joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14026f790
Capabilities:
Create directory

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 0x8000
mov edx, 2
call fcn.1400065d0
mov rsi, rax
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1402790a0
mov rbx, qword [rsp + 0x30]
lea r8, [0x140495be8]
mov edx, 0x7fff
mov rcx, rsi
mov r9, rbx
call fcn.1400143a0
mov word [rsi + 0xfffe], 0
cmp eax, 0x7fff
ja 0x14026f905
mov ebp, eax
movsxd r15, eax
mov edx, 0x8000
mov rcx, rbx
call fcn.1402c12a0
cmp rax, r15
jne 0x14026f905
cmp ebp, 0x7ff7
ja 0x14026f910
mov dword [rsp + 0x2c], 0
lea rdx, [rsp + 0x2c]
mov ecx, 4
call fcn.14026af30
test al, al
je 0x14026f950
mov r9d, dword [rsp + 0x2c]
lea r8, [0x140475708]
lea rbx, [rsp + 0x47]
mov edx, 9
mov rcx, rbx
call fcn.1400084c0
lea rcx, [rsp + 0x38]
mov rdx, rbx
call fcn.1402790a0
mov rbx, qword [rsp + 0x38]
mov r14d, 0x7fff
sub r14, r15
lea rcx, [rsi + r15*2]
lea r8, [0x140495be8]
mov rdx, r14
mov r9, rbx
call fcn.1400143a0
mov word [rsi + 0xfffe], 0
movsxd r15, eax
cmp r14, r15
setl al
test r15d, r15d
sets cl
or cl, al
jne 0x14026f8c2
mov edx, 0x8000
mov rcx, rbx
call fcn.1402c12a0
mov bl, 1
cmp rax, r15
je 0x14026f8cf
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14026f8de
call fcn.14029f9fc
test bl, bl
je 0x14026f910
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14026f950
mov rcx, rsi
mov rdx, 0xffffffffffffffff
xor r8d, r8d
call fcn.140278b50
jmp 0x14026f958
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14026f921
call fcn.14029f9fc
mov rcx, rsi
call fcn.1402bbd1c
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14026f94a
mov rax, rdi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.14029fd30
int3
mov rcx, rdi
call fcn.14026f970
mov rdi, rax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x14026f91c
jmp 0x14026f921
Function at 0x14026f970
Capabilities:
Create directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, 0x8000
mov edx, 2
call fcn.1400065d0
mov rsi, rax
lea rcx, [rsp + 0x28]
mov rdx, rdi
call fcn.1402790a0
mov rdi, qword [rsp + 0x28]
lea r8, [0x140495be8]
mov edx, 0x7fff
mov rcx, rsi
mov r9, rdi
call fcn.1400143a0
mov word [rsi + 0xfffe], 0
cmp eax, 0x7fff
ja 0x14026fab7
mov ebx, eax
movsxd r14, eax
mov edx, 0x8000
mov rcx, rdi
call fcn.1402c12a0
cmp rax, r14
jne 0x14026fab7
cmp ebx, 0x7fdb
ja 0x14026fac2
lea rcx, [rsp + 0x30]
call qword [sym.imp.RPCRT4.dll_UuidCreateSequential]
cmp eax, 0x720
je 0x14026fa1b
test eax, eax
jne 0x14026fac2
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
jne 0x14026fac2
mov rdi, qword [rsp + 0x20]
mov ebx, 0x7fff
sub rbx, r14
lea rcx, [rsi + r14*2]
lea r8, [0x140495be8]
mov rdx, rbx
mov r9, rdi
call fcn.1400143a0
mov word [rsi + 0xfffe], 0
movsxd r14, eax
cmp rbx, r14
setl al
test r14d, r14d
sets cl
or cl, al
jne 0x14026fab7
mov edx, 0x8000
mov rcx, rdi
call fcn.1402c12a0
cmp rax, r14
jne 0x14026fab7
lea rcx, [rsp + 0x20]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
xor edi, edi
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14026fac4
mov rcx, rsi
mov rdx, 0xffffffffffffffff
xor r8d, r8d
call fcn.140278b50
mov rdi, rax
jmp 0x14026fac4
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14026fad3
call fcn.14029f9fc
mov rcx, rsi
call fcn.1402bbd1c
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14026faf9
mov rax, rdi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14029fd30
int3
Function at 0x14026fb00
Capabilities:
Delete directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov ebx, r8d
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
call fcn.1402750d0
test bl, bl
je 0x14026fbcf
mov ecx, 0x8000
mov edx, 2
call fcn.1400065d0
mov rsi, rax
mov qword [rsp + 0x28], rax
mov word [rax], 0
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x14026fc0d
lea r8, [0x140495be8]
mov edx, 0x7fff
mov rcx, rsi
mov r9, rdi
call fcn.1400143a0
mov word [rsi + 0xfffe], 0
cmp eax, 0x7fff
ja 0x14026fc02
mov ebx, eax
movsxd r14, eax
mov edx, 0x8000
mov rcx, rdi
call fcn.1402c12a0
cmp rax, r14
jne 0x14026fc02
mov qword [rsp + 0x30], r14
test ebx, ebx
je 0x14026fc0d
cmp word [rsi + r14*2 - 2], 0x5c
jne 0x14026fbbc
lea rax, [r14 - 1]
mov qword [rsp + 0x30], rax
mov word [rsi + r14*2 - 2], 0
lea rcx, [rsp + 0x28]
call fcn.14026fd50
mov edi, eax
mov rsi, qword [rsp + 0x28]
jmp 0x14026fc0f
mov rcx, qword [rsp + 0x38]
mov dl, 1
call fcn.140275950
cmp eax, 1
jne 0x14026fbf3
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne dil
jmp 0x14026fc17
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
jmp 0x14026fc17
mov ecx, reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov rcx, rsi
call fcn.1402bbd1c
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14026fc26
call fcn.14029f9fc
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14026fc43
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.14029fd30
int3

Function at 0x14026fc50
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, r8
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.1402750d0
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14026fcff
test al, 0x10
je 0x14026fd05
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14026fd05
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.1402750d0
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne sil
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14026fd12
call fcn.14029f9fc
jmp 0x14026fd12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14026fd21
call fcn.14029f9fc
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x14026fd3b
mov eax, esi
add rsp, 0x58
pop rdi
pop rsi
ret
call fcn.14029fd30
int3
Function at 0x140274bb0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rdi, r8
mov rsi, rdx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 0x10]
mov ecx, dword [rax]
call fcn.1402b3664
mov rbx, rax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov rcx, rax
mov rdx, rsi
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140274ca8
mov edi, dword [rsp + 0x44]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x140274c8c
mov ecx, dword [rsp + 0x44]
add rcx, rcx
call fcn.14029fa30
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebx, eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov ecx, ebx
xor edx, edx
mov r8, rsi
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9d, dword [rsp + 0x44]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, ebx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov rcx, rdi
call fcn.14029f9fc
movsxd rdi, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140274cc0
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov rdi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
je 0x140274c9d
call fcn.14029fd30
int3

Function at 0x140274e30
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx + 0x10]
mov ecx, dword [rax]
call fcn.1402b3664
xor edi, edi
mov rcx, rax
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140274e7a
mov rax, qword [rsi + 0x10]
mov ecx, dword [rax]
call fcn.1402b3664
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne dil
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140275950
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov eax, 5
cmp ecx, 0xffffffff
je 0x140275a07
test ecx, 0x400
jne 0x140275996
shr ecx, 4
and ecx, 1
mov eax, ecx
jmp 0x140275a07
mov eax, 2
test bl, bl
je 0x140275a07
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
mov eax, 5
cmp rsi, 0xffffffffffffffff
je 0x140275a07
lea rdx, [rsp + 0x44]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x44]
shr ecx, 4
and ecx, 1
test edi, edi
mov eax, 5
cmovne eax, ecx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140275a23
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
call fcn.14029fd30
int3

Function at 0x140275b70
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x28]
call fcn.1402750d0
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
mov edx, eax
shr edx, 0xa
and edx, 1
test cl, dl
jne 0x140275bc3
mov ecx, 0x1126
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
test rsi, rsi
jne 0x140275be3
jmp 0x140275beb
mov rcx, rsi
test al, 0x10
jne 0x140275bd2
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140275bd8
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne dil
test rsi, rsi
je 0x140275beb
mov rcx, rsi
call fcn.14029f9fc
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140275c05
mov eax, edi
add rsp, 0x38
pop rdi
pop rsi
ret
call fcn.14029fd30
int3
Function at 0x140275c10
Capabilities:
Check if file exists
Delete directory
Delete file
Move file

Disassembly:
xor ecx, ecx
jmp 0x140275c20
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov ebx, ecx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.1402750d0
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140275cde
mov ecx, eax
shr ecx, 4
and ecx, 1
test eax, 0x400
mov eax, 2
cmove eax, ecx
cmp eax, ebx
jne 0x140275cde
lea rcx, [rsp + 0x28]
mov rdx, rdi
call fcn.1402750d0
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.14026f420
cmp eax, 1
jne 0x140275d06
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
test eax, 0x400
sete al
or al, cl
jne 0x140275d06
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
mov edx, eax
shr edx, 0xa
and edx, 1
test cl, dl
jne 0x140275ced
mov ecx, 0x1126
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
test rdi, rdi
jne 0x140275d22
jmp 0x140275d2a
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x140275d2a
mov rcx, rdi
test al, 0x10
jne 0x140275cfc
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140275d02
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140275d58
mov rcx, rsi
mov rdx, rdi
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
test rdi, rdi
je 0x140275d2a
mov rcx, rdi
call fcn.14029f9fc
test rsi, rsi
je 0x140275d37
mov rcx, rsi
call fcn.14029f9fc
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140275d52
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.14029fd30
int3
xor ebx, ebx
test rdi, rdi
jne 0x140275d22
jmp 0x140275d2a
Function at 0x140275c20
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
xor ecx, ecx
jmp 0x140275c20
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, r8
mov ebx, ecx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.1402750d0
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140275cde
mov ecx, eax
shr ecx, 4
and ecx, 1
test eax, 0x400
mov eax, 2
cmove eax, ecx
cmp eax, ebx
jne 0x140275cde
lea rcx, [rsp + 0x28]
mov rdx, rdi
call fcn.1402750d0
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.14026f420
cmp eax, 1
jne 0x140275d06
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
sete cl
test eax, 0x400
sete al
or al, cl
jne 0x140275d06
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne cl
mov edx, eax
shr edx, 0xa
and edx, 1
test cl, dl
jne 0x140275ced
mov ecx, 0x1126
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
test rdi, rdi
jne 0x140275d22
jmp 0x140275d2a
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x140275d2a
mov rcx, rdi
test al, 0x10
jne 0x140275cfc
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140275d02
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140275d58
mov rcx, rsi
mov rdx, rdi
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
test rdi, rdi
je 0x140275d2a
mov rcx, rdi
call fcn.14029f9fc
test rsi, rsi
je 0x140275d37
mov rcx, rsi
call fcn.14029f9fc
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140275d52
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
call fcn.14029fd30
int3
xor ebx, ebx
test rdi, rdi
jne 0x140275d22
jmp 0x140275d2a

Function at 0x140275d70
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
mov ecx, 2
jmp 0x140275c20
Function at 0x140276420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rsi, r8
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x78]
call fcn.1402750d0
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402764d5
test eax, 0x400
je 0x1402764bb
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x1402764d5
mov rbx, rax
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x1402764d5
mov eax, dword [rsp + 0x40]
shr eax, 4
and eax, 1
mov qword [rsi], rax
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1402b2644
test eax, eax
je 0x14027650f
mov qword [rsi], 5
test rdi, rdi
je 0x1402764e9
mov rcx, rdi
call fcn.14029f9fc
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140276509
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.14029fd30
int3
imul rax, qword [rsp + 0x70], 0x3e8
mov qword [rsi + 8], rax
imul rax, qword [rsp + 0x68], 0x3e8
mov qword [rsi + 0x10], rax
imul rax, qword [rsp + 0x60], 0x3e8
mov qword [rsi + 0x18], rax
movzx eax, word [rsp + 0x46]
mov qword [rsi + 0x20], rax
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x28], rax
test rdi, rdi
jne 0x1402764e1
jmp 0x1402764e9

Function at 0x140276a90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
mov ebx, r8d
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x38]
call fcn.1402750d0
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, 5
cmp eax, 0xffffffff
je 0x140276b54
test eax, 0x400
jne 0x140276ae3
shr eax, 4
and eax, 1
mov edi, eax
jmp 0x140276b54
mov edi, 2
test bl, bl
je 0x140276b54
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
xor edx, edx
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 5
cmp rax, 0xffffffffffffffff
je 0x140276b54
mov rbx, rax
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x44]
shr eax, 4
and eax, 1
test edi, edi
mov edi, 5
cmovne edi, eax
test rsi, rsi
je 0x140276b61
mov rcx, rsi
call fcn.14029f9fc
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140276b7f
mov eax, edi
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
call fcn.14029fd30
int3
Function at 0x140278e40
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rsi, rdx
mov ebx, ecx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
test rax, rax
je 0x140278f27
mov eax, dword [rsp + 0x44]
cmp ebx, eax
jge 0x140278e96
mov dword [rsp + 0x44], ebx
mov eax, ebx
test eax, eax
jle 0x140278f1e
xor r12d, r12d
xorps xmm6, xmm6
mov r13, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax + rax]
mov rbx, qword [rdi + r12*8]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
movsxd r14, eax
mov rcx, r14
call fcn.140006630
mov r15, rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, 0xffffffff
call r13
mov qword [rsi + r12*8], r15
inc r12
movsxd rax, dword [rsp + 0x44]
cmp r12, rax
jl 0x140278eb0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
setne al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x140278f53
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14029fd30
int3
Function at 0x140282230
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, dword [0x1404b15b8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
test rax, rax
je 0x140282274
mov ecx, 0x230
add rcx, qword [rax + 0x7a0]
jmp 0x140282288
mov ecx, dword [0x1404a7e94]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
test rax, rax
je 0x1402822eb
movabs rax, 0x7ffffffffffffff8
cmp rsi, rax
jge 0x140282304
add rsi, 7
and rsi, 0xfffffffffffffff8
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
sub rdx, rax
cmp rdx, rsi
jge 0x1402822c9
mov rdx, rsi
call fcn.140228140
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
je 0x1402822e5
jmp 0x1402822fe
lea rdx, [rax + rsi]
mov qword [rcx], rdx
add qword [rcx + 0x10], rsi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
jne 0x1402822fe
add rsp, 0x40
pop rsi
ret
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x1404a7eb8]
je 0x1402822e5
call fcn.14029fd30
int3
lea rax, str..._.._runtime_vm_zone.h
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x101
lea rdx, str.Zone::Alloc:_size_is_too_large:_size_lld
lea rcx, [rsp + 0x28]
mov r8, rsi
call fcn.1402d94a0
int3

Function at 0x14029d990
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1404a6de8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14029d9bc
cmp byte [rax + 8], 0
jne 0x14029d9c6
mov rcx, rax
call fcn.140041280
test rax, rax
jne 0x14029d9c6
call fcn.1402021d0
test rax, rax
je 0x14029d9d6
mov rcx, rax
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.140202050
nop
add rsp, 0x20
pop rsi
ret

Function at 0x1402a17d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402a1822
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402a1822
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402a1822
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402a1822
cmp dword [rcx + 0x84], 0xe
jbe 0x1402a1822
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1402a1824
xor al, al
add rsp, 0x28
ret
Function at 0x1402af544
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1402af57b
call fcn.1402b238c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1402b3c14
xor eax, eax
jmp 0x1402af609
mov rdx, r9
mov rcx, r8
call fcn.1402af62c
mov rbx, rax
test rax, rax
je 0x1402af606
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1402af690]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1402af5f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1402b23cc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1402af5da
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1402af5e9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1402c91f0
jmp 0x1402af606
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1402af603
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1402af764
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1402af8ac

Function at 0x1402b288c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1404a7eb8]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x1404991b8]
mov rbp, rcx
call fcn.1402ce980
xor edi, edi
test rax, rax
je 0x1402b2972
mov ebx, edi
call fcn.1402b238c
mov r14d, dword [rax]
call fcn.1402b238c
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.1402d14c4
mov rsi, rax
test rax, rax
je 0x1402b2903
call fcn.1402b238c
mov dword [rax], r14d
jmp 0x1402b292d
call fcn.1402b238c
cmp dword [rax], 0x22
jne 0x1402b296a
call fcn.1402b238c
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.1402d14c4
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x1402b296a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1402b2931
cmp rax, 3
je 0x1402b294c
mov rcx, rsi
call fcn.1402b27e8
test al, al
je 0x1402b295d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1402b295d
mov dil, 1
mov rcx, rbx
call fcn.1402bbd1c
mov al, dil
jmp 0x1402b2974
mov rcx, rbx
call fcn.1402bbd1c
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14029fd30
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret