joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d6da0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140144700]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, Ordinal_26
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400d6dec
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x1400d6ebe
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400d6e30
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x1400d6ebe
mov rcx, rbp
call fcn.1400934d0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0
lea edx, [r8 + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x1400d6e9a
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400d6eaa
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400d6ebc
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d8190
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400d7c80
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x1400d7ce5
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x1400d7c90
ret
Function at 0x1400df118
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400def83
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400def83
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400def83
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400def83
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400def83
cmp dword [rcx + 0x84], 0xe
jbe 0x1400def83
cmp dword [rcx + 0xf8], 0
je 0x1400def83
mov ecx, ebx
call fcn.1400df034
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400dee10
nop
cmp dword [rbp + 0x20], 0
je 0x1400defd1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400defdc
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400def14

Function at 0x1400e5790
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1400d8a10
sub rsp, rax
mov rax, qword [0x140144700]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1400f1a58
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400e57df
mov rax, rbp
jmp 0x1400e58e7
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x15b6a0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400ee548
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x15b6a0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400e58e3
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e58e3
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400ee548
test rax, rax
js 0x1400e58e3
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400e58e3
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400e58d5
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400e58d5
cmp byte [rcx], 0xd
jne 0x1400e58bb
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400e58ca
cmp byte [rcx + 1], 0xa
jne 0x1400e58ca
inc rcx
jmp 0x1400e58ca
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x144890]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400e589d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400e58e7
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400d8190
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ed580
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x140144700]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x14012a4d0]
mov rbp, rcx
call fcn.1400f6f04
xor edi, edi
test rax, rax
je 0x1400ed666
mov ebx, edi
call fcn.1400e3788
mov r14d, dword [rax]
call fcn.1400e3788
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.1400f6e50
mov rsi, rax
test rax, rax
je 0x1400ed5f7
call fcn.1400e3788
mov dword [rax], r14d
jmp 0x1400ed621
call fcn.1400e3788
cmp dword [rax], 0x22
jne 0x1400ed65e
call fcn.1400e3788
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.1400f6e50
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x1400ed65e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1400ed625
cmp rax, 3
je 0x1400ed640
mov rcx, rsi
call fcn.1400ed4dc
test al, al
je 0x1400ed651
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1400ed651
mov dil, 1
mov rcx, rbx
call fcn.1400e38b8
mov al, dil
jmp 0x1400ed668
mov rcx, rbx
call fcn.1400e38b8
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400d8190
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1400ee1f8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1400ee22f
call fcn.1400e3788
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.1400e08f0
xor eax, eax
jmp 0x1400ee2bd
mov rdx, r9
mov rcx, r8
call fcn.1400ee194
mov rbx, rax
test rax, rax
je 0x1400ee2ba
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1400ee0c0]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400ee2a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e36fc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400ee28e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400ee29d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1400f29c8
jmp 0x1400ee2ba
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400ee2b7
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400effd8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x14015b6a0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1400f002f
cmp word [rdx], r13w
jne 0x1400f002f
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1400f0034
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400f0159
mov r11d, reloc.WS2_32.dll_listen
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400f017a
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400f006d
mov rdx, r9
mov word [rbx], cx
jmp 0x1400f0094
cmp r9, r8
jae 0x1400f00a4
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400f004e
jmp 0x1400f0159
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400f014e
cmp dword [rsp + 0x80], esi
je 0x1400f014e
lea r8, [0x14015b6a0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1400f0126
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400f00f6
mov word [rbx], r13w
jmp 0x1400f0156
mov ecx, reloc.WS2_32.dll_listen
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400f0103
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400f0156
cmp word [rsp + 0x70], r13w
jne 0x1400f0133
cmp rbx, r14
je 0x1400f00f0
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400ee550
cmp word [rsp + 0x70], r13w
je 0x1400f0159
mov ecx, reloc.WS2_32.dll_listen
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x14015b6a0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400f0153
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400f0159
Function at 0x1400f5e70
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400f5e86
mov al, 1
jmp 0x1400f5ee6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400f5e97
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400f5ee4
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400f6884
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400f5ee4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400f5ee4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400f5ee4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400f5ee6
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400f6994
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400ee550
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400ee550
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400f6ae4
cmp rax, 0xffffffffffffffff
je 0x1400f6ae4
xor edi, edi
test rbp, rbp
jle 0x1400f6a8f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400f2950
mov rbx, rax
test rax, rax
jne 0x1400f6a1c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400f6a85
mov edx, 0x8000
mov ecx, r14d
call fcn.1400efc10
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400f1390
cmp eax, 0xffffffff
je 0x1400f6a65
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400f6a2c
mov edx, r15d
mov ecx, r14d
call fcn.1400efc10
jmp 0x1400f6a85
cmp byte [rsi + 0x38], dil
je 0x1400f6a7c
cmp dword [rsi + 0x34], 5
jne 0x1400f6a7c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x1400f6a85
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400f29c8
jmp 0x1400f6af8
jns 0x1400f6af8
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400ee550
cmp rax, 0xffffffffffffffff
jne 0x1400f6ab0
cmp byte [rsi + 0x30], dil
je 0x1400f6af8
mov edi, dword [rsi + 0x2c]
jmp 0x1400f6af8
mov ecx, r14d
call fcn.1400f6884
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400f6af8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x1400f6af8
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400f6af1
mov eax, dword [rsi + 0x2c]
jmp 0x1400f6af6
mov eax, reloc.WLDAP32.dll_Ordinal_22
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400ee550
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400fa374
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400fa3a4
xor eax, eax
jmp 0x1400fa467
mov rbp, rbx
cmp word [rax], si
je 0x1400fa3c9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400fa3b0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400fa3ac
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400f7330
movsxd r14, eax
test eax, eax
jne 0x1400fa407
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400fa39d
mov rcx, r14
call fcn.1400f35ac
mov rdi, rax
test rax, rax
jne 0x1400fa420
xor ecx, ecx
call fcn.1400f29c8
jmp 0x1400fa3fc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400f7330
test eax, eax
jne 0x1400fa451
mov rcx, rdi
call fcn.1400f29c8
jmp 0x1400fa45b
xor ecx, ecx
call fcn.1400f29c8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400fa484
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400fa50b
mov rsi, rbx
cmp word [rax], bp
je 0x1400fa4ca
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400fa4b4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400fa4b0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400f35ac
mov rdi, rax
test rax, rax
je 0x1400fa4f8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140101bd0
mov rbp, rdi
xor ecx, ecx
call fcn.1400f29c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400fbc0c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400fbc2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e36fc
or eax, 0xffffffff
jmp 0x1400fbc2e
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400fe578
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140144700]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1400fe5c2
call fcn.1400e3768
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.1400e3788
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.1400e08f0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400d8190
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1400fe5cd
lea eax, [rbx + 1]
jmp 0x1400fe5af
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1400fe5ad
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1400fe5af
Function at 0x1400ffa14
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400e37a8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400ffa9e
cmp byte [rbp - 0x21], r15b
je 0x1400ffa99
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400ffad4
call fcn.1400f2c70
test eax, eax
jne 0x1400ffac0
cmp byte [rbp - 0x21], r15b
je 0x1400ffab8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400ffad4
cmp byte [rbp - 0x21], r15b
je 0x1400ffad1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400ebff8
test eax, eax
jne 0x1400ffb74
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400e37a8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400ffb13
cmp byte [rbp - 0x21], r15b
je 0x1400ffb48
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400ffb48
call fcn.1400f2c70
test eax, eax
jne 0x1400ffb34
cmp byte [rbp - 0x21], r15b
je 0x1400ffb2d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400ffb48
cmp byte [rbp - 0x21], r15b
je 0x1400ffb45
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400ebff8
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400ffb74
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400ffb77
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400ffb85
mov rcx, rdi
call fcn.1400f29c8
cmp byte [rbp + 0x3f], r15b
je 0x1400ffb94
mov rcx, qword [rbp + 0x27]
call fcn.1400f29c8
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18000434a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x158
lea rax, [0x1803c6988]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x24]
call fcn.180004b1a
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x18]
mov eax, eax
mov r9d, 4
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
and eax, dword [rax]

Function at 0x180004390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and eax, dword [rax]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0x4c]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x48]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x50]
call sym.VBoxRT.dll_public:_class_xml::AttributeNode____ptr64___cdecl_xml::AttributeNode::operator_class_xml::AttributeNode_const____ptr64____ptr64
mov qword [rsp + 0xe8], rax
test byte [rax + rbp*8], ah
add byte [rax], al
add byte [rcx - 0x48], al
add al, 1
add byte [rax], al
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [rsp + 0xe8]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 4]
mov qword [rsp + 0xc0], rax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x50], eax

Function at 0x1800043c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and eax, dword [rax]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax + 0x4c]
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x48]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x50]
call sym.VBoxRT.dll_public:_class_xml::AttributeNode____ptr64___cdecl_xml::AttributeNode::operator_class_xml::AttributeNode_const____ptr64____ptr64
mov qword [rsp + 0xe8], rax
test byte [rax + rbp*8], ah
add byte [rax], al
add byte [rcx - 0x48], al
add al, 1
add byte [rax], al
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [rsp + 0xe8]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 4]
mov qword [rsp + 0xc0], rax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x50], eax

Function at 0x180004410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 0x50]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x78]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x40]
and al, 0x40
and al, 0x40
mov ecx, dword [rcx + 0x1c]
movzx ecx, cx
cmp eax, ecx
je 0x180004438
mov eax, dword [rsp + 0x50]
xor ecx, ecx
mov rdx, qword [rsp + 0x78]
mov word [rdx + rax*2], cx
mov eax, dword [rsp + 0x50]
dec eax
mov dword [rsp + 0x50], eax
jmp 0x1800043fd
mov dword [rsp + 0x60], 0