joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ffa62ba1e90
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x7ffa62be11e0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x7ffa62ba1f09
mov rcx, r10
call fcn.7ffa62ba1d60
test eax, eax
je 0x7ffa62ba1f09
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x7ffa62ba1f06
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x7ffa62ba1efd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x7ffa62ba1f09
add r8, 0x28
cmp r8, r9
jne 0x7ffa62ba1ee8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x7ffa62ba23d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
xor r9d, r9d
movsxd rax, dword [rdx + 0x3c]
mov r10d, dword [rax + rdx + 0x88]
add r10, rdx
mov rbx, rcx
mov r8, rdx
mov r11d, dword [r10 + 0x20]
mov esi, dword [r10 + 0x18]
add r11, rdx
cmp esi, r9d
jbe 0x7ffa62ba243c
mov ecx, dword [r11 + r9*4]
add rcx, r8
call fcn.7ffa62ba2530
mov r12d, eax
lea rax, [r9 + 1]
cmp r12d, ebx
jne 0x7ffa62ba2437
mov edx, dword [r10 + 0x24]
add r9, r9
mov eax, dword [r10 + 0x1c]
add r9, r8
movzx edx, word [r9 + rdx]
lea rdx, [r8 + rdx*4]
mov eax, dword [rdx + rax]
add rax, r8
jmp 0x7ffa62ba243e
mov r9, rax
jmp 0x7ffa62ba23fb
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x7ffa62ba2450
Capabilities:
Parse pe header

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
cmp word [rax], 0x5a4d
jne 0x7ffa62ba247e
movsxd rdx, dword [rax + 0x3c]
lea rcx, [rdx - 0x40]
cmp rcx, 0x3bf
ja 0x7ffa62ba247e
cmp dword [rax + rdx], 0x4550
je 0x7ffa62ba2483
dec rax
jmp 0x7ffa62ba245d
ret

Function at 0x7ffa62ba24c0
Capabilities:
Check for software breakpoints

Disassembly:
cmp byte [rcx - 1], 0xcc
je 0x7ffa62ba251e
test r8d, r8d
jne 0x7ffa62ba24cf
sub rcx, 0x20
mov r9b, byte [rcx]
cmp r9b, 0xe9
je 0x7ffa62ba24e2
mov r8b, byte [rcx + 3]
cmp r8b, 0xe9
jne 0x7ffa62ba24e9
inc edx
xor r8d, r8d
jmp fcn.7ffa62ba24c0
xor eax, eax
cmp r9b, 0x4c
jne 0x7ffa62ba2520
cmp byte [rcx + 1], 0x8b
jne 0x7ffa62ba2520
cmp byte [rcx + 2], 0xd1
jne 0x7ffa62ba251e
cmp r8b, 0xb8
jne 0x7ffa62ba251e
cmp byte [rcx + 6], 0
jne 0x7ffa62ba2520
movzx eax, byte [rcx + 5]
shl eax, 8
mov r8d, eax
movzx eax, byte [rcx + 4]
or eax, r8d
add eax, edx
jmp 0x7ffa62ba2520
xor eax, eax
ret
Function at 0x1400018e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000192a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000192a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000192a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000192a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000192a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000192c
xor al, al
add rsp, 0x28
ret
Function at 0x140002470
Capabilities:
Set current directory

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ecx, ecx
xor edx, edx
call fcn.140021614
mov qword [0x1400d1968], rax
test rax, rax
je 0x1400024e6
lea rcx, [rsp + 0x20]
call fcn.14000ecbc
test eax, eax
jne 0x1400024f7
mov rsi, qword [rsp + 0x20]
mov rcx, rsi
mov edx, 0x5c
call fcn.14000e84c
test rax, rax
je 0x1400024c6
mov byte [rax], 0
mov rsi, qword [rsp + 0x20]
mov rcx, rsi
call fcn.14001c5ac
test eax, eax
jne 0x140002508
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14000d6d0
nop
add rsp, 0x30
pop rsi
ret
lea rcx, str._nCant_get_the_current_folder_name_n
mov edx, 0xa
call fcn.140001920
lea rcx, str._nCant_get_RTEmsg_application_start_folder_name_n
mov edx, 0xb
call fcn.140001920
lea rcx, str._nCant_change_to_the_RTEmsg_application_folder_n
mov edx, 0xc
call fcn.140001920
int3

Function at 0x140006ce0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1030
call fcn.14000d670
sub rsp, rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1028], rax
call fcn.140023a84
mov rcx, rsi
call fcn.140023a84
lea rbx, [rsp + 0x820]
lea r14, [rsp + 0x20]
nop word cs:[rax + rax]
mov edx, 1
mov r8d, 0x800
mov rcx, rbx
mov r9, rdi
call fcn.140022438
mov r15, rax
mov edx, 1
mov r8d, 0x800
mov rcx, r14
mov r9, rsi
call fcn.140022438
cmp r15, rax
jne 0x140006d7b
test r15, r15
je 0x140006d7f
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.14003fbe0
test eax, eax
je 0x140006d30
xor ebx, ebx
jmp 0x140006d81
mov bl, 1
mov rcx, rdi
call fcn.140021b8c
mov rcx, rsi
call fcn.140021b8c
mov rcx, qword [rsp + 0x1028]
xor rcx, rsp
call fcn.14000d6d0
mov eax, ebx
add rsp, 0x1030
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140006dc0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
call fcn.140021ac4
mov ebp, eax
lea r14, [0x140048646]
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax]
mov rcx, rsi
mov rdx, r14
call fcn.14000d1d0
test rax, rax
jne 0x140006e30
call fcn.14001eb00
cmp dword [rax], 0xd
jne 0x140006e20
mov ecx, 0xa
call r15
call fcn.140021ac4
sub eax, ebp
cmp eax, 0x5dd
jl 0x140006df0
mov rcx, rdi
mov edx, 0xf2
mov r8, rsi
call fcn.14000a4b0
mov rbx, rax
mov rcx, rax
call fcn.140002310
cmp rax, 0x989681
jae 0x140006f5b
mov r12, rax
mov rcx, rax
add rcx, 2
lea rdx, str.Yfile
call fcn.14000a550
mov r14, rax
lea r15, [rax + 1]
mov edx, 1
mov rcx, r15
mov r8, r12
mov r9, rbx
call fcn.140022438
mov byte [rax + r14 + 1], 0
movzx r9d, byte [r14 + 1]
test r9b, r9b
je 0x140006f4b
xor eax, eax
mov rcx, r14
mov r8, r14
jmp 0x140006eae
inc rcx
mov r9d, r10d
mov r15, rdx
test r10b, r10b
je 0x140006ef7
movzx r10d, byte [r15 + 1]
test r10b, r10b
je 0x140006ef4
lea rdx, [r15 + 1]
cmp r9b, 0xa
jne 0x140006ea0
mov r9, rcx
sub r9, r8
add r9, 0xffffffffffffff00
cmp r9, 0xffffffffffffff00
jbe 0x140006f2f
mov r9d, r8d
neg r9b
movzx r9d, r9b
add r9d, ecx
mov byte [r8], r9b
inc rax
movzx r10d, byte [rdx]
mov r8, r15
jmp 0x140006ea0
mov rdx, r15
cmp rax, 1
jbe 0x140006f4b
mov byte [rdx], 0
mov eax, dword [0x1400e1928]
lea rcx, [0x1400d1968]
shl rax, 5
mov qword [rax + rcx + 0x5b0], r14
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140021b8c
mov byte [r8], 0
mov rcx, rbx
call fcn.140021b8c
mov rcx, rdi
mov edx, 0xf4
mov r8, rsi
call fcn.14000a4b0
mov rcx, rdi
mov edx, 0xf5
mov r8, rsi
call fcn.14000a4b0
mov rcx, rbx
call fcn.140021b8c
mov rcx, rdi
mov edx, 0xf3
mov r8, rsi
call fcn.14000a4b0
int3
Function at 0x140008c50
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp byte [0x1400d1f04], 0
jne 0x140008d63
mov esi, dword [0x1400d1ad0]
mov eax, dword [0x1400d1ab8]
mov ebx, esi
mov edi, 0x20000
sub ebx, eax
jbe 0x140008cbb
cmp ebx, 0x20000
jae 0x140008d6e
mov rcx, qword [0x1400d1ad8]
lea rdx, [rcx + rax*4]
mov r8d, ebx
shl r8, 2
call fcn.14003fce0
mov eax, dword [0x1400d1ab8]
add qword [0x1400d1ac8], rax
mov edi, 0x20000
sub edi, ebx
mov esi, dword [0x1400d1ad0]
mov dword [0x1400d1ab8], 0
sub esi, ebx
mov dword [0x1400d1ad0], esi
mov r9, qword [0x1400d1970]
xor ebp, ebp
test r9, r9
je 0x140008d54
shl rsi, 2
add rsi, qword [0x1400d1ad8]
mov r14d, edi
mov edx, 4
mov rcx, rsi
mov r8, r14
call fcn.140022438
mov rbx, rax
cmp rax, r14
je 0x140008d3e
mov ecx, 0x6b
mov edx, ebx
call fcn.140002030
mov ecx, 0x165
call fcn.140002820
mov rcx, qword [0x1400d1978]
mov rdx, rax
mov r8d, edi
call fcn.140001d90
lea rcx, [rsi + rbx*4]
sub r14, rbx
shl r14, 2
mov dl, 0xff
mov r8, r14
call fcn.140040380
test ebx, ebx
je 0x140008d54
mov rcx, qword [0x1400d1970]
call fcn.140021d48
mov ebp, ebx
test eax, eax
je 0x140008d5d
mov byte [0x1400d1f04], 1
mov ebx, ebp
add dword [0x1400d1ad0], ebx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov r8d, ebx
lea rdx, str.remaining_words
mov ecx, 0x3b
call fcn.140001c10
int3

Function at 0x1400092f0
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov eax, dword [0x1400d1a00]
test eax, eax
je 0x140009472
mov esi, dword [0x1400d1a14]
test rsi, rsi
je 0x140009479
mov rdi, rcx
mov rax, rsi
shl rax, 2
mov ecx, 0x6e
cmp rax, rdi
jl 0x140009331
mov ecx, 0x6a
jle 0x14000933e
mov edx, esi
call fcn.140002030
shr rdi, 2
mov esi, edi
cmp esi, 0x8000006
jb 0x14000935a
mov ecx, 0x71
mov edx, 0x20000014
call fcn.140002030
mov esi, 0x8000005
mov eax, dword [0x1400d1a00]
cmp eax, esi
jbe 0x14000937a
mov dword [0x1400d1a00], esi
mov edx, dword [0x1400d1a00]
mov ecx, 0x72
call fcn.140002030
mov dword [0x1400d1ae0], esi
mov ebx, esi
lea rcx, [rbx*4]
lea rdx, str.binFil1
call fcn.14000a550
mov qword [0x1400d1ad8], rax
mov rcx, qword [0x1400d1970]
xor edi, edi
mov edx, 0x18
xor r8d, r8d
call fcn.14001ece4
mov r9, qword [0x1400d1970]
test r9, r9
je 0x140009450
mov r14, qword [0x1400d1ad8]
mov edx, 4
mov rcx, r14
mov r8, rbx
call fcn.140022438
mov rdi, rax
cmp rax, rbx
je 0x14000941f
mov ecx, 0x6b
mov edx, edi
call fcn.140002030
mov ecx, 0x165
call fcn.140002820
mov rcx, qword [0x1400d1978]
mov rdx, rax
mov r8d, esi
call fcn.140001d90
lea rcx, [r14 + rdi*4]
sub rbx, rdi
shl rbx, 2
mov dl, 0xff
mov r8, rbx
call fcn.140040380
mov dword [0x1400d1ad0], edi
test edi, edi
je 0x14000945c
mov rax, qword [0x1400d1ad8]
mov edx, edi
xor ecx, ecx
nop word cs:[rax + rax]
cmp dword [rax + rcx*4], 0xffffffff
jne 0x140009460
inc rcx
cmp rdx, rcx
jne 0x140009440
jmp 0x140009462
mov dword [0x1400d1ad0], 0
jmp 0x140009462
xor edi, edi
jmp 0x140009462
mov edi, ecx
mov dword [0x1400d1ab8], edi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 0x1f
jmp 0x14000947e
mov ecx, 0x26
xor edx, edx
xor r8d, r8d
call fcn.140001c10
int3
Function at 0x140009490
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
call fcn.140002350
mov rcx, qword [0x1400d19a8]
test rcx, rcx
je 0x140009699
lea rdx, [0x140048307]
call fcn.14000d1d0
test rax, rax
je 0x1400096a0
mov rsi, rax
mov qword [0x1400d1970], rax
mov rcx, rax
call fcn.140002310
cmp rax, 0x18
jbe 0x1400096b8
lea rcx, [0x1400d1a00]
mov edx, 1
mov r8d, 0x18
mov r9, rsi
call fcn.140022438
cmp rax, 0x18
jne 0x1400096cc
mov r8d, dword [0x1400d1a08]
mov eax, r8d
and eax, 0x7f000000
cmp eax, 0x6000000
jne 0x1400096e4
test r8d, 0x80e0
jne 0x1400096eb
mov r11d, dword [0x1400d1a0c]
test r11d, r11d
jne 0x140009556
mov ecx, 0x65
xor edx, edx
call fcn.140002030
mov dword [0x1400d1a0c], 1
mov r11d, 1
mov r8d, dword [0x1400d1a08]
mov dword [0x1400d1a40], r11d
mov eax, r8d
shr eax, 0xc
and al, 7
lea r10d, [rax + 9]
mov edx, r8d
shr dl, 3
and dl, 1
mov byte [0x1400d1a1d], dl
mov ecx, r8d
shr cl, 4
and cl, 1
mov byte [0x1400d1a1e], cl
mov r9d, r8d
and r9b, 1
mov byte [0x1400d1a1f], r9b
mov ecx, r8d
shr ecx, 8
and cl, 0xf
inc cl
mov byte [0x1400d1a26], cl
mov esi, r8d
shr esi, 0x10
movzx esi, sil
test esi, esi
mov edi, 0x100
cmovne edi, esi
mov esi, 1
shl rsi, cl
mov word [0x1400d1a24], di
mov edi, 1
cvtsi2sd xmm0, rsi
mov ecx, r11d
cvtsi2sd xmm1, rcx
lea ecx, [rax + 0xa]
shl rdi, cl
shr r8d, 0x1f
divsd xmm0, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm1, rdi
mov byte [0x1400d1a1c], r8b
divsd xmm0, xmm1
xor al, 0x17
mov r8d, 0xf
mov ecx, eax
shl r8d, cl
movsd qword [0x1400d1a38], xmm0
mov byte [0x1400d1a27], r10b
not r8d
and r8d, 0xfffffffe
mov dword [0x1400d1a2c], r8d
mov byte [0x1400d1a28], al
cmp r10b, byte [0x1400d19c8]
jne 0x1400096fa
test r9b, r9b
je 0x14000965d
test dl, dl
jne 0x14000965d
mov ecx, 0x6c
xor edx, edx
call fcn.140002030
movzx edx, byte [0x1400d1a1d]
movzx r9d, byte [0x1400d1a1f]
test dl, dl
je 0x14000966b
mov eax, 2
test r9b, r9b
jne 0x14000968c
mov ecx, dword [0x1400d1a14]
mov eax, 1
cmp ecx, 0xffff0000
jb 0x14000968c
xor eax, eax
cmp ecx, 0xfffffff4
cmove eax, ecx
cmp ecx, 0xfffffff0
cmove eax, ecx
mov dword [0x1400d1a20], eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x23
jmp 0x1400096f0
mov rdx, qword [0x1400d19a8]
mov ecx, 0x22
mov r8, 0xfffffffffffffffe
call fcn.140001c10
mov rdx, qword [0x1400d19a8]
mov ecx, 0x25
mov r8, rax
call fcn.140001c10
mov rdx, qword [0x1400d19a8]
mov ecx, 0x24
mov r8, 0xfffffffffffffffe
call fcn.140001c10
mov ecx, 0x27
jmp 0x1400096f0
mov ecx, 0x28
xor edx, edx
xor r8d, r8d
call fcn.140001c10
movzx r8d, r10b
mov ecx, 0x2b
xor edx, edx
call fcn.140001c10
int3

Function at 0x14000a980
Capabilities:
Set current directory
Set environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400e2a48]
inc eax
mov dword [0x1400e2a48], eax
cmp eax, 1
ja 0x14000a9db
mov r9, qword [0x1400d1980]
lea rcx, str._nFatal_exception_during_format_file_processing_
mov edx, 0x2f
mov r8d, 1
call fcn.140022c84
call fcn.140002400
lea rcx, str.Main.log
call fcn.1400025f0
call fcn.14001ec30
mov rcx, qword [0x1400d1968]
add rsp, 0x28
jmp fcn.14001c450
nop
add rsp, 0x28
ret
Function at 0x14000acc0
Capabilities:
Set current directory
Set environment variable

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400e2a48]
inc eax
mov dword [0x1400e2a48], eax
cmp eax, 1
ja 0x14000ad3c
mov rax, qword [0x1400d1978]
mov r9, qword [0x1400d1980]
test rax, rax
je 0x14000ad10
cmp rax, r9
je 0x14000ad10
lea rcx, str._nFatal_exception_when_processing_binary_files_
mov edx, 0x2e
mov r8d, 1
mov r9, rax
call fcn.140022c84
mov r9, qword [0x1400d1980]
lea rcx, str._nFatal_exception_when_processing_binary_files_
mov edx, 0x2e
mov r8d, 1
call fcn.140022c84
call fcn.14001ec30
mov rcx, qword [0x1400d1968]
add rsp, 0x28
jmp fcn.14001c450
nop
add rsp, 0x28
ret

Function at 0x14000d4b0
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x450
mov rsi, rdx
mov rdi, rcx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x448], rax
call fcn.140024310
mov rbx, rax
mov rcx, rsi
call fcn.140024310
lea rcx, [rbx - 0x104]
mov ebp, 0xffffffff
cmp rcx, 0xfffffffffffffefd
jb 0x14000d5a1
test rax, rax
je 0x14000d5a1
cmp rax, 0x103
ja 0x14000d5a1
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x28], 0x104
mov r14, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
xor edx, edx
mov r8, rsi
mov r9d, eax
call r14
mov ebp, eax
cdqe
mov word [rsp + rax*2 + 0x30], 0
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x104
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, ebx
call r14
cdqe
mov word [rsp + rax*2 + 0x240], 0
test eax, eax
je 0x14000d594
test ebp, ebp
je 0x14000d594
lea rcx, [rsp + 0x240]
lea rdx, [rsp + 0x30]
call fcn.1400219c8
jmp 0x14000d59f
mov rcx, rdi
mov rdx, rsi
call fcn.140023948
mov ebp, eax
mov rcx, qword [rsp + 0x448]
xor rcx, rsp
call fcn.14000d6d0
mov eax, ebp
add rsp, 0x450
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14000df58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000dfa2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000dfa2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000dfa2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000dfa2
cmp dword [rcx + 0x84], 0xe
jbe 0x14000dfa2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000dfa4
xor al, al
add rsp, 0x28
ret
Function at 0x14001c13c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001c284
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001c2f3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c2f3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001c2f3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001c2f3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001c2f3
cmp dword [rcx + 0x84], 0xe
jbe 0x14001c2f3
cmp dword [rcx + 0xf8], 0
je 0x14001c2f3
mov ecx, ebx
call fcn.14001c1bc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001c418
nop
cmp dword [rbp + 0x20], 0
je 0x14001c341
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001c250
int3

Function at 0x14001c284
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001c284
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001c2f3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c2f3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001c2f3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001c2f3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001c2f3
cmp dword [rcx + 0x84], 0xe
jbe 0x14001c2f3
cmp dword [rcx + 0xf8], 0
je 0x14001c2f3
mov ecx, ebx
call fcn.14001c1bc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001c418
nop
cmp dword [rbp + 0x20], 0
je 0x14001c341
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001c250
int3
Function at 0x14001c804
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rbx, rcx
mov ecx, dword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x14001c83f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001eb7c
call fcn.14001eb00
mov eax, dword [rax]
jmp 0x14001c8b6
cmp rdi, qword [rbx + 0x18]
ja 0x14001c84b
mov qword [rbx + 0x20], rdi
jmp 0x14001c8b4
cmp byte [rbx + 0x28], 0
lea rsi, [rdi + 1]
je 0x14001c862
mov rcx, qword [rbx + 0x10]
call fcn.1400285d0
mov byte [rbx + 0x28], 0
lea rcx, [rdi*2 + 2]
call fcn.1400293c0
mov qword [rbx + 0x10], rax
mov r8, rax
neg rax
mov edx, 0
sbb eax, eax
not eax
and eax, 0xc
cmove rdx, rsi
test eax, eax
sete cl
mov byte [rbx + 0x28], cl
mov qword [rbx + 0x18], rdx
test eax, eax
jne 0x14001c8b6
mov ecx, dword [rbx + 0x18]
mov rdx, r8
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, eax
test rax, rax
je 0x14001c829
mov qword [rbx + 0x20], rax
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140020db4
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x14004b650]
mov rbp, rcx
call fcn.14002d014
xor edi, edi
test rax, rax
je 0x140020e9a
mov ebx, edi
call fcn.14001eb00
mov r14d, dword [rax]
call fcn.14001eb00
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.14001f088
mov rsi, rax
test rax, rax
je 0x140020e2b
call fcn.14001eb00
mov dword [rax], r14d
jmp 0x140020e55
call fcn.14001eb00
cmp dword [rax], 0x22
jne 0x140020e92
call fcn.14001eb00
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.14001f088
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x140020e92
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x140020e59
cmp rax, 3
je 0x140020e74
mov rcx, rsi
call fcn.140020d10
test al, al
je 0x140020e85
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140020e85
mov dil, 1
mov rcx, rbx
call fcn.1400226b8
mov al, dil
jmp 0x140020e9c
mov rcx, rbx
call fcn.1400226b8
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000d6d0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140021664
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1400216ae
call fcn.14001eb5c
mov dword [rax], 0xf
call fcn.14001eb00
mov dword [rax], 0xd
call fcn.1400286e8
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14000d6d0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1400216b9
lea eax, [rbx + 1]
jmp 0x14002169b
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x140021699
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x14002169b

Function at 0x1400219a0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400219c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001eb7c
or eax, 0xffffffff
jmp 0x1400219c2
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400227c4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14000d670
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14002a9e8
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140022813
mov rax, rbp
jmp 0x14002291b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xe3770]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14002f59c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0xe3770]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140022917
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140022917
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14002f59c
test rax, rax
js 0x140022917
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140022917
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140022909
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140022909
cmp byte [rcx], 0xd
jne 0x1400228ef
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400228fe
cmp byte [rcx + 1], 0xa
jne 0x1400228fe
inc rcx
jmp 0x1400228fe
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x50b30]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400228d1
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14002291b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14000d6d0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret