joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b538
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov rsi, rcx
mov ebp, r14d
mov edi, r14d
test rcx, rcx
je 0x14002b662
cmp r14w, word [rcx]
je 0x14002b662
xor edx, edx
call fcn.14002bad0
mov rbx, rax
test rax, rax
je 0x14002b5fe
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jne 0x14002b5c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, rbx
lea r8, str.WdsRemoveDirectory:_Unable_to_clear_attributes_on___s___GLE__0x_x
lea rcx, [0x1400c8aa0]
mov dword [rsp + 0x20], eax
mov edx, 0x3000000
mov edi, eax
call fcn.14002a5d8
xor edx, edx
mov rcx, rbx
call fcn.14002ae08
mov ebp, eax
test eax, eax
jne 0x14002b62b
test edi, edi
jne 0x14002b5e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, rbx
lea r8, str.WdsRemoveDirectory:_Unable_to_remove_directory___s___GLE__0x_x
jmp 0x14002b616
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, rsi
lea r8, str.WdsRemoveDirectory:_Unable_to_prepare_path___s___GLE__0x_x
mov edi, eax
mov edx, 0x3000000
mov dword [rsp + 0x20], eax
lea rcx, [0x1400c8aa0]
call fcn.14002a5d8
test rbx, rbx
je 0x14002b650
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebp
jmp 0x14002b675
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14002b698
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, ebx
test rcx, rcx
je 0x14002b73e
cmp bx, word [rcx]
je 0x14002b73e
xor edx, edx
call fcn.14002bad0
mov rsi, rax
test rax, rax
je 0x14002b73a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14002b6e9
test al, 0x10
je 0x14002b6e9
lea edi, [rbx + 1]
jmp 0x14002b70c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
mov ecx, 0x10b
cmove eax, ecx
mov ecx, 3
cmp eax, 2
cmove eax, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, edi
jmp 0x14002b751
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002b768
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
test rcx, rcx
je 0x14002b80d
cmp bx, word [rcx]
je 0x14002b80d
xor edx, edx
call fcn.14002bad0
mov rsi, rax
test rax, rax
je 0x14002b7ed
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14002b7bd
and eax, 0x10
sete bl
neg eax
sbb edi, edi
and edi, 2
jmp 0x14002b7cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x14002b7fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebx
jmp 0x14002b820
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002ce2c
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebp, r9d
mov r14, r8
mov rsi, rdx
mov r15, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebp
lea edx, [rdi + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14002cead
mov r8d, dword [r14]
lea ecx, [rdi + 3]
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov rdx, r15
call qword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
nop dword [rax + rax]
test eax, eax
je 0x14002cebe
test rsi, rsi
je 0x14002cea6
mov qword [rsi], rbx
xor ebx, ebx
mov edi, 1
jmp 0x14002cebe
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
test rbx, rbx
je 0x14002cee3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x14002d528
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r13d, r13d
mov rbp, r9
neg dword [rsp + 0x88]
mov r12, r8
mov r14, rdx
mov r15, rcx
sbb esi, esi
mov ebx, r13d
neg esi
mov edi, 0x80
inc esi
add edi, edi
test rbx, rbx
je 0x14002d58f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ebx, edi
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14002d610
mov rcx, r14
cmp dword [rsp + 0x80], r13d
je 0x14002d5e3
mov r9, r15
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
nop dword [rax + rax]
jmp 0x14002d60c
test rbp, rbp
mov qword [rsp + 0x28], r15
lea r8, [0x1400a9d54]
mov dword [rsp + 0x20], edi
cmovne r8, rbp
mov r9, rbx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
nop dword [rax + rax]
mov ecx, eax
jmp 0x14002d613
mov ecx, r13d
mov eax, edi
sub eax, esi
cmp ecx, eax
jae 0x14002d568
test rbp, rbp
jne 0x14002d653
test rbx, rbx
je 0x14002d653
test ecx, ecx
jne 0x14002d653
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test eax, eax
cmovne rbx, r13
mov rbp, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002d70c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
xor ebx, ebx
xor edx, edx
call fcn.14002bad0
mov rsi, rax
test rax, rax
je 0x14002d79e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebp, eax
cmp edi, 0xffffffff
je 0x14002d766
lea eax, [rbx + 1]
bt edi, 0xa
jb 0x14002d768
mov eax, ebx
test ebp, ebp
mov dword [r14], eax
sete bl
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140033c2c
Capabilities:
Get number of processors

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xb8
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rbp - 1], rax
mov rdi, qword [rbp + 0x77]
mov r12, r8
mov r15, qword [rbp + 0x7f]
lea r8, [rbp - 0x79]
mov rsi, r9
mov r13, rdx
mov r14, rcx
call fcn.140033b60
mov ebx, eax
test eax, eax
js 0x140033e0e
cmp r12, qword [rbp - 0x79]
jb 0x140033c8a
mov ebx, 0x80070057
jmp 0x140033e0e
lea r9, [rbp - 0x19]
mov r8d, 0x2000
mov rdx, r13
mov rcx, r14
call fcn.1400336d4
xor r13d, r13d
mov ebx, eax
test eax, eax
js 0x140033e0e
cmp dword [rbp - 0x19], 3
jne 0x140033e09
cmp dword [rbp - 9], 0xffffffff
je 0x140033e09
mov rcx, qword [r14]
lea r9, [rbp - 0x29]
movups xmm0, xmmword [rbp - 0x11]
mov r8d, r12d
lea rdx, [rbp - 0x69]
mov rax, qword [rcx]
movdqu xmmword [rbp - 0x69], xmm0
mov rax, qword [rax + 0xc0]
call qword [str.PN_t_]
test eax, eax
js 0x140033deb
test rsi, rsi
je 0x140033d2e
lea r9, [rbp - 0x59]
mov qword [rsi], r13
mov r8d, 0x2007
lea rdx, [rbp - 0x29]
mov rcx, r14
call fcn.1400336d4
mov ebx, eax
test eax, eax
js 0x140033d73
cmp dword [rbp - 0x59], 1
jne 0x140033d29
mov rcx, qword [rbp - 0x51]
mov rdx, rsi
call fcn.140030404
mov ebx, eax
jmp 0x140033d2e
mov ebx, 0x8007000d
test ebx, ebx
js 0x140033d73
test rdi, rdi
je 0x140033d7b
lea r9, [rbp - 0x41]
mov qword [rdi], r13
mov r8d, 0x2009
lea rdx, [rbp - 0x29]
mov rcx, r14
call fcn.1400336d4
mov ebx, eax
test eax, eax
js 0x140033d93
cmp dword [rbp - 0x41], 1
jne 0x140033d6c
mov rcx, qword [rbp - 0x39]
mov rdx, rdi
call fcn.140030404
mov ebx, eax
jmp 0x140033d7b
mov ebx, 0x8007000d
jmp 0x140033d7b
test rdi, rdi
je 0x140033d7b
mov qword [rdi], r13
test ebx, ebx
js 0x140033d93
test r15, r15
je 0x140033e0e
movups xmm0, xmmword [rbp - 0x29]
movdqu xmmword [r15], xmm0
jmp 0x140033e0e
test rsi, rsi
je 0x140033dbe
mov r8, qword [rsi]
test r8, r8
je 0x140033dbe
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rsi], r13
test rdi, rdi
je 0x140033e0e
mov r8, qword [rdi]
test r8, r8
je 0x140033e0e
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov qword [rdi], r13
jmp 0x140033e0e
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140033e0e
mov ebx, 0x8007000d
mov eax, ebx
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140094220
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14004b5dc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
cmp qword [rcx + 8], rdx
jbe 0x14004b60f
xor ecx, ecx
mov rax, qword [rbx + 0x10]
lea rcx, [rcx + 0x90]
inc rdx
and qword [rcx + rax - 0x68], 0
and qword [rcx + rax - 0x80], 0
cmp rdx, qword [rbx + 8]
jb 0x14004b5ef
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbx + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
and qword [rbx + 0x10], 0
test rcx, rcx
je 0x14004b646
mov edx, 1
call fcn.14004b5dc
and qword [rbx + 0x18], 0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140052940
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
xor r9d, r9d
mov esi, edx
mov r10d, edx
mov rbx, rcx
shr r10d, 4
mov r11, r8
mov edi, r9d
movabs rbp, 0x87c37b91114253d5
movabs r14, 0x4cf5ad432745937f
test r10d, r10d
je 0x1400529d9
lea edx, [rdi + rdi]
inc edi
mov rcx, qword [rbx + rdx*8]
lea eax, [rdx + 1]
mov rax, qword [rbx + rax*8]
imul rax, r14
imul rcx, rbp
rol rax, 0x21
imul rax, rbp
rol rcx, 0x1f
xor rax, r11
imul rcx, r14
rol rax, 0x1f
xor rcx, r8
add rax, 0xb41def1
rol rcx, 0x1b
add rcx, r11
lea r8, [rcx*4 + 0x52dce729]
add r8, rcx
add rax, r8
lea r11, [rax + rax*4]
cmp edi, r10d
jb 0x140052983
shl r10d, 4
mov eax, esi
mov ecx, r10d
and eax, 0xf
add rcx, rbx
cmp eax, 8
ja 0x140052a37
je 0x140052ab4
sub eax, 1
je 0x140052aff
sub eax, 1
je 0x140052af4
sub eax, 1
je 0x140052ae9
sub eax, 1
je 0x140052ade
sub eax, 1
je 0x140052ad3
sub eax, 1
je 0x140052ac8
cmp eax, 1
je 0x140052abd
jmp 0x140052b14
sub eax, 9
je 0x140052a9e
sub eax, 1
je 0x140052a93
sub eax, 1
je 0x140052a88
sub eax, 1
je 0x140052a7d
sub eax, 1
je 0x140052a72
sub eax, 1
je 0x140052a67
cmp eax, 1
jne 0x140052b14
movzx r9d, byte [rcx + 0xe]
shl r9, 0x30
movzx eax, byte [rcx + 0xd]
shl rax, 0x28
xor r9, rax
movzx eax, byte [rcx + 0xc]
shl rax, 0x20
xor r9, rax
movzx eax, byte [rcx + 0xb]
shl rax, 0x18
xor r9, rax
movzx eax, byte [rcx + 0xa]
shl rax, 0x10
xor r9, rax
movzx eax, byte [rcx + 9]
shl rax, 8
xor r9, rax
movzx eax, byte [rcx + 8]
xor rax, r9
imul rax, r14
rol rax, 0x21
imul rax, rbp
xor r11, rax
movzx r9d, byte [rcx + 7]
shl r9, 0x38
movzx eax, byte [rcx + 6]
shl rax, 0x30
xor r9, rax
movzx eax, byte [rcx + 5]
shl rax, 0x28
xor r9, rax
movzx eax, byte [rcx + 4]
shl rax, 0x20
xor r9, rax
movzx eax, byte [rcx + 3]
shl rax, 0x18
xor r9, rax
movzx eax, byte [rcx + 2]
shl rax, 0x10
xor r9, rax
movzx eax, byte [rcx + 1]
shl rax, 8
xor r9, rax
movzx eax, byte [rcx]
xor rax, r9
imul rax, rbp
rol rax, 0x1f
imul rax, r14
xor r8, rax
mov rbx, qword [rsp + 0x10]
xor r11, rsi
mov rbp, qword [rsp + 0x18]
movabs rdx, 0xff51afd7ed558ccd
mov rdi, qword [rsp + 0x28]
mov rax, rsi
mov rsi, qword [rsp + 0x20]
xor rax, r8
add rax, r11
mov rcx, rax
add r11, rax
shr rcx, 0x21
xor rcx, rax
mov rax, r11
imul rcx, rdx
shr rax, 0x21
mov r8, rcx
xor rax, r11
imul rax, rdx
shr r8, 0x21
xor r8, rcx
mov rdx, rax
shr rdx, 0x21
movabs rcx, 0xc4ceb9fe1a85ec53
xor rdx, rax
imul rdx, rcx
imul r8, rcx
mov rax, rdx
shr rax, 0x21
xor rdx, rax
mov rcx, r8
shr rcx, 0x21
xor rcx, r8
add rcx, rdx
lea rax, [rdx + rcx]
xor rax, rcx
pop r14
ret
Function at 0x140052bb0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, dword [rsp + 0xd0]
xor r12d, r12d
mov r14, qword [rsp + 0xd8]
mov edi, ecx
mov ecx, dword [0x1400c5a20]
mov rbp, r9
mov qword [rsp + 0x38], r12
mov rsi, r8
mov r15, rdx
cmp ecx, 0xffffffff
jne 0x140052c6f
xorps xmm0, xmm0
lea r8d, [r12 + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, str.WIM_Verbose_Logging
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
dec eax
cmp eax, 0xf
ja 0x140052c5c
lea r8, [rsp + 0x30]
lea rdx, [0x1400afbe8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_swscanf_s]
nop dword [rax + rax]
mov ecx, dword [0x1400c5a20]
test eax, eax
cmovg ecx, dword [rsp + 0x30]
jmp 0x140052c62
mov ecx, dword [0x1400c5a20]
cmp ecx, 0xffffffff
cmove ecx, r12d
mov dword [0x1400c5a20], ecx
cmp edi, 4
jne 0x140052c7c
test ecx, ecx
je 0x140052d9f
sub edi, 1
je 0x140052ca3
sub edi, 1
je 0x140052c9c
sub edi, 1
je 0x140052c95
cmp edi, 1
mov edi, 0x41009477
jmp 0x140052ca8
mov edi, 0x41009484
jmp 0x140052ca8
mov edi, 0x41009485
jmp 0x140052ca8
mov edi, 0x4100947f
mov r9d, dword [rsp + 0xe0]
lea rdx, str.__s:__d______s___s
mov qword [rsp + 0x28], rsi
lea rcx, [rsp + 0x38]
mov r8, r14
mov qword [rsp + 0x20], rbp
call fcn.14002d398
mov rbp, qword [rsp + 0x38]
mov esi, ebx
and esi, 0x10000000
mov r14d, 0x13d
test rbp, rbp
je 0x140052d56
mov ecx, ebx
test esi, esi
je 0x140052d0f
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, ebx
cmp eax, r14d
je 0x140052d26
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
jmp 0x140052d26
mov r9d, ebx
movzx eax, bx
and r9d, 0x1fff0000
cmp r9d, 0x70000
cmove ecx, eax
mov r9d, ecx
mov r8, rbp
mov rcx, r15
mov edx, edi
call fcn.1400586fc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, ebx
test esi, esi
je 0x140052d7f
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
cmp eax, r14d
je 0x140052d91
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x140052d91
and ecx, 0x1fff0000
movzx eax, bx
cmp ecx, 0x70000
cmove ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140094220
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400531e8
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
and dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
nop dword [rax + rax]
test eax, eax
jne 0x14005324b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [0x1400c99e0]
mov rdx, rdi
mov rcx, rbx
call qword [str.PN_t_]
jmp 0x14005325d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400533a0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
cmp dword [0x1400c99e8], ebx
je 0x1400533f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], ebx
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
nop dword [rax + rax]
test eax, eax
jne 0x1400533f6
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
jmp 0x140053407
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop dword [rax + rax]
mov ebx, eax
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140057ea8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov r14, rdx
mov rdi, rcx
mov esi, 1
test rdx, rdx
jne 0x140057ee6
lea ecx, [rdx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x14005802a
mov qword [rdx], rbx
mov r8d, 4
lea rdx, [0x1400b0360]
call qword [sym.imp.msvcrt.dll_wcsncmp]
nop dword [rax + rax]
test eax, eax
je 0x140058028
or rax, 0xffffffffffffffff
mov rcx, rax
inc rcx
cmp word [rdi + rcx*2], bx
jne 0x140057f11
cmp rcx, 0xf7
jbe 0x140058028
inc rax
cmp word [rdi + rax*2], bx
jne 0x140057f27
lea r15d, [rax - 1]
mov ecx, 0x5c
cmp cx, word [rdi]
lea r12, [rdi + 2]
mov rcx, qword gs:[0x60]
mov edx, 8
cmovne r15d, eax
cmovne r12, rdi
mov rcx, qword [rcx + 0x30]
lea eax, [r15 + 5]
lea r8, [rax + rax]
mov edi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
jne 0x140057f8d
mov rax, qword gs:[0x30]
mov dword [rax + 0x68], 8
jmp 0x14005801e
lea rax, [rsp + 0x78]
mov r9d, 4
mov qword [rsp + 0x28], rax
lea r8, [0x1400b0360]
lea rax, [rsp + 0x80]
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.14002ef38
mov edi, eax
test eax, eax
js 0x140057ff1
mov rdx, qword [rsp + 0x78]
mov r8, r12
mov rcx, qword [rsp + 0x80]
mov r9d, r15d
call fcn.14000274c
mov edi, eax
test eax, eax
js 0x140057ff1
mov rax, qword gs:[0x30]
mov dword [rax + 0x68], ebx
mov rbx, rbp
jmp 0x14005801e
mov rcx, qword gs:[0x60]
mov r8, rbp
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rax, qword gs:[0x30]
movzx ecx, di
mov dword [rax + 0x68], ecx
mov qword [r14], rbx
neg rbx
sbb eax, eax
and esi, eax
mov eax, esi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400580b4
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov r14, rdx
mov ebx, r15d
mov esi, r15d
lea ebp, [r15 + 1]
test rdx, rdx
jne 0x1400580f0
mov eax, 0x80070057
jmp 0x140058296
xor edx, edx
call fcn.140057d04
mov rdi, rax
mov r13d, 0x80070000
test rax, rax
je 0x14005819c
mov edx, 0x5c
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
mov rsi, rax
test ebp, ebp
je 0x140058265
mov ebp, r15d
test ebx, ebx
js 0x1400581fe
mov dword [rsp + 0x38], r15d
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov qword [rsp + 0x28], r15
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
nop dword [rax + rax]
test eax, eax
jne 0x1400581fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, r13d
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x1400581f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
jmp 0x1400581fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, r13d
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x1400581d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
jmp 0x1400581d7
mov ebx, 0x80004005
test ebx, ebx
jns 0x140058120
mov r9d, ebx
lea rcx, str.GetVolumeRootFromPath
mov r8d, 0x1ea
call fcn.140066474
jmp 0x140058294
mov ebx, 0x80004005
cmp ebx, 0x80070090
je 0x140058230
lea eax, [rbx + 0x7ff8fffe]
cmp eax, 1
jbe 0x140058230
test ebx, ebx
jns 0x140058120
mov r9d, ebx
lea rcx, str.GetVolumeRootFromPath
mov r8d, 0x21c
call fcn.140066474
jmp 0x14005825d
mov edx, 0x5c
mov word [rsi], r15w
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x14005825d
mov word [rax + 2], r15w
mov ebx, r15d
mov ebp, 1
test ebx, ebx
jns 0x140058120
test ebx, ebx
js 0x14005826f
mov qword [r14], rdi
mov rdi, r15
test rdi, rdi
je 0x140058294
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
ret