps xmm15, xmm15
mov r14, qword [0x0062ffd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x41574f
jmp 0x415734
call fcn.00461540
xorps xmm15, xmm15
mov r14, qword [0x0062ffd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00435cc0
lea rax, [0x005099e1]
mov ebx, 0x18
call fcn.004365c0
mov rax, qword [rsp + 0x38]
call fcn.004362c0
lea rax, [0x00509ad1]
mov ebx, 0x19
call fcn.004365c0
mov rax, qword [rsp + 0x30]
nop
call fcn.004362c0
call fcn.00435f20
call fcn.00435d40
lea rax, [0x0050cb7a]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00434380
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d9a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.004156a0