joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14021a0c0
Capabilities:
Write file on windows

Disassembly:
push r14
mov r14, rcx
push r13
mov r13, rdx
push r12
push rbp
push rdi
push rsi
mov rsi, r9
push rbx
mov rbx, r8
sub rsp, 0x60
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFile]
lea r12, [rsp + 0x3c]
lea rbp, [rsp + 0x40]
mov r8d, 0x1000000
mov r9, r12
mov rdx, r13
mov rcx, r14
cmp rbx, r8
mov qword [rsp + 0x50], rsi
cmovbe r8, rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x58], 0
call rdi
test eax, eax
jne 0x14021a122
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14021a138
mov eax, dword [rsp + 0x3c]
cmp rax, rbx
je 0x14021a136
sub rbx, rax
add rsi, rax
add r13, rax
jmp 0x14021a0eb
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x14021a1f0
Capabilities:
Suspend thread

Disassembly:
push r13
push r12
mov r12, rcx
push rbp
push rdi
push rsi
push rbx
mov ebx, edx
sub rsp, 0x38
mov rcx, qword [rcx]
mov r13d, dword [rcx]
cmp dword [rcx + 4], r13d
jne 0x14021a24f
lea eax, [r13 + r13]
mov rbp, rax
lea rdx, [rax*8 + 8]
xor eax, eax
cmp r13d, 0x1f
cmovbe rcx, rax
call sub.msvcrt.dll_realloc
test rax, rax
je 0x14021a2d5
cmp r13d, 0x1f
jne 0x14021a249
mov rsi, qword [r12]
mov ecx, 0x40
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
mov qword [r12], rax
mov dword [rax], ebp
mov r8d, ebx
xor edx, edx
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r13, rax
test rax, rax
jne 0x14021a279
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
inc eax
jne 0x14021a2be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp eax, 5
je 0x14021a2b0
lea rdx, [rsp + 0x2c]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14021a2b0
cmp dword [rsp + 0x2c], 0x103
je 0x14021a2b3
xor r12d, r12d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14021a2db
mov rdx, qword [r12]
xor r12d, r12d
mov eax, dword [rdx + 4]
lea ecx, [rax + 1]
mov dword [rdx + 4], ecx
mov qword [rdx + rax*8 + 8], r13
jmp 0x14021a2db
mov r12d, 0xe
add rsp, 0x38
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14021a2f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
xor r11d, r11d
xor eax, eax
mov rbp, rsp
push r15
push r14
mov r14d, edx
push r13
add r14, 1
push r12
shl r14, 4
mov r12, rcx
push rdi
lea r13, [rcx + r14]
sub r14, 0x10
push rsi
lea r8, [rcx + r14]
push rbx
lea rbx, [r13 + r14]
and rsp, 0xfffffffffffffff0
sub rsp, 0x820
lea rsi, [rsp + 0x20]
lea r10, [rsp + 0x420]
mov edx, dword [r12 + 8]
mov ecx, 0x100
mov rdi, rsi
mov r9, r12
rep stosq qword [rdi], rax
mov ecx, r11d
xor edi, edi
shr edx, cl
nop dword [rax]
mov r15d, edx
mov edx, dword [r9 + 8]
mov ecx, r11d
add r9, 0x10
shr edx, cl
movzx ecx, dl
xor r15d, edx
add dword [rsp + rcx*4 + 0x20], 1
movzx ecx, dh
or edi, r15d
mov ecx, ecx
add dword [rsp + rcx*4 + 0x420], 1
cmp r8, r9
jne 0x14021a358
mov rdx, rsi
xor r9d, r9d
xor ecx, ecx
mov r15d, dword [rdx]
mov dword [rdx], ecx
add rdx, 4
add ecx, r15d
mov r15d, dword [rdx + 0x3fc]
mov dword [rdx + 0x3fc], r9d
add r9d, r15d
cmp r10, rdx
jne 0x14021a390
mov r9, r12
nop dword [rax]
mov edx, dword [r9 + 8]
mov ecx, r11d
movdqu xmm0, xmmword [r9]
add r9, 0x10
shr edx, cl
movzx ecx, dl
mov edx, dword [rsp + rcx*4 + 0x20]
lea r15d, [rdx + 1]
shl rdx, 4
mov dword [rsp + rcx*4 + 0x20], r15d
movups xmmword [r13 + rdx], xmm0
cmp r8, r9
jne 0x14021a3b8
cmp edi, 0xff
jbe 0x14021a454
mov r9, r13
nop dword [rax]
mov edx, dword [r9 + 8]
mov ecx, r11d
movdqu xmm1, xmmword [r9]
add r9, 0x10
shr edx, cl
movzx edx, dh
mov edx, edx
add rdx, 0x100
mov ecx, dword [rsp + rdx*4 + 0x20]
lea r15d, [rcx + 1]
shl rcx, 4
mov dword [rsp + rdx*4 + 0x20], r15d
movups xmmword [r12 + rcx], xmm1
cmp rbx, r9
jne 0x14021a3f8
add r11d, 0x10
shr edi, 0x10
jne 0x14021a33b
lea rsp, [rbp - 0x38]
mov eax, 1
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r8, r14
mov rdx, r13
mov rcx, r12
call sub.msvcrt.dll_memcpy
jmp 0x14021a43e
Function at 0x14021a470
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
xor r8d, r8d
xor eax, eax
mov rbp, rsp
push r15
push r14
mov r14d, edx
push r13
shl r14, 2
mov r13, rcx
push r12
lea r12, [rcx + r14]
push rdi
push rsi
push rbx
lea rbx, [r12 + r14]
and rsp, 0xfffffffffffffff0
sub rsp, 0x820
lea rsi, [rsp + 0x20]
lea r11, [rsp + 0x420]
mov edx, dword [r13]
mov ecx, 0x100
mov rdi, rsi
mov r9, r13
rep stosq qword [rdi], rax
mov ecx, r8d
xor edi, edi
not edx
shr edx, cl
nop dword [rax]
mov r10d, edx
mov edx, dword [r9]
mov ecx, r8d
add r9, 4
not edx
shr edx, cl
movzx ecx, dl
xor r10d, edx
add dword [rsp + rcx*4 + 0x20], 1
movzx ecx, dh
or edi, r10d
mov ecx, ecx
add dword [rsp + rcx*4 + 0x420], 1
cmp r12, r9
jne 0x14021a4d0
mov rdx, rsi
xor r9d, r9d
xor ecx, ecx
nop dword [rax]
mov r10d, dword [rdx]
mov dword [rdx], ecx
add rdx, 4
add ecx, r10d
mov r10d, dword [rdx + 0x3fc]
mov dword [rdx + 0x3fc], r9d
add r9d, r10d
cmp r11, rdx
jne 0x14021a510
mov r9, r13
nop dword [rax]
mov r10d, dword [r9]
mov ecx, r8d
add r9, 4
mov edx, r10d
not edx
shr edx, cl
movzx edx, dl
mov ecx, dword [rsp + rdx*4 + 0x20]
lea r15d, [rcx + 1]
mov dword [r12 + rcx*4], r10d
mov dword [rsp + rdx*4 + 0x20], r15d
cmp r12, r9
jne 0x14021a538
cmp edi, 0xff
jbe 0x14021a5c7
mov r9, r12
nop dword [rax]
mov r10d, dword [r9]
mov ecx, r8d
add r9, 4
mov edx, r10d
not edx
shr edx, cl
movzx edx, dh
mov edx, edx
add rdx, 0x100
mov ecx, dword [rsp + rdx*4 + 0x20]
lea r15d, [rcx + 1]
mov dword [r13 + rcx*4], r10d
mov dword [rsp + rdx*4 + 0x20], r15d
cmp rbx, r9
jne 0x14021a570
add r8d, 0x10
shr edi, 0x10
jne 0x14021a4ae
lea rsp, [rbp - 0x38]
mov eax, 1
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r8, r14
mov rdx, r12
mov rcx, r13
call sub.msvcrt.dll_memcpy
jmp 0x14021a5b1

Function at 0x14021a700
Capabilities:
Resume thread

Disassembly:
push r13
push r12
xor r12d, r12d
push rdi
push rsi
mov rsi, rcx
push rbx
xor ebx, ebx
sub rsp, 0x30
cmp dword [rsi + 4], ebx
jbe 0x14021a764
mov eax, ebx
mov r13, qword [rsi + rax*8 + 8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
inc eax
jne 0x14021a757
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
je 0x14021a757
lea rdx, [rsp + 0x2c]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14021a757
cmp dword [rsp + 0x2c], 0x103
cmove r12d, edi
mov rcx, r13
inc ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14021a713
add rsp, 0x30
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x14021a800
Capabilities:
Enumerate threads

Disassembly:
push r14
push r13
push r12
push rbp
mov rbp, rcx
push rdi
push rsi
mov rsi, rdx
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x14021a8ca
mov r14d, dword [rax + 0xc0]
lea rbx, [rax + 0x100]
xor r13d, r13d
shl r14, 5
mov rax, qword [rbp + 0xb0]
add r14, rbx
test rax, rax
je 0x14021a862
mov r13, qword [rax + 0x70]
jmp 0x14021a862
mov eax, dword [rbx + 0x10]
cmp eax, dword [rbp + 0x94]
je 0x14021a869
add rbx, 0x20
cmp rbx, r14
jb 0x14021a853
jmp 0x14021a8a4
mov rax, qword [rbx + 8]
test rax, rax
je 0x14021a85e
mov rax, qword [rbx + 8]
cmp rax, rdi
je 0x14021a85e
mov rax, qword [rbx + 8]
cmp rax, r13
je 0x14021a85e
mov rdx, qword [rbx + 8]
mov rcx, rsi
call fcn.14021a1f0
mov r12d, eax
test eax, eax
je 0x14021a85e
mov rcx, qword [rsi]
call fcn.14021a700
jmp 0x14021a97b
test r13, r13
je 0x14021a8ae
cmp r13, rdi
jne 0x14021a8b6
xor r12d, r12d
jmp 0x14021a97b
mov edx, r13d
mov rcx, rsi
call fcn.14021a1f0
mov r12d, eax
test eax, eax
je 0x14021a8ae
jmp 0x14021a897
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x14021a8f3
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x24]
mov rcx, rax
mov dword [rsp + 0x24], 0x1c
mov rdx, r14
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x14021a947
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, r13
mov r12d, ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi]
call fcn.14021a700
jmp 0x14021a97b
mov edx, dword [rsp + 0x2c]
cmp edi, edx
jne 0x14021a955
mov rdx, r14
mov rcx, r13
call sub.KERNEL32.dll_Thread32Next
mov r12d, eax
test eax, eax
je 0x14021a965
mov eax, dword [rbp + 0x94]
cmp dword [rsp + 0x30], eax
je 0x14021a92d
jmp 0x14021a935
mov rcx, rsi
call fcn.14021a1f0
mov ebx, eax
test eax, eax
je 0x14021a935
jmp 0x14021a917
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x12
jne 0x14021a917
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14021ab10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
xor eax, eax
mov rbp, rsp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbx, rcx
mov ecx, 8
mov rdi, rbx
sub rsp, 0x30
rep stosd dword [rdi], eax
mov eax, 0x57
test rdx, rdx
je 0x14021ad04
mov rsi, r8
mov r8d, 0x7fffffff
mov r12, rdx
mov r13d, r9d
call sub.msvcrt.dll_mbstowcs
mov rdi, rax
lea rax, [rax - 1]
cmp rax, 0x7ffe
jbe 0x14021ab6b
mov eax, 0x7b
jmp 0x14021ad04
lea r8, [rdi + 1]
lea rax, [r8 + r8]
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140035990
sub rsp, rax
mov rdx, r12
lea r14, [rsp + 0x30]
mov rcx, r14
call sub.msvcrt.dll_mbstowcs
cmp rax, rdi
jne 0x14021ab61
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14021abf6
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 2
jne 0x14021ad04
test r13w, r13w
je 0x14021ad04
mov edx, dword [rsi]
bt edx, 0x11
jb 0x14021ad04
bt edx, 0xe
jb 0x14021ac08
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14021ac08
call rdi
cmp eax, 0xb7
jne 0x14021ad04
jmp 0x14021ac08
mov edx, dword [rsi]
or dh, 0x40
test al, 0x10
lea ecx, [rdx - 0x4000]
cmovne edx, ecx
mov dword [rsi], edx
mov rcx, r12
call sub.msvcrt.dll_strlen
mov edi, dword [rsi]
mov qword [rbx + 0x18], rax
bt edi, 0xe
jae 0x14021ac4c
cmp rax, 8
jbe 0x14021ac4c
lea r13, [rax - 9]
mov r8d, 9
lea rcx, str._mdbx.dat
lea rdx, [r12 + r13]
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14021ac4c
sub edi, 0x4000
mov dword [rsi], edi
mov qword [rbx + 0x18], r13
mov esi, dword [rsi]
mov r13, qword [rbx + 0x18]
and esi, 0x4000
lea rdx, [r13 + r13]
cmp esi, 1
sbb rax, rax
and eax, 0xe
lea rcx, [rax + rdx + 6]
call sub.msvcrt.dll_malloc
mov rcx, rax
mov qword [rbx], rax
mov eax, 0xe
test rcx, rcx
je 0x14021ad04
mov qword [rbx + 8], rcx
test esi, esi
je 0x14021acb9
lea rax, [rcx + r13 + 5]
lea r9, str._lck
mov r8, r12
mov qword [rbx + 0x10], rax
lea rdx, [0x1402b054c]
call fcn.14021aae0
mov rcx, qword [rbx + 0x10]
mov rdx, r12
call sub.msvcrt.dll_strcpy
jmp 0x14021ad02
lea rax, [rcx + r13 + 0xa]
mov r8d, r13d
lea r13, [0x1402b0551]
mov r9, r12
mov qword [rbx + 0x10], rax
lea rax, str._mdbx.lck
mov rdx, r13
mov qword [rsp + 0x20], rax
call fcn.14021aae0
mov rcx, qword [rbx + 0x10]
mov r8d, dword [rbx + 0x18]
mov r9, r12
lea rax, str._mdbx.dat
mov rdx, r13
mov qword [rsp + 0x20], rax
call fcn.14021aae0
xor eax, eax
lea rsp, [rbp - 0x30]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
Function at 0x14021ad20
Capabilities:
Set file attributes

Disassembly:
push rbp
mov rbp, rsp
push r15
mov r15, r8
mov r8d, 0x7fffffff
push r14
push r13
push r12
push rdi
mov rdi, rdx
mov rdx, r15
push rsi
mov rsi, r9
push rbx
mov ebx, ecx
xor ecx, ecx
sub rsp, 0x88
mov r12d, dword [rbp + 0x30]
mov qword [r9], 0xffffffffffffffff
call sub.msvcrt.dll_mbstowcs
mov r13, rax
dec rax
cmp rax, 0x7ffe
jbe 0x14021ad75
mov r12d, 0x7b
jmp 0x14021aece
lea r8, [r13 + 1]
lea rax, [r8 + r8]
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140035990
sub rsp, rax
mov rdx, r15
lea r14, [rsp + 0x40]
mov rcx, r14
call sub.msvcrt.dll_mbstowcs
cmp rax, r13
jne 0x14021ad6a
mov edx, dword [rdi + 4]
cmp r12w, 1
sbb eax, eax
and edx, 0x400000
add eax, 4
cmp edx, 1
sbb r8d, r8d
dec ebx
and r8d, 3
cmp ebx, 4
ja case.default.0x14021add8
lea rcx, [0x1402b0558]
movsxd rdx, dword [rcx + rbx*4]
add rdx, rcx
jmp rdx
mov edx, 0xc0000080
mov ebx, 0x1002000
jmp 0x14021ae56
or r8d, 1
mov edx, 0x80000080
mov ebx, 0x1002000
mov eax, 3
jmp 0x14021ae56
mov edx, 0x40000080
mov ebx, 0x81002000
mov eax, 3
jmp 0x14021ae56
mov eax, dword [rdi + 0x88]
xor ebx, ebx
cmp dword [rdi + 0x78], eax
mov edx, 0x40000080
setae bl
mov eax, 1
xor r8d, r8d
shl ebx, 0x1d
or ebx, 0x1002000
jmp 0x14021ae56
or r8d, 4
mov edx, 0x110180
mov ebx, 0x1002000
mov eax, 3
jmp 0x14021ae56
mov edx, 0xc0000080
mov ebx, 0x1002102
mov eax, 4
mov rcx, r14
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x14021ae8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14021aece
lea rdx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x14021aeb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsi]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], 0xffffffffffffffff
jmp 0x14021aece
mov edx, dword [rbp - 0x74]
xor r12d, r12d
xor ebx, edx
and ebx, 0x2902
je 0x14021aece
xor edx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rsp, [rbp - 0x38]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14021aef0
Capabilities:
Get disk information

Disassembly:
push r14
mov r14, rcx
push r13
push r12
push rsi
push rbx
mov ebx, edx
sub rsp, 0x1e0
cmp qword [0x1403e9468], 0
jne 0x14021af1e
bt edx, 0x16
mov r12d, 0x307
jae 0x14021b19e
mov rcx, r14
mov r12d, 0x10fe
call qword [sym.imp.KERNEL32.dll_GetFileType]
dec eax
jne 0x14021b19e
mov rax, qword [0x1403e94a0]
test rax, rax
je 0x14021af85
mov r9d, 0x74
lea r8, [rsp + 0x60]
mov edx, 0xd
mov rcx, r14
call rax
test eax, eax
je 0x14021af85
mov eax, dword [rsp + 0x70]
test al, 2
je 0x14021af6c
bt ebx, 0x11
jae 0x14021b19e
mov edx, ebx
and eax, 1
mov r12d, 0x1100
and edx, 0x400000
or edx, eax
je 0x14021b19e
mov rax, qword [0x1403e9480]
test rax, rax
je 0x14021b017
lea rdx, [rsp + 0x60]
mov rcx, r14
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rsp + 0x48], 0x180
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x90310
call rax
mov ecx, eax
test eax, eax
js 0x14021afee
bt ebx, 0x16
mov r12d, 0x1100
jb 0x14021b017
jmp 0x14021b19e
cmp eax, 0xc000046d
setne dl
cmp eax, 0xc0000010
setne al
test dl, al
je 0x14021b017
cmp ecx, 0xc00000bb
je 0x14021b017
call fcn.14021a640
mov r12d, eax
jmp 0x14021b19e
mov rsi, qword [0x1403e9498]
xor r12d, r12d
test rsi, rsi
je 0x14021b19e
cmp qword [0x1403e9490], 0
je 0x14021b19e
mov ecx, 0xfffe
mov r12d, 0xe
call sub.msvcrt.dll_malloc
mov r13, rax
test rax, rax
je 0x14021b19e
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov rdx, r13
mov rcx, r14
mov dword [rsp + 0x38], 0
mov r8d, 0x7fff
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call rsi
test eax, eax
je 0x14021b0bf
mov esi, ebx
and esi, 0x20000
jne 0x14021b0a3
test dword [rsp + 0x60], 0x188000
jne 0x14021b0f5
mov r9d, 2
mov r8d, 0x7fff
mov rdx, r13
mov rcx, r14
call qword [0x1403e9490]
test eax, eax
jne 0x14021b0cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14021b196
mov r12, qword [sym.imp.msvcrt.dll__wcsnicmp]
mov r8d, 0xc
lea rdx, str.DeviceMup_
mov rcx, r13
call r12
test eax, eax
jne 0x14021b100
bt ebx, 0x16
jb 0x14021b17b
mov r12d, 0x1100
jmp 0x14021b196
xor r9d, r9d
mov r8d, 0x7fff
mov rdx, r13
mov rcx, r14
call qword [0x1403e9490]
test eax, eax
je 0x14021b17b
mov r14, qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, r13
call r14
cmp eax, 1
jne 0x14021b168
mov r8d, 4
lea rdx, [0x1402b0586]
mov rcx, r13
call r12
test eax, eax
jne 0x14021b0eb
lea rcx, [r13 + 0xa]
mov r8d, 2
lea rdx, [0x1402b0590]
call r12
test eax, eax
jne 0x14021b0eb
mov word [r13 + 0xe], 0
lea rcx, [r13 + 8]
call r14
cmp eax, 5
je 0x14021b18d
ja 0x14021b180
sub eax, 2
cmp eax, 1
ja 0x14021b0eb
xor r12d, r12d
jmp 0x14021b196
xor r12d, r12d
cmp eax, 6
je 0x14021b196
jmp 0x14021b0eb
test esi, esi
jne 0x14021b17b
jmp 0x14021b0eb
mov rcx, r13
call sub.msvcrt.dll_free
add rsp, 0x1e0
mov eax, r12d
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
Function at 0x14021b400
Capabilities:
Clear file content

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x30
mov rax, qword [0x1403e9488]
test rax, rax
je 0x14021b43e
mov qword [rsp + 0x28], rdx
lea r8, [rsp + 0x28]
mov r9d, 8
mov edx, 6
call rax
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x14021b469
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14021b469
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14021b45a
add rsp, 0x30
pop r12
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14021b44e
xor eax, eax
add rsp, 0x30
pop r12
ret
Function at 0x14021b980
Capabilities:
Map section object

Disassembly:
push rbp
xorps xmm0, xmm0
mov rbp, rsp
push r14
mov r14, r9
push r13
push r12
push rdi
mov rdi, r8
push rsi
mov esi, ecx
push rbx
mov rbx, rdx
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
mov qword [rdx], 0
mov rcx, qword [rdx + 8]
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x28], 0
movups xmmword [rdx + 0x10], xmm0
mov edx, esi
call fcn.14021aef0
mov r12d, eax
test eax, eax
jne 0x14021bb17
mov r13d, esi
mov rcx, qword [rbx + 8]
and r13d, 0x20000
jne 0x14021ba00
test byte [rbp + 0x30], 1
je 0x14021ba00
mov rdx, rdi
call fcn.14021b400
test eax, eax
jne 0x14021bb14
mov qword [rbx + 0x20], rdi
jmp 0x14021ba11
lea rdx, [rbx + 0x20]
call fcn.14021a690
test eax, eax
jne 0x14021bb14
cmp r13d, 1
mov r8, qword [rbx + 8]
lea rcx, [rbx + 0x28]
mov dword [rsp + 0x28], 0x4000000
sbb eax, eax
and esi, 0x80000
lea r9, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
and eax, 2
mov qword [rsp + 0x30], r8
add eax, 2
cmp esi, 1
sbb edx, edx
mov dword [rsp + 0x20], eax
xor r8d, r8d
and edx, 0xfffffffe
add edx, 0x17
call sub.ntdll.dll_NtCreateSection
mov ecx, eax
test eax, eax
js 0x14021baf9
test r13d, r13d
jne 0x14021ba76
cmp qword [0x1403e9468], 0
cmovne rdi, r14
jmp 0x14021ba78
xor edi, edi
cmp esi, 1
mov qword [rsp + 0x58], rdi
sbb esi, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and esi, 0xfffffffe
mov rcx, qword [rbx + 0x28]
mov r8, rbx
add esi, 4
mov rdx, rax
xor eax, eax
test r13d, r13d
sete al
mov dword [rsp + 0x48], esi
xor r9d, r9d
shl eax, 0xd
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call sub.ntdll.dll_NtMapViewOfSection
mov r13d, eax
test eax, eax
jns 0x14021bb03
mov rcx, qword [rbx + 0x28]
call sub.ntdll.dll_NtClose
mov qword [rbx + 0x28], 0
mov ecx, r13d
mov qword [rbx], 0
call fcn.14021a640
mov r12d, eax
jmp 0x14021bb17
movq xmm0, qword [rsp + 0x58]
movhps xmm0, qword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm0
jmp 0x14021bb17
mov r12d, eax
lea rsp, [rbp - 0x30]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret

Function at 0x14021bc40
Capabilities:
Read file on windows

Disassembly:
push rbx
mov rbx, r8
sub rsp, 0x60
lea rax, [rsp + 0x40]
mov dword [rsp + 0x50], r9d
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14021bc90
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14021bca4
mov eax, 0x1e
jmp 0x14021bca4
mov eax, dword [rsp + 0x3c]
mov edx, 0x26
cmp rax, rbx
mov eax, 0
cmovne eax, edx
add rsp, 0x60
pop rbx
ret
Function at 0x14021bcb0
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
mov r14, rdx
push r13
mov r13, rcx
push r12
push rsi
mov rsi, r9
push rbx
mov rbx, r8
sub rsp, 0x50
mov rax, qword [0x1403e9460]
test rax, rax
jne 0x14021bd25
mov rdx, rcx
lea r8, [rsp + 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov r12d, eax
test eax, eax
jne 0x14021bdb8
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x48]
mov r12d, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14021bdb8
mov qword [rsp + 0x30], r9
mov r9d, 0xffff
mov qword [rsp + 0x28], r8
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call rax
mov r12d, eax
cmp eax, 2
jne 0x14021bdb8
mov qword [rsp + 0x30], rsi
mov r9d, 0x1ffff
mov r8, r14
mov rdx, r13
mov qword [rsp + 0x28], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call qword [0x1403e9460]
mov r12d, eax
cmp eax, 2
jne 0x14021bdb8
mov qword [rsp + 0x30], rsi
mov r9d, 0x2ffff
mov r8, r14
mov rdx, r13
mov qword [rsp + 0x28], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call qword [0x1403e9460]
mov r12d, eax
add rsp, 0x50
mov eax, r12d
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
Function at 0x14021c340
Capabilities:
Print debug messages

Disassembly:
push r13
mov r13, r9
push r12
mov r12, rdx
push rsi
push rbx
mov ebx, r8d
sub rsp, 0x38
mov rax, qword [0x1403e8a00]
mov rsi, qword [rsp + 0x80]
test rax, rax
je 0x14021c373
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
jmp rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14021c440
mov qword [rsp + 0x20], 0
test r12, r12
je 0x14021c3c7
test ebx, ebx
jle 0x14021c3ac
lea rcx, [rsp + 0x20]
mov r9d, ebx
mov r8, r12
lea rdx, str._s:_d
call fcn.14021c310
jmp 0x14021c3df
test r12, r12
je 0x14021c3c7
lea rcx, [rsp + 0x20]
mov r8, r12
lea rdx, [0x1402b05ca]
call fcn.14021c310
jmp 0x14021c3df
test ebx, ebx
jle 0x14021c3fe
lea rcx, [rsp + 0x20]
mov r8d, ebx
lea rdx, str._d:
call fcn.14021c310
test eax, eax
jle 0x14021c3fe
mov r12, qword [rsp + 0x20]
test r12, r12
je 0x14021c3fe
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, r12
call sub.msvcrt.dll_free
lea rcx, [rsp + 0x28]
mov r8, rsi
mov rdx, r13
mov qword [rsp + 0x28], 0
call fcn.14021a030
test eax, eax
jle 0x14021c440
mov r12, qword [rsp + 0x28]
test r12, r12
je 0x14021c440
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x38
mov rcx, r12
pop rbx
pop rsi
pop r12
pop r13
jmp sub.msvcrt.dll_free
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x14021d420
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x48
cmp qword [0x1403e8a00], 0
je 0x14021d443
mov qword [rsp + 0x20], rcx
lea r9, str.assert:__s_n
xor ecx, ecx
call fcn.14021c450
jmp 0x14021d4aa
mov qword [rsp + 0x38], 0
test rdx, rdx
jne 0x14021d458
lea rdx, [0x1402b0d96]
mov dword [rsp + 0x20], r8d
lea r10, [rsp + 0x38]
mov r9, rdx
mov r8, rcx
lea rdx, str._r_nMDBX_ASSERTION:__s___s:_u
mov rcx, r10
call fcn.14021c310
test eax, eax
jle 0x14021d483
cmp qword [rsp + 0x38], 0
jne 0x14021d48f
lea rax, str._troubles_with_assertion_message_preparation_
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14021d4aa
call qword [sym.imp.KERNEL32.dll_DebugBreak]
or ecx, 0xffffffff
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_FatalExit]

Function at 0x14021d4c0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsFree]
test eax, eax
jne 0x14021d4eb
mov r8d, 0x124e
lea rdx, str.thread_key_delete
lea rcx, str.TlsFree_key_
add rsp, 0x28
jmp fcn.14021d420
add rsp, 0x28
ret

Function at 0x14021d720
Capabilities:
Print debug messages

Disassembly:
mov r8d, 0x125f
lea rdx, str.thread_rthc_set
lea rcx, str.TlsSetValue_key___void__value_
jmp fcn.14021d420