joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009de70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, 2
mov rbx, r8
mov rdi, rdx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
call fcn.14009e6e0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdx, rax
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1400aca80
Capabilities:
Open clipboard

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
mov rbx, rdx
xor edi, edi
call qword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
jne 0x1400acaa6
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8, qword [str.text_plain]
mov rax, rbx
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400acac6
inc rax
test ecx, ecx
jne 0x1400acab3
test edx, edx
je 0x1400acb2a
cmp byte [rbx], dil
je 0x1400acb2a
mov rdx, qword [str.image]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x1400acaf2
inc rbx
test eax, eax
jne 0x1400acae0
test ecx, ecx
jne 0x1400acb37
mov ecx, 8
call qword [sym.imp.user32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x1400acb12
lea ecx, [rax + 0xe]
call qword [sym.imp.user32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1400acb37
mov edi, 1
call qword [sym.imp.user32.dll_CloseClipboard]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 0xd
call qword [sym.imp.user32.dll_IsClipboardFormatAvailable]
mov edi, eax
call qword [sym.imp.user32.dll_CloseClipboard]
mov rbx, qword [rsp + 0x30]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x1400acbe0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
test rdx, rdx
je 0x1400ace30
push rbx
push rdi
sub rsp, 0x38
mov edi, r8d
mov rbx, rdx
test r8d, r8d
js 0x1400ace2a
mov qword [rsp + 0x50], rbp
cmp r9d, 2
mov qword [rsp + 0x58], rsi
mov ebp, 1
mov qword [rsp + 0x60], r12
mov eax, r8d
mov qword [rsp + 0x30], r13
mov r12d, ebp
cmovl r12d, r9d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov esi, r15d
test r8d, r8d
jle 0x1400accd3
nop
movzx ecx, byte [rdx]
cmp cl, 0xd
jne 0x1400acc5f
cmp byte [rdx + 1], 0xa
jne 0x1400acc69
cmp eax, 2
jb 0x1400acc69
add esi, 2
mov ecx, 2
dec eax
jmp 0x1400acc6e
cmp cl, 0xa
jne 0x1400acc69
add esi, 2
jmp 0x1400acc6b
inc esi
mov rcx, rbp
dec eax
add rdx, rcx
test eax, eax
jg 0x1400acc40
lea ebp, [rsi + 1]
movsxd rcx, ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r14, rax
movzx ecx, byte [rbx]
cmp cl, 0xd
jne 0x1400accaf
cmp byte [rbx + 1], 0xa
lea rdx, [rbx + 1]
jne 0x1400accaf
cmp edi, 2
jb 0x1400accaf
mov byte [rax], cl
mov rbx, rdx
movzx ecx, byte [rdx]
mov byte [rax + 1], cl
add rax, 2
dec edi
jmp 0x1400accc8
cmp cl, 0xa
jne 0x1400accc3
mov byte [rax], 0xd
movzx ecx, byte [rbx]
mov byte [rax + 1], cl
add rax, 2
jmp 0x1400accc8
mov byte [rax], cl
inc rax
dec edi
inc rbx
test edi, edi
jg 0x1400acc85
jmp 0x1400accde
mov rcx, rbp
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r14, rax
movsxd rdi, r12d
lea r13, [0x140000000]
mov byte [rax], r15b
cmp ebp, dword [r13 + rdi*4 + 0x1b4928]
jle 0x1400acd1d
mov rcx, qword [r13 + rdi*8 + 0x1b4910]
call fcn.140098a60
lea ebx, [rsi + 0x64]
movsxd rcx, ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [r13 + rdi*8 + 0x1b4910], rax
mov dword [r13 + rdi*4 + 0x1b4928], ebx
mov rcx, qword [r13 + rdi*8 + 0x1b4910]
mov rdx, r14
movsxd rbx, esi
mov rbp, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [r13 + rdi*8 + 0x1b4910]
test r12d, r12d
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov byte [rbx + rax], r15b
mov dword [r13 + rdi*4 + 0x1b4920], esi
mov rsi, qword [rsp + 0x58]
mov byte [rdi + r13 + 0x1b4930], 1
mov r13, qword [rsp + 0x30]
je 0x1400ace18
call fcn.140098fb0
test rax, rax
je 0x1400ace18
mov rax, qword [rax + 0xc8]
test rax, rax
je 0x1400acd8d
mov r15, qword [rax]
mov rcx, r15
call qword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x1400ace18
call qword [sym.imp.user32.dll_EmptyClipboard]
mov edx, dword [0x1401b4924]
xor r9d, r9d
mov rcx, qword [0x1401b4918]
xor r8d, r8d
call fcn.1400dd1a0
mov ebx, eax
lea ecx, [rax*2 + 2]
movsxd rdx, ecx
mov ecx, 0x42
call qword [sym.imp.kernel32.dll_GlobalAlloc]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.kernel32.dll_GlobalLock]
mov edx, dword [0x1401b4924]
lea r9d, [rbx + 1]
mov rcx, qword [0x1401b4918]
mov r8, rax
call fcn.1400dd1a0
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.user32.dll_SetClipboardData]
call qword [sym.imp.user32.dll_CloseClipboard]
mov byte [0x1401b4931], 1
mov rcx, r14
call fcn.140098a60
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x1400adb60
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401b3658]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ecx, ecx
call qword [sym.imp.user32.dll_GetKeyboardLayout]
movzx ecx, ax
mov r9d, 6
lea r8, [rsp + 0x20]
mov edx, 0x1004
call qword [sym.imp.kernel32.dll_GetLocaleInfoA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atol]
mov dword [0x1401b8e38], eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14012cd90
add rsp, 0x38
ret

Function at 0x1400adc60
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub rsp, 0x28
call fcn.140098fb0
test rax, rax
je 0x1400add21
mov rcx, qword [rax + 0xc8]
test rcx, rcx
je 0x1400adc81
mov rcx, qword [rcx]
call qword [sym.imp.user32.dll_OpenClipboard]
test eax, eax
je 0x1400add21
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.user32.dll_EmptyClipboard]
mov edx, dword [0x1401b4924]
xor r9d, r9d
mov rcx, qword [0x1401b4918]
xor r8d, r8d
call fcn.1400dd1a0
mov ebx, eax
lea ecx, [rax*2 + 2]
movsxd rdx, ecx
mov ecx, 0x42
call qword [sym.imp.kernel32.dll_GlobalAlloc]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.kernel32.dll_GlobalLock]
mov edx, dword [0x1401b4924]
lea r9d, [rbx + 1]
mov rcx, qword [0x1401b4918]
mov r8, rax
call fcn.1400dd1a0
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.user32.dll_SetClipboardData]
call qword [sym.imp.user32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov byte [0x1401b4931], 1
add rsp, 0x28
ret
Function at 0x1400aeb80
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x1401b5028], 0
jne 0x1400aecff
lea rcx, str.Shcore.DLL
mov byte [0x1401b5028], 1
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.GetProcessDpiAwareness
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400aebde
lea rdx, [rsp + 0x38]
xor ecx, ecx
call rax
test eax, eax
jne 0x1400aebde
mov eax, dword [rsp + 0x38]
cmp eax, 2
je 0x1400aec56
test eax, eax
jne 0x1400aec5d
jmp 0x1400aebe6
mov dword [rsp + 0x38], 0
lea rcx, str.User32.DLL
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SetProcessDpiAwarenessContext
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400aec1e
mov rcx, 0xfffffffffffffffc
call rax
test eax, eax
setne al
mov byte [0x1401b4981], al
jmp 0x1400aec25
movzx eax, byte [0x1401b4981]
test al, al
jne 0x1400aec5d
lea rcx, str.Shcore.DLL
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SetProcessDpiAwareness
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400aec5d
mov ecx, 2
call rax
test eax, eax
jne 0x1400aec5d
mov byte [0x1401b4981], 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
lea rcx, str.IMM32.DLL
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov qword [0x1401b49a0], rax
test rax, rax
jne 0x1400aec92
lea rcx, str.FLTK_Lib_Error:_IMM32.DLL_file_not_found__n_nPlease_check_your_input_method_manager_library_accessibility.
call qword [case.0x1400d1a53.1]
mov rax, qword [0x1401b49a0]
lea rdx, str.ImmAssociateContextEx
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x1401b49a0]
lea rdx, str.ImmGetContext
mov qword [0x1401b49a8], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x1401b49a0]
lea rdx, str.ImmSetCompositionWindow
mov qword [0x1401b49b0], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x1401b49a0]
lea rdx, str.ImmReleaseContext
mov qword [0x1401b49b8], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [0x1401b49c0], rax
call fcn.140095b60
add rsp, 0x28
ret
Function at 0x1400af550
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x678
mov rax, qword [0x1401b3658]
xor rax, rsp
mov qword [rsp + 0x660], rax
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [0x1401b4948]
xor edx, edx
call qword [sym.imp.user32.dll_PeekMessageA]
test eax, eax
je 0x1400af5a7
mov eax, 1
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.14012cd90
add rsp, 0x678
ret
cmp dword [0x1401b49d4], 0
jne 0x1400af5ca
xor eax, eax
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.14012cd90
add rsp, 0x678
ret
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], 0
lea rdx, [0x1401b49e0]
mov r8d, 0x618
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x30]
xor ecx, ecx
lea r9, [rsp + 0x450]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x248]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ws2_32.dll_select]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.14012cd90
add rsp, 0x678
ret
Function at 0x1400bec10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx edi, r9w
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1400bd560
lea rax, vtable.Fl_Anim_GIF_Image.0
mov word [rbx + 0x58], di
mov qword [rbx], rax
xor r14d, r14d
movabs rax, 0x3ff0000000000000
mov qword [rbx + 0x50], r14
mov ecx, 0x90
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x60], rsi
mov word [rbx + 0x68], r14w
mov dword [rbx + 0x6c], 0xffffffff
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdx, rax
test rax, rax
je 0x1400bed08
mov qword [rax], rbx
mov byte [rax + 8], r14b
mov dword [rax + 0xc], r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 1
mov dword [rax + 0x20], 0xffffffff
mov dword [rax + 0x24], 0xff000000
mov qword [rax + 0x28], r14
mov qword [rax + 0x30], r14
mov dword [rax + 0x38], 0x38
mov dword [rax + 0x3c], 0xbf800000
mov byte [rax + 0x40], r14b
mov qword [rax + 0x42], r14
mov qword [rax + 0x50], r14
mov dword [rax + 0x58], r14d
mov dword [rax + 0x5c], 0xffffffff
mov dword [rax + 0x60], 0xff000000
mov qword [rax + 0x68], r14
mov byte [rax + 0x70], r14b
mov dword [rax + 0x74], 0x38
mov dword [rax + 0x78], 0xbf800000
mov qword [rax + 0x7c], r14
mov byte [rax + 0x84], r14b
mov qword [rax + 0x88], r14
jmp 0x1400bed0b
mov rdx, r14
movzx ecx, word [rbx + 0x58]
xor r9d, r9d
mov eax, ecx
mov qword [rbx + 0x78], rdx
shr ecx, 6
xor r8d, r8d
and ecx, 1
shr eax, 7
and eax, 1
lea eax, [rcx + rax*2]
mov dword [rdx + 0x80], eax
mov rdx, rbp
movzx ecx, byte [rbx + 0x58]
mov rax, qword [rbx + 0x78]
shr cl, 3
and cl, 1
mov byte [rax + 0x84], cl
mov rcx, rbx
call fcn.1400bfa10
mov byte [rbx + 0x69], al
mov rax, qword [rbx + 0x78]
mov ecx, dword [rax + 0x68]
test ecx, ecx
je 0x1400bed7e
cmp dword [rax + 0x6c], r14d
je 0x1400bed7e
cmp dword [rbx + 8], r14d
jne 0x1400bed7e
cmp dword [rbx + 0xc], r14d
jne 0x1400bed7e
mov dword [rbx + 8], ecx
mov dword [rbx + 0x1c], ecx
mov eax, dword [rax + 0x6c]
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x20], eax
movzx r8d, di
mov rdx, rsi
mov rcx, rbx
call fcn.1400bef80
test dil, 1
jne 0x1400bedb6
mov rdx, rbx
lea rcx, [0x1400bf0e0]
call fcn.14009a810
mov rax, qword [rbx + 0x78]
cmp dword [rax + 0xc], r14d
je 0x1400bedba
mov rcx, rbx
call fcn.1400bfb80
jmp 0x1400bedba
mov dword [rbx + 0x6c], r14d
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400cdda0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov r9d, dword [0x1401b9540]
mov rdi, rcx
mov rax, qword gs:[0x58]
mov ebp, r8d
mov ecx, 0x80
mov esi, edx
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm7
mov rax, qword [rax + r9*8]
mov eax, dword [rcx + rax]
cmp dword [0x1401b5950], eax
jg 0x1400cdf46
cmp byte [rdi + 0x78], 0
mov rax, qword [rdi + 0x58]
je 0x1400cde52
mov rcx, qword [rax]
xorps xmm4, xmm4
cvtsi2ss xmm4, esi
movss xmm0, dword [rcx]
xorps xmm3, xmm3
movss xmm1, dword [rcx + 4]
cvtps2pd xmm0, xmm0
cvtps2pd xmm1, xmm1
addsd xmm0, qword [0x14016e1b0]
addsd xmm1, qword [0x14016e1b0]
cvtsi2ss xmm3, ebp
cvttsd2si eax, xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, eax
cvttsd2si eax, xmm1
divss xmm4, xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, eax
divss xmm3, xmm0
minss xmm4, xmm3
cvtps2pd xmm6, xmm4
movaps xmm7, xmm6
jmp 0x1400cde7c
mov rax, qword [rax]
movd xmm6, esi
cvtdq2pd xmm6, xmm6
movss xmm0, dword [rax]
cvtps2pd xmm0, xmm0
movd xmm7, ebp
divsd xmm6, xmm0
movss xmm0, dword [rax + 4]
cvtps2pd xmm0, xmm0
cvtdq2pd xmm7, xmm7
divsd xmm7, xmm0
mov eax, esi
imul eax, ebp
shl eax, 2
movsxd rcx, eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdx, qword [rdi + 0x58]
lea ecx, [rsi*4]
mov dword [rsp + 0x48], ecx
lea rbx, [rdi + 0x30]
mov rcx, qword [0x1401b5948]
xorps xmm3, xmm3
mov dword [rsp + 0x40], ebp
xorps xmm2, xmm2
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rax
cvtpd2ps xmm0, xmm7
mov qword [rbx], rax
mov rdx, qword [rdx]
cvtpd2ps xmm1, xmm6
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x20], xmm1
call fcn.1400ce7e0
cmp byte [rdi + 0x6c], 0
mov dword [rdi + 0x38], 1
mov qword [rdi + 0x28], rbx
mov dword [rdi + 0x18], 1
mov dword [rdi + 0x10], 4
je 0x1400cdeff
mov rcx, rdi
call fcn.1400a6620
movss xmm2, dword [rdi + 0x74]
movss xmm0, dword [0x140135b20]
comiss xmm0, xmm2
jbe 0x1400cdf1c
mov edx, dword [rdi + 0x70]
mov rcx, rdi
call fcn.1400a5ac0
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
movaps xmm7, xmmword [rsp + 0x50]
mov dword [rdi + 0x64], esi
mov rsi, qword [r11 + 0x20]
mov dword [rdi + 0x68], ebp
mov rbp, qword [r11 + 0x18]
mov byte [rdi + 0x60], 1
mov rsp, r11
pop rdi
ret
lea rcx, [0x1401b5950]
call fcn.14012cf08
cmp dword [0x1401b5950], 0xffffffff
jne 0x1400cddee
mov ecx, 0x80
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
jne 0x1400cdf71
jmp 0x1400cdfa1
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov dword [rax + 8], 0x3e800000
mov dword [rax + 0xc], 0x3c23d70a
lea rcx, [0x1401b5950]
mov qword [0x1401b5948], rax
call fcn.14012cea8
jmp 0x1400cddee
Function at 0x1400cf5a0
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x90
mov rax, qword [0x1401b3658]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x1400cf7a0
lea rdx, [0x140170318]
mov qword [rsp + 0xa8], rbx
call fcn.1400dcbc0
mov rbx, rax
test rax, rax
je 0x1400cf798
mov edx, 1
mov qword [rsp + 0x80], r14
mov r9, rax
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x3f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
mov r14, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14d, r14d
je 0x1400cf790
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0x88], rsi
cmp r14d, 7
jl 0x1400cf66e
cmp eax, 0x66656423
jne 0x1400cf66e
cmp word [rsp + 0x34], 0x6e69
jne 0x1400cf66e
cmp byte [rsp + 0x36], 0x65
jne 0x1400cf66e
mov ecx, 0x50
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x1400cf6aa
mov rdx, qword [rdi + 0x30]
mov rcx, rax
call fcn.1400cff60
mov rbx, rax
jmp 0x1400cf6ec
cmp r14d, 9
jl 0x1400cf6ae
movabs rcx, 0x2a204d5058202a2f
cmp rax, rcx
jne 0x1400cf6ae
cmp byte [rsp + 0x38], 0x2f
jne 0x1400cf6ae
mov ecx, 0x50
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x1400cf6aa
mov rdx, qword [rdi + 0x30]
mov rcx, rax
call fcn.1400d01e0
mov rbx, rax
jmp 0x1400cf6ec
xor ebx, ebx
jmp 0x1400cf6ec
xor ebx, ebx
cmp dword [0x1401b5970], ebx
mov esi, ebx
jle 0x1400cf780
mov ebp, ebx
mov rax, qword [0x1401b5968]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 0x30]
mov r8d, r14d
call qword [rax + rbp]
mov rbx, rax
test rax, rax
jne 0x1400cf6ec
inc esi
add rbp, 8
cmp esi, dword [0x1401b5970]
jl 0x1400cf6c0
test rbx, rbx
je 0x1400cf780
cmp dword [rdi + 0x48], 0
je 0x1400cf70f
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x1400cf70f
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x18]
mov ebp, dword [rdi + 8]
mov esi, dword [rdi + 0xc]
mov dword [rdi + 0x48], 1
mov qword [rdi + 0x40], rbx
mov eax, dword [rbx + 0x1c]
mov dword [rdi + 8], eax
mov dword [rdi + 0x1c], eax
mov eax, dword [rbx + 0x20]
mov dword [rdi + 0xc], eax
mov dword [rdi + 0x20], eax
mov eax, dword [rbx + 0x10]
mov dword [rdi + 0x10], eax
mov rax, qword [rbx + 0x28]
mov ecx, dword [rbx + 0x18]
mov qword [rdi + 0x28], rax
mov dword [rdi + 0x18], ecx
test ebp, ebp
je 0x1400cf780
test esi, esi
je 0x1400cf767
mov rax, qword [rdi]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x20], 1
mov edx, ebp
mov rcx, rdi
call qword [rax + 0x58]
mov rax, qword [rdi]
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x20], 1
mov edx, ebp
mov rcx, rdi
call qword [rax + 0x58]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0xb0]
mov r14, qword [rsp + 0x80]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14012cd90
add rsp, 0x90
pop rdi
ret
Function at 0x1400d9eb0
Capabilities:
Write file on windows

Disassembly:
push rsi
push r14
sub rsp, 0x28
mov r14, rcx
mov qword [rsp + 0x48], rbp
mov rcx, qword [rcx + 8]
mov rsi, rdx
test rcx, rcx
je 0x1400d9ed1
call fcn.1400d9eb0
mov r8, qword [r14 + 0x18]
lea rdx, str._n__s__n_n
mov rcx, rsi
call fcn.1400bc4b0
xor ebp, ebp
cmp dword [r14 + 0x28], ebp
jle 0x1400da072
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r15
xor r15d, r15d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r14 + 0x20]
mov rcx, rsi
mov rdi, qword [r15 + rax + 8]
mov r8, qword [r15 + rax]
test rdi, rdi
je 0x1400da047
lea rdx, [0x140175790]
call fcn.1400bc4b0
xor ebx, ebx
lea rax, [rdi + 2]
nop dword [rax + rax]
cmp byte [rax - 2], 0
je 0x1400d9f8e
cmp byte [rax - 1], 0
je 0x1400d9f8b
cmp byte [rax], 0
je 0x1400d9f85
cmp byte [rax + 1], 0
je 0x1400d9f7f
cmp byte [rax + 2], 0
je 0x1400d9f79
cmp byte [rax + 3], 0
je 0x1400d9f73
add rbx, 6
add rax, 6
cmp rbx, 0x3c
jb 0x1400d9f40
jmp 0x1400d9f8e
add rbx, 5
jmp 0x1400d9f8e
add rbx, 4
jmp 0x1400d9f8e
add rbx, 3
jmp 0x1400d9f8e
add rbx, 2
jmp 0x1400d9f8e
inc rbx
mov r9, rsi
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea rdx, [0x1401733f8]
mov rcx, rsi
call fcn.1400bc4b0
add rdi, rbx
cmp byte [rdi], 0
je 0x1400da053
nop
xor ebx, ebx
lea rax, [rdi + 2]
cmp byte [rax - 2], 0
je 0x1400da008
cmp byte [rax - 1], 0
je 0x1400da005
cmp byte [rax], 0
je 0x1400d9fff
cmp byte [rax + 1], 0
je 0x1400d9ff9
cmp byte [rax + 2], 0
je 0x1400d9ff3
add rbx, 5
add rax, 5
cmp rbx, 0x50
jb 0x1400d9fc6
jmp 0x1400da008
add rbx, 4
jmp 0x1400da008
add rbx, 3
jmp 0x1400da008
add rbx, 2
jmp 0x1400da008
inc rbx
mov rdx, rsi
mov ecx, 0x2b
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov r9, rsi
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rdx, rsi
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add rdi, rbx
cmp byte [rdi], 0
jne 0x1400d9fc0
jmp 0x1400da053
lea rdx, [0x140175794]
call fcn.1400bc4b0
inc ebp
add r15, 0x10
cmp ebp, dword [r14 + 0x28]
jl 0x1400d9f10
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [r14]
mov rbp, qword [rsp + 0x48]
test rcx, rcx
je 0x1400da087
mov rdx, rsi
call fcn.1400d9eb0
and byte [r14 + 0x30], 0xfe
xor eax, eax
add rsp, 0x28
pop r14
pop rsi
ret
Function at 0x1400e6140
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor esi, esi
movsxd r14, r9d
mov rbp, r8
mov r15, rdx
call qword [sym.imp.kernel32.dll_GetLogicalDrives]
mov r12, qword [rsp + 0x60]
lea ebx, [rsi + 0x41]
mov edi, eax
nop dword [rax]
test dil, 1
je 0x1400e61ab
mov rdx, r14
lea r8, str._c:_
mov r9d, ebx
mov rcx, rbp
call fcn.1400df210
mov r8, r12
mov rdx, rbp
mov rcx, r15
call fcn.1400ff6c0
inc esi
inc ebx
shr edi, 1
cmp ebx, 0x5a
jle 0x1400e6180
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400e65f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400e6604
test ebx, ebx
jle 0x1400e6625
movsxd rax, ebx
movzx ecx, byte [rax + rdx - 1]
cmp cl, 0x2f
je 0x1400e6623
cmp cl, 0x5c
jne 0x1400e6625
dec ebx
cmp ebx, 1
jge 0x1400e6637
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rdi
cmp ebx, 2
jne 0x1400e667c
movsx ecx, byte [rdx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x1400e667c
cmp byte [rsi + 1], 0x3a
jne 0x1400e667c
movzx eax, byte [rsi]
mov ebx, 3
mov byte [rsp + 0x40], al
lea rsi, [rsp + 0x40]
movzx eax, word [0x14017689c]
mov word [rsp + 0x41], ax
movzx eax, byte [0x14017689e]
mov byte [rsp + 0x43], al
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call fcn.1400dd1a0
mov rcx, qword [0x1401b8e48]
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, edi
mov edx, ebx
mov r8, rax
mov qword [0x1401b8e48], rax
mov rcx, rsi
call fcn.1400dd1a0
mov ecx, eax
xor ebx, ebx
mov rax, qword [0x1401b8e48]
mov word [rax + rcx*2], bx
mov rcx, qword [0x1401b8e48]
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
mov rdi, qword [rsp + 0x30]
cmp eax, 0xffffffff
je 0x1400e66e7
test al, 0x10
je 0x1400e66e7
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x1400e6f40
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400e6f60
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call fcn.1400dd1a0
mov rcx, qword [0x1401b8e48]
lea edi, [rax + 1]
mov edx, edi
add rdx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r9d, edi
mov edx, ebx
mov r8, rax
mov qword [0x1401b8e48], rax
mov rcx, rsi
call fcn.1400dd1a0
mov ecx, eax
xor edx, edx
mov rax, qword [0x1401b8e48]
mov word [rax + rcx*2], dx
mov rcx, qword [0x1401b8e48]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]