joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c960
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
movapd xmmword [rsp + 0x40], xmm7
movapd xmmword [rsp + 0x30], xmm6
mov r12, qword [rcx]
cmp dword [r12 + 4], 0
jne 0x14000cb20
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
movsxd r15, dword [r12]
mov rcx, qword [rcx + 8]
cmp rcx, rdx
je 0x14000c9c2
mov qword [rsp + 0x28], r12
add r12, 8
mov qword [rsp + 0x20], r12
mov r8d, 1
mov rdx, rbx
mov r9d, 1
call fcn.14000bbb0
jmp 0x14000ca12
mov rcx, r15
shl rcx, 4
call fcn.14006f1ac
mov r14, rax
lea rax, [r12 + 8]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
mov r8d, 1
mov rcx, r14
mov rdx, rbx
mov r9d, 1
call fcn.14000bbb0
movsxd r8, dword [r12]
shl r8, 4
mov rcx, rbx
mov rdx, r14
call fcn.1400918e0
mov rcx, r14
call fcn.14006e598
mov rax, qword [rdi + 8]
movsd xmm0, qword [rax]
movsd xmm1, qword [rax + 8]
movapd xmm2, xmm0
addsd xmm2, xmm1
movsd qword [rsi], xmm2
subsd xmm0, xmm1
mov rax, r15
shl rax, 4
movsd qword [rsi + rax], xmm0
mov qword [rsi + 8], 0
mov qword [rsi + rax + 8], 0
cmp r15d, 2
jl 0x14000cb08
add rax, 0xfffffffffffffff0
shr r15d, 1
shl r15, 4
xor ecx, ecx
movapd xmm0, xmmword [0x140093020]
movapd xmm1, xmmword [0x1400937b0]
nop word cs:[rax + rax]
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
movupd xmm3, xmmword [rdx + rcx + 0x10]
movupd xmm4, xmmword [rdx + rax]
movapd xmm2, xmm3
addpd xmm2, xmm4
subpd xmm3, xmm4
movapd xmm4, xmm3
movsd xmm4, xmm2
movupd xmm5, xmmword [r8 + rcx]
movapd xmm6, xmm2
xorpd xmm6, xmm0
unpckhpd xmm6, xmm2
movapd xmm7, xmm3
unpcklpd xmm7, xmm3
mulpd xmm7, xmm5
shufpd xmm5, xmm5, 1
mulpd xmm5, xmm6
addpd xmm7, xmm5
addpd xmm4, xmm7
mulpd xmm4, xmm1
movupd xmmword [rsi + rcx + 0x10], xmm4
shufpd xmm2, xmm7, 2
shufpd xmm7, xmm3, 2
subpd xmm2, xmm7
mulpd xmm2, xmm1
movupd xmmword [rsi + rax], xmm2
add rax, 0xfffffffffffffff0
add rcx, 0x10
cmp r15, rcx
jne 0x14000ca80
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 2
call fcn.14005bf0c
lea rcx, str.kiss_fft_usage_error:_improper_alloc_n
mov edx, 0x25
mov r8d, 1
mov r9, rax
call fcn.14006e6dc
mov ecx, 1
call fcn.140063e44
int3

Function at 0x14000ccf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx + 0x20]
jmp fcn.14000cd00
Function at 0x1400243b0
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x1400243bd
cmp edx, 4
jae 0x1400243c0
xor eax, eax
jmp 0x140024409
xor eax, eax
ret
mov r8d, edx
and r8d, 0xfffffffc
xor eax, eax
lea r9, [0x140095620]
xor al, byte [rcx]
movzx eax, al
movzx r10d, byte [rcx + 1]
xor r10b, byte [rax + r9]
movzx eax, byte [rcx + 2]
movzx r10d, r10b
xor al, byte [r10 + r9]
movzx eax, al
movzx r10d, byte [rcx + 3]
xor r10b, byte [rax + r9]
add rcx, 4
movzx eax, r10b
movzx eax, byte [rax + r9]
add r8d, 0xfffffffc
jne 0x1400243d0
test dl, 3
je 0x140024434
and edx, 3
xor r8d, r8d
lea r9, [0x140095620]
nop dword [rax + rax]
xor al, byte [rcx + r8]
movzx eax, al
movzx eax, byte [rax + r9]
inc r8
cmp edx, r8d
jne 0x140024420
ret

Function at 0x140024440
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov eax, r8d
test edx, edx
je 0x1400244f1
mov edx, edx
xor r8d, r8d
lea r9, [0x140095720]
nop dword [rax]
mov rbx, qword [rcx + r8*8]
mov r10, rbx
mov r11, rbx
mov esi, ebx
mov edi, ebx
movzx ebp, bh
movzx r14d, bl
shr rbx, 0x30
xor eax, ebx
movzx ebx, ah
movzx eax, al
movzx eax, word [r9 + rax*2 + 0xc00]
xor ax, word [r9 + rbx*2 + 0xe00]
shr r10, 0x27
and r10d, 0x1fe
xor ax, word [r10 + r9 + 0xa00]
shr r11, 0x1f
and r11d, 0x1fe
xor ax, word [r11 + r9 + 0x800]
shr esi, 0x18
xor ax, word [r9 + rsi*2 + 0x600]
shr edi, 0x10
movzx r10d, dil
xor ax, word [r9 + r10*2 + 0x400]
xor ax, word [r9 + rbp*2 + 0x200]
xor ax, word [r9 + r14*2]
inc r8
cmp edx, r8d
jne 0x140024460
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140024ac0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
test r8d, r8d
je 0x140024adf
mov eax, r8d
cmp r8d, 8
jae 0x140024ae6
xor r8d, r8d
xor ecx, ecx
jmp 0x140024b70
xor ecx, ecx
jmp 0x140024b89
mov r8d, eax
and r8d, 0xfffffff8
mov ecx, eax
shr ecx, 3
shl rcx, 5
pxor xmm0, xmm0
xor r9d, r9d
pxor xmm1, xmm1
nop word cs:[rax + rax]
movdqu xmm2, xmmword [rdx + r9]
movdqu xmm3, xmmword [rdx + r9 + 0x10]
movdqa xmm4, xmm2
psrad xmm4, 0x1f
pxor xmm2, xmm4
psubd xmm2, xmm4
paddd xmm0, xmm2
movdqa xmm2, xmm3
psrad xmm2, 0x1f
pxor xmm3, xmm2
psubd xmm3, xmm2
paddd xmm1, xmm3
add r9, 0x20
cmp rcx, r9
jne 0x140024b10
paddd xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddd xmm0, xmm1
pshufd xmm1, xmm0, 0x55
paddd xmm1, xmm0
movd ecx, xmm1
cmp r8, rax
je 0x140024b89
nop
mov r9d, dword [rdx + r8*4]
mov r10d, r9d
neg r10d
cmovs r10d, r9d
add ecx, r10d
inc r8
cmp rax, r8
jne 0x140024b70
cmp ecx, 1
adc ecx, 0
call fcn.140027950
add eax, esi
add rsp, 0x20
pop rsi
ret
Function at 0x140024ba0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, r9d
mov esi, ecx
test r8d, r8d
je 0x140024bc3
mov eax, r8d
cmp r8d, 8
jae 0x140024bca
xor r8d, r8d
xor ecx, ecx
jmp 0x140024c50
xor ecx, ecx
jmp 0x140024c69
mov r8d, eax
and r8d, 0xfffffff8
mov ecx, eax
shr ecx, 3
shl rcx, 5
pxor xmm0, xmm0
xor r9d, r9d
pxor xmm1, xmm1
nop word cs:[rax + rax]
movdqu xmm2, xmmword [rdx + r9]
movdqu xmm3, xmmword [rdx + r9 + 0x10]
movdqa xmm4, xmm2
psrad xmm4, 0x1f
pxor xmm2, xmm4
psubd xmm2, xmm4
paddd xmm0, xmm2
movdqa xmm2, xmm3
psrad xmm2, 0x1f
pxor xmm3, xmm2
psubd xmm3, xmm2
paddd xmm1, xmm3
add r9, 0x20
cmp rcx, r9
jne 0x140024bf0
paddd xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddd xmm0, xmm1
pshufd xmm1, xmm0, 0x55
paddd xmm1, xmm0
movd ecx, xmm1
cmp r8, rax
je 0x140024c69
nop
mov r9d, dword [rdx + r8*4]
mov r10d, r9d
neg r10d
cmovs r10d, r9d
add ecx, r10d
inc r8
cmp rax, r8
jne 0x140024c50
cmp ecx, 1
adc ecx, 0
call fcn.140027950
mov ecx, esi
sub ecx, edi
add eax, ecx
cmp eax, esi
cmovle eax, esi
inc eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140026dc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
cmp r8d, 8
jl 0x140026e74
lea rax, [0x1400968c0]
nop word cs:[rax + rax]
mov ebx, dword [rdx]
bswap ebx
xor ebx, ecx
mov ecx, ebx
movzx esi, bh
movzx r9d, bl
mov r10d, ebx
shr r10d, 0x18
shr ecx, 0x10
movzx ecx, cl
mov ecx, dword [rax + rcx*4 + 0x1800]
xor ecx, dword [rax + r10*4 + 0x1c00]
xor ecx, dword [rax + rsi*4 + 0x1400]
xor ecx, dword [rax + r9*4 + 0x1000]
movzx r9d, byte [rdx + 4]
xor ecx, dword [rax + r9*4 + 0xc00]
movzx r9d, byte [rdx + 5]
xor ecx, dword [rax + r9*4 + 0x800]
movzx r9d, byte [rdx + 6]
xor ecx, dword [rax + r9*4 + 0x400]
movzx r9d, byte [rdx + 7]
xor ecx, dword [rax + r9*4]
add rdx, 8
lea r9d, [r8 - 8]
cmp r8d, 0xf
mov r8d, r9d
ja 0x140026de0
test r9d, r9d
je 0x140026e7c
test r9b, 1
jne 0x140026e80
mov r8d, r9d
cmp r9d, 1
jne 0x140026ea9
jmp 0x140026ef2
mov r9d, r8d
test r9d, r9d
jne 0x140026e60
mov eax, ecx
jmp 0x140026ef2
lea r8d, [r9 - 1]
mov eax, ecx
shl eax, 8
shr ecx, 0x18
movzx r10d, byte [rdx]
inc rdx
xor r10d, ecx
lea rcx, [0x1400968c0]
xor eax, dword [rcx + r10*4]
mov ecx, eax
cmp r9d, 1
je 0x140026ef2
mov r8d, r8d
xor r9d, r9d
lea r10, [0x1400968c0]
mov eax, ecx
nop dword [rax + rax]
mov ecx, eax
shl ecx, 8
shr eax, 0x18
movzx r11d, byte [rdx + r9]
xor r11d, eax
xor ecx, dword [r10 + r11*4]
mov eax, ecx
shl eax, 8
shr ecx, 0x18
movzx r11d, byte [rdx + r9 + 1]
xor r11d, ecx
xor eax, dword [r10 + r11*4]
add r9, 2
cmp r8d, r9d
jne 0x140026ec0
pop rbx
pop rsi
ret
Function at 0x14002f090
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x14002f126
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x14002f12d
mov r15, rsi
jmp 0x14002f0eb
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call fcn.1400918e0
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x14002f11e
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14002f103
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x14002f0c0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14002f11e
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x14002f0eb
sub rsi, r15
jmp 0x14002f21a
xor esi, esi
jmp 0x14002f21a
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14002f180
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x14002f180
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.1400918e0
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x14002f191
jmp 0x14002f217
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x14002f217
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x14002f1c0
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
nop dword [rax]
cmp r14, 0x1000
jb 0x14002f1f3
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.14006e318
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x14002f1c0
jmp 0x14002f217
test r14, r14
je 0x14002f214
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.14006e318
sub r14, rax
jmp 0x14002f217
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140039850
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x270
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1e8], 0xfffffffffffffffe
mov rax, qword [rcx + 0x28]
inc rax
cmp rax, 1
jbe 0x1400399e6
mov rdi, r8
test r8, r8
je 0x1400398e9
mov rbx, rdx
mov rsi, rcx
xor r15d, r15d
lea r14, [rbp + 0x1dc]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
nop word cs:[rax + rax]
mov dword [rbp + 0x1dc], 0
mov r8d, edi
sub r8d, r15d
lea rdx, [rbx + r15]
mov rcx, qword [rsi + 0x28]
mov qword [rsp + 0x20], 0
mov r9, r14
call r12
test eax, eax
je 0x1400398fb
mov eax, dword [rbp + 0x1dc]
add r15, rax
cmp r15, rdi
jb 0x1400398b0
add rsp, 0x270
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rdx, str.Error_writing_to_file__
lea rdi, [rbp - 0x58]
mov rcx, rdi
call fcn.140034e90
add rsi, 0x20
mov rcx, rdi
mov rdx, rsi
call fcn.1400333a0
lea rdx, [0x1400a8619]
lea rcx, [rbp - 0x58]
call fcn.140032e30
lea rcx, [rbp + 0x1e0]
call fcn.140049e50
lea rcx, [rbp - 0x58]
lea rdx, [rbp + 0x1e0]
call fcn.1400333a0
mov rcx, qword [rbp + 0x1e0]
test rcx, rcx
je 0x140039970
mov qword [rbp + 0x1e0], 0
lock dec dword [rcx + 8]
jne 0x140039970
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rcx, [rbp + 0x1e0]
lea rdx, [rbp - 0x58]
call fcn.140033490
mov dword [rbp + 0x1c0], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1c8], 0
mov rax, qword [rbp + 0x1e0]
test rax, rax
je 0x1400399ba
mov qword [rbp + 0x1c8], rax
lock inc dword [rax + 8]
mov qword [rbp + 0x1d0], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp + 0x1b8], rax
lea rdx, [0x1400b4fb0]
lea rcx, [rbp + 0x1b8]
call fcn.1400596bc
lea rdx, str.File_output_is_no_longer_open
lea rcx, [rbp + 0x1e0]
call fcn.1400328b0
mov dword [rbp - 0x50], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0
mov rax, qword [rbp + 0x1e0]
test rax, rax
je 0x140039a27
mov qword [rbp - 0x48], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x40], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1400b4fb0]
lea rcx, [rbp - 0x58]
call fcn.1400596bc
int3
Function at 0x140042260
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
test r8, r8
je 0x1400422b0
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x1400422b4
mov dword [rbp - 0x14], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x14]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140042314
mov eax, dword [rbp - 0x14]
add rsp, 0x80
pop rbp
ret
xor eax, eax
jmp 0x1400422a7
lea rdx, str.File_is_not_open
lea rcx, [rbp - 0x10]
call fcn.1400328b0
mov dword [rbp - 0x50], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x1400422ef
mov qword [rbp - 0x48], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x40], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1400b4fb0]
lea rcx, [rbp - 0x58]
call fcn.1400596bc
jmp 0x140042372
lea rdx, str.ReadFile___failed
lea rcx, [rbp - 0x10]
call fcn.1400328b0
mov dword [rbp - 0x30], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x14004234f
mov qword [rbp - 0x28], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x20], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x38], rax
lea rdx, [0x1400b4fb0]
lea rcx, [rbp - 0x38]
call fcn.1400596bc
int3

Function at 0x140042cc0
Capabilities:
Get file size

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x140042cfc
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140042d5c
mov rax, qword [rbp - 0x10]
add rsp, 0x80
pop rbp
ret
lea rdx, str.File_is_not_open
lea rcx, [rbp - 0x10]
call fcn.1400328b0
mov dword [rbp - 0x50], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140042d37
mov qword [rbp - 0x48], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x40], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1400b4fb0]
lea rcx, [rbp - 0x58]
call fcn.1400596bc
jmp 0x140042dba
lea rdx, str.Could_not_get_length_of_file
lea rcx, [rbp - 0x18]
call fcn.1400328b0
mov dword [rbp - 0x30], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x140042d97
mov qword [rbp - 0x28], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x20], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x38], rax
lea rdx, [0x1400b4fb0]
lea rcx, [rbp - 0x38]
call fcn.1400596bc
int3
Function at 0x14004d7f0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x288
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x200], 0xfffffffffffffffe
cmp qword [rdx], 0
je 0x14004d911
mov rsi, rdx
lea rdx, str.Drives
mov rcx, rsi
call fcn.140033a10
test eax, eax
je 0x14004d911
lea rdx, str.Network
mov rcx, rsi
call fcn.140033a10
test eax, eax
je 0x14004d911
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov rdx, rsi
call fcn.14004b190
lea r8, [0x1400c37d8]
lea rdi, [rbp + 0x1b0]
mov rcx, rbx
mov rdx, rdi
call fcn.140033c20
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14004d892
mov qword [rbp - 0x60], 0
lock dec dword [rcx + 8]
jne 0x14004d892
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
cmp qword [rbp + 0x1c8], 8
jb 0x14004d8a3
mov rdi, qword [rbp + 0x1b0]
mov rcx, rdi
call fcn.14006978c
test eax, eax
je 0x14004d8c5
call fcn.140066404
cmp dword [rax], 0x11
jne 0x14004d91e
mov rdx, rsi
call fcn.14004d640
test al, al
je 0x14004d91e
mov rax, qword [rbp + 0x1c8]
cmp rax, 8
jb 0x14004d911
mov rcx, qword [rbp + 0x1b0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14004d90c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14004da14
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400546c4
nop
add rsp, 0x288
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.Could_not_create_directory
lea rcx, [rbp - 0x60]
call fcn.140034e90
lea rcx, [rbp - 0x60]
mov rdx, rdi
call fcn.140035460
lea rdx, [0x1400a861e]
lea rcx, [rbp - 0x60]
call fcn.1400337b0
lea rcx, [rbp + 0x1f8]
call fcn.140049e50
lea rcx, [rbp - 0x60]
lea rdx, [rbp + 0x1f8]
call fcn.1400337f0
lea rcx, [rbp + 0x1f0]
lea rdx, [rbp - 0x60]
call fcn.140033490
mov rcx, qword [rbp + 0x1f8]
test rcx, rcx
je 0x14004d99d
mov qword [rbp + 0x1f8], 0
lock dec dword [rcx + 8]
jne 0x14004d99d
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rbp + 0x1a0]
test rcx, rcx
je 0x14004d9ae
call fcn.14006e598
mov dword [rbp + 0x1d8], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1e0], 0
mov rax, qword [rbp + 0x1f0]
test rax, rax
je 0x14004d9e8
mov qword [rbp + 0x1e0], rax
lock inc dword [rax + 8]
mov qword [rbp + 0x1e8], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp + 0x1d0], rax
lea rdx, [0x1400b4fb0]
lea rcx, [rbp + 0x1d0]
call fcn.1400596bc
call fcn.140068134
int3

Function at 0x140058498
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400584e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400584e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400584e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400584e2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400584e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400584e4
xor al, al
add rsp, 0x28
ret
Function at 0x140063e44
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140063f8c
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140063ffb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140063ffb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140063ffb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140063ffb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140063ffb
cmp dword [rcx + 0x84], 0xe
jbe 0x140063ffb
cmp dword [rcx + 0xf8], 0
je 0x140063ffb
mov ecx, ebx
call fcn.140063ec4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140064120
nop
cmp dword [rbp + 0x20], 0
je 0x140064049
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140063f58
int3

Function at 0x140063f8c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140063f8c
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140063ffb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140063ffb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140063ffb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140063ffb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140063ffb
cmp dword [rcx + 0x84], 0xe
jbe 0x140063ffb
cmp dword [rcx + 0xf8], 0
je 0x140063ffb
mov ecx, ebx
call fcn.140063ec4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140064120
nop
cmp dword [rbp + 0x20], 0
je 0x140064049
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140063f58
int3
Function at 0x140066f6c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1400bf3c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x1400abe80]
mov rbp, rcx
call fcn.140082ca4
xor edi, edi
test rax, rax
je 0x140067052
mov ebx, edi
call fcn.140066404
mov r14d, dword [rax]
call fcn.140066404
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.1400859b4
mov rsi, rax
test rax, rax
je 0x140066fe3
call fcn.140066404
mov dword [rax], r14d
jmp 0x14006700d
call fcn.140066404
cmp dword [rax], 0x22
jne 0x14006704a
call fcn.140066404
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.1400859b4
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x14006704a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x140067011
cmp rax, 3
je 0x14006702c
mov rcx, rsi
call fcn.140066ec8
test al, al
je 0x14006703d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x14006703d
mov dil, 1
mov rcx, rbx
call fcn.14006e598
mov al, dil
jmp 0x140067054
mov rcx, rbx
call fcn.14006e598
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140055700
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140067564
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140059200
sub rsp, rax
mov rax, qword [0x1400bf3c0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140066534
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400675b3
mov rax, rbp
jmp 0x1400676bb
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xc3060]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1400851e8
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0xc3060]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400676b7
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400676b7
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1400851e8
test rax, rax
js 0x1400676b7
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400676b7
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400676a9
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400676a9
cmp byte [rcx], 0xd
jne 0x14006768f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14006769e
cmp byte [rcx + 1], 0xa
jne 0x14006769e
inc rcx
jmp 0x14006769e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0xc00d0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140067671
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400676bb
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140055700
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140069078
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400bf3c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1400690c2
call fcn.140066460
mov dword [rax], 0xf
call fcn.140066404
mov dword [rax], 0xd
call fcn.140068114
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140055700
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1400690cd
lea eax, [rbx + 1]
jmp 0x1400690af
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1400690ad
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1400690af

Function at 0x1400697b8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400697d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140066480
or eax, 0xffffffff
jmp 0x1400697da
xor eax, eax
add rsp, 0x28
ret