joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d5560
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, edx
mov r14, r8
and eax, 0x3000
mov esi, edx
mov rdi, rcx
cmp eax, 0x3000
je 0x1400d5641
test eax, eax
je 0x1400d5597
test dl, 0x92
je 0x1400d5641
cmp qword [rcx + 0x18], 8
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
jb 0x1400d55ab
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebp, ebp
mov ebx, eax
test eax, eax
jne 0x1400d55c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400d55c3
mov eax, ebp
lea r9, str.boost::filesystem::permissions
mov r8, r14
mov rdx, rdi
mov ecx, eax
call fcn.1400d4df0
test al, al
jne 0x1400d5637
bt esi, 0xc
jae 0x1400d55e6
and ebx, 0xfffffffe
jmp 0x1400d5600
bt esi, 0xd
jae 0x1400d55f1
or ebx, 1
jmp 0x1400d5600
mov eax, ebx
or ebx, 1
and eax, 0xfffffffe
test sil, 0x92
cmovne ebx, eax
cmp qword [rdi + 0x18], 8
jb 0x1400d560c
mov rcx, qword [rdi]
jmp 0x1400d560f
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1400d5623
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea r9, str.boost::filesystem::permissions
mov r8, r14
mov rdx, rdi
mov ecx, ebp
call fcn.1400d4df0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400d57b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rsi, rdx
mov rdi, rcx
jb 0x1400d57cf
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400d57fe
mov r8, rsi
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1400d5660
mov eax, dword [rax]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x1400d5812
mov dword [rsi], 0
call fcn.1400d2cb0
mov qword [rsi + 8], rax
bt ebx, 0xa
jae 0x1400d5859
mov rcx, rdi
call fcn.1400d5000
test al, al
je 0x1400d5844
and bl, 0x10
mov eax, 4
mov ecx, 0xb
cmovne eax, ecx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, 9
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x40]
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d5de0
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
cmp edx, 1
jne 0x1400d5e15
test r8, r8
je 0x1400d5e08
xor eax, eax
mov dword [r8], eax
call fcn.1400d2cb0
mov qword [rdi + 8], rax
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rdx - 3]
test eax, 0xfffffff7
je 0x1400d5e8e
cmp qword [rcx + 0x18], 8
jb 0x1400d5e29
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400d5e67
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
je 0x1400d5e67
cmp eax, 0x57
je 0x1400d5e67
cmp eax, 0x35
ja 0x1400d5e58
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x1400d5e67
cmp eax, 0xa1
je 0x1400d5e67
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400d5e69
xor eax, eax
lea r9, str.boost::filesystem::remove
mov r8, rdi
mov rdx, rbx
mov ecx, eax
call fcn.1400d4df0
test al, al
je 0x1400d5ef4
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp qword [rcx + 0x18], 8
jb 0x1400d5e98
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400d5ed6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
je 0x1400d5ed6
cmp eax, 0x57
je 0x1400d5ed6
cmp eax, 0x35
ja 0x1400d5ec7
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x1400d5ed6
cmp eax, 0xa1
je 0x1400d5ed6
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400d5ed8
xor eax, eax
lea r9, str.boost::filesystem::remove
mov r8, rdi
mov rdx, rbx
mov ecx, eax
call fcn.1400d4df0
test al, al
jne 0x1400d5e08
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d5ff0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x140375828]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
cmp qword [rdx + 0x18], 8
jb 0x1400d6034
mov rcx, qword [rdx]
jmp 0x1400d6037
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x1400d6057
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.1400d5660
jmp 0x1400d61a9
xor r15d, r15d
bt eax, 0xa
jae 0x1400d6165
cmp qword [rdi + 0x18], 8
jb 0x1400d6070
mov rdx, qword [rdi]
jmp 0x1400d6073
mov rdx, rdi
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp word [rdx], r15w
jne 0x1400d6092
mov r8, r15
jmp 0x1400d60a0
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r15w
jne 0x1400d6096
lea rcx, [rsp + 0x50]
call fcn.140026520
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x1400d6105
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.1400271e0
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp rbx, 0xffffffffffffffff
jne 0x1400d6130
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.1400d5660
nop
jmp 0x1400d61a9
mov rcx, rdi
call fcn.1400d5000
test al, al
jne 0x1400d615b
mov edx, ebp
mov rcx, rdi
call fcn.1400d5200
mov dword [rsi], 9
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1400d61a9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x1400d6176
mov dword [r14], r15d
call fcn.1400d2cb0
mov qword [r14 + 8], rax
mov edx, ebp
mov rcx, rdi
test bpl, 0x10
mov dword [rsp + 0x40], 3
jne 0x1400d6191
mov dword [rsp + 0x40], 2
call fcn.1400d5200
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], eax
mov eax, dword [rcx]
mov dword [rsi], eax
mov eax, dword [rcx + 4]
mov dword [rsi + 4], eax
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401dd140
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d61d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov r14, r8
mov rdi, rdx
mov rbx, rcx
jb 0x1400d61fa
mov rcx, qword [rdx]
jmp 0x1400d61fd
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1400d621a
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.1400d5660
jmp 0x1400d6288
test r14, r14
je 0x1400d622f
mov dword [r14], 0
call fcn.1400d2cb0
mov qword [r14 + 8], rax
mov rcx, rdi
bt esi, 0xa
jae 0x1400d6258
call fcn.1400d5000
mov dword [rsp + 0x38], 4
mov edx, esi
mov rcx, rdi
test al, al
jne 0x1400d6270
mov dword [rsp + 0x38], 9
jmp 0x1400d6270
mov dword [rsp + 0x38], 3
mov edx, esi
test sil, 0x10
jne 0x1400d6270
mov dword [rsp + 0x38], 2
call fcn.1400d5200
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x3c], eax
mov eax, dword [rcx]
mov dword [rbx], eax
mov eax, dword [rcx + 4]
mov dword [rbx + 4], eax
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400d6670
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140375828]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x11], rcx
xor r14d, r14d
mov dword [rbp - 0x39], r14d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
lea rcx, [rbp - 0x31]
call fcn.14005b590
nop
mov rdi, qword [rbp - 0x31]
mov rdx, qword [rbp - 0x29]
cmp rdi, rdx
sete al
test al, al
jne 0x1400d6742
sub rdx, rdi
sar rdx, 1
mov r8d, edx
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400d6742
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
cmp word [rdi], r14w
jne 0x1400d6712
mov r8d, r14d
jmp 0x1400d672b
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400d6720
mov rdx, rdi
lea rcx, [rbp - 9]
call fcn.140026520
lea rdx, [rbp - 9]
mov ebx, 1
jmp 0x1400d675c
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r14
mov word [rbp + 0x17], r14w
lea rdx, [rbp + 0x17]
mov ebx, 2
mov dword [rbp - 0x39], ebx
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r14
cmp qword [rsi + 0x18], 8
jb 0x1400d6777
mov rax, qword [rsi]
jmp 0x1400d677a
mov rax, rsi
mov word [rax], r14w
mov rcx, rsi
call fcn.14003ef50
nop
or ebx, 4
mov dword [rbp - 0x39], ebx
test bl, 2
je 0x1400d67c3
and ebx, 0xfffffffd
mov dword [rbp - 0x39], ebx
mov r8, qword [rbp + 0x2f]
cmp r8, 8
jb 0x1400d67b2
inc r8
mov rdx, qword [rbp + 0x17]
lea rcx, [rbp + 0x17]
call fcn.1400271e0
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r14
mov word [rbp + 0x17], r14w
test bl, 1
je 0x1400d67f9
and ebx, 0xfffffffe
mov dword [rbp - 0x39], ebx
mov r8, qword [rbp + 0xf]
cmp r8, 8
jb 0x1400d67e8
inc r8
mov rdx, qword [rbp - 9]
lea rcx, [rbp - 9]
call fcn.1400271e0
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
test rdi, rdi
je 0x1400d6815
mov r8, qword [rbp - 0x21]
sub r8, rdi
sar r8, 1
mov rdx, rdi
lea rcx, [rbp - 0x31]
call fcn.1400271e0
nop
mov rax, rsi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1401dd140
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400e0cf0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x30
call fcn.1401ddd50
sub rsp, rax
mov rbx, rdx
mov rsi, rcx
call fcn.1400e0e30
mov rdi, rax
test rax, rax
jne 0x1400e0dc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [0x14031a5b0]
mov dword [rsp + 0x20], 0xaf
mov r8d, eax
lea edx, [rdi + 1]
lea ecx, [rdi + 2]
call fcn.1400e3440
lea rax, [0x14031a5c8]
mov r8, rsi
mov qword [rsp + 0x28], rax
lea r9, [0x14031a5cc]
lea rdx, [0x14031a5d0]
mov qword [rsp + 0x20], rbx
lea ecx, [rdi + 5]
call fcn.1400e2da0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [rax], 2
je 0x1400e0d95
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [rax], 6
je 0x1400e0d95
mov dword [rsp + 0x20], 0xb8
lea r9, [0x14031a5f0]
lea r8d, [rdi + 2]
jmp 0x1400e0daa
mov dword [rsp + 0x20], 0xb6
lea r9, [0x14031a5d8]
mov r8d, 0x80
mov edx, 0x6d
lea ecx, [rdx - 0x4d]
call fcn.1400e3440
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x14031a550]
call fcn.1400df8f0
mov rbx, rax
test rax, rax
jne 0x1400e0df7
mov rcx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov rcx, rbx
call fcn.1400df3a0
mov edx, 0x6a
mov r9, rdi
mov rcx, rbx
lea r8d, [rdx - 0x69]
call fcn.1400df3d0
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f32e0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x1400f3307
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x1400f32f0
movzx eax, r9b
ret

Function at 0x140100f40
Capabilities:
Encode data using base64

Disassembly:
xor r10d, r10d
test r8d, r8d
jle 0x140101033
lea r9, [rdx + 1]
lea r11, [0x140228df0]
cmp r8d, 3
jl 0x140100fbb
movzx eax, byte [r9]
movzx edx, byte [r9 - 1]
shl rdx, 8
or rdx, rax
movzx eax, byte [r9 + 1]
shl rdx, 8
or rdx, rax
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r11]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 1], al
mov rax, rdx
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 2], al
add rcx, 3
and edx, 0x3f
movzx eax, byte [rdx + r11]
mov byte [rcx], al
jmp 0x140101014
movzx edx, byte [r9 - 1]
shl edx, 0x10
cmp r8d, 2
jne 0x140100fd2
movzx eax, byte [r9]
shl eax, 8
or edx, eax
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r11]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 1], al
cmp r8d, 1
jne 0x140100ffe
lea eax, [r8 + 0x3c]
jmp 0x14010100a
shr rdx, 6
and edx, 0x3f
movzx eax, byte [rdx + r11]
mov byte [rcx + 2], al
add rcx, 3
mov byte [rcx], 0x3d
add r10d, 4
add r9, 3
sub r8d, 3
inc rcx
test r8d, r8d
jg 0x140100f57
mov byte [rcx], 0
mov eax, r10d
ret
mov byte [rcx], r10b
mov eax, r10d
ret
Function at 0x14010fed0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov rsi, r8
mov ecx, 0x4000
mov r15, rdx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbp, rax
test rax, rax
jne 0x14010ff0b
lea eax, [rbp + 4]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov qword [rsp + 0x48], rdi
cmp rsi, 0xffffffffffffffff
je 0x14010ff3b
cmp rbx, rsi
jae 0x14010ffb3
mov r8d, 0x4000
mov rax, rsi
sub rax, rbx
cmp rax, r8
cmovb r8, rax
jmp 0x14010ff41
mov r8d, 0x4000
mov r9, r14
mov edx, 1
mov rcx, rbp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov rdi, rax
test rax, rax
je 0x14010ff98
mov r9, r15
mov r8, rax
mov edx, 1
mov rcx, rbp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, rdi
jne 0x14010ff76
add rbx, rdi
jmp 0x14010ff17
mov rcx, rbp
call case.0x1400ca6fe.0
mov rcx, qword [0x140497720]
lea rdx, str._fcopy:_write_error_n
call fcn.140093460
mov eax, 0xa
jmp 0x14010ffbd
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ferror
test eax, eax
je 0x14010ffb3
mov rcx, rbp
call case.0x1400ca6fe.0
mov eax, 0xb
jmp 0x14010ffbd
mov rcx, rbp
call case.0x1400ca6fe.0
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret

Function at 0x1401101b0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140375828]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
lea rdx, [rsp + 0x20]
call fcn.140110600
test eax, eax
jne 0x1401101f9
cmp word [rsp + 0x28], 1
jg 0x140110216
mov rcx, rdi
call fcn.1401de9a4
test eax, eax
jne 0x140110267
mov rdx, rdi
mov rcx, rsi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_rename
test eax, eax
je 0x14011029e
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [rax], 0x12
jne 0x140110267
lea rdx, [0x1402be198]
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov rbp, rax
test rax, rax
jne 0x140110248
mov rcx, qword [0x140497720]
lea rdx, str._replace:_cant_open__s_n
mov r8, rsi
call fcn.140093460
lea eax, [rbp + 0xa]
jmp 0x1401102a0
lea rdx, [0x140214a34]
mov rcx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov r14, rax
mov rcx, rbp
test rax, rax
jne 0x14011026e
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov eax, 0xf
jmp 0x1401102a0
mov r8d, 0xffffffff
mov rdx, rax
call fcn.14010fed0
mov rcx, rbp
mov ebx, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
test eax, eax
jne 0x1401102c2
test ebx, ebx
jne 0x1401102c2
mov rcx, rsi
call fcn.1401de9a4
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401dd140
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.1401de9a4
test ebx, ebx
je 0x1401102dd
mov eax, 0xe
cmp ebx, 0xa
cmove ebx, eax
mov eax, ebx
jmp 0x1401102a0
mov ebx, 0xe
mov eax, ebx
jmp 0x1401102a0
Function at 0x1401103e0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x140375828]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
movzx ecx, byte [rcx]
call sub.api_ms_win_crt_string_l1_1_0.dll_isalpha
test eax, eax
je 0x140110410
cmp byte [rbx + 1], 0x3a
je 0x140110433
lea r9, [rsp + 0x48]
mov edx, 0x104
lea r8, [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea rbx, [rsp + 0x170]
mov r8d, 3
mov qword [rsp + 0x48], rbx
mov rdx, rbx
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strncpy
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov byte [rsp + 0x43], 0
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x170]
lea rax, [rsp + 0x54]
mov r8d, 0x104
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rcx, [rsp + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll__strupr
mov rcx, rax
lea rdx, [0x14025c234]
mov r8d, 3
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
test eax, eax
je 0x1401104f1
mov r8d, 4
lea rdx, str.VFAT
lea rcx, [rsp + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
test eax, eax
je 0x1401104f1
mov r8d, 4
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
test eax, eax
je 0x1401104f1
xor eax, eax
jmp 0x1401104f6
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401dd140
add rsp, 0x290
pop rbx
ret
Function at 0x1401108c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11, r8
mov r10, rdx
test rdx, rdx
jne 0x1401108d6
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
lea rdi, [0x14025c280]
not ecx
test r8, r8
je 0x14011090d
test r10b, 3
je 0x14011090d
movzx edx, byte [r10]
mov eax, ecx
xor rdx, rax
inc r10
shr eax, 8
movzx r8d, dl
mov ecx, dword [rdi + r8*4]
xor ecx, eax
sub r11, 1
jne 0x1401108e8
cmp r11, 0x10
jb 0x140110a29
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 4
imul rax, rbx, 0xfffffffffffffff0
add r11, rax
nop word [rax + rax]
xor ecx, dword [r10]
movzx edx, cl
shr ecx, 8
mov r8d, dword [rdi + rdx*4]
xor r8d, ecx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov r9d, dword [rdi + rcx*4]
xor r9d, r8d
xor r9d, dword [r10 + 4]
movzx ecx, r9b
shr r9d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r9d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
xor r8d, dword [r10 + 8]
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
xor r8d, dword [r10 + 0xc]
add r10, 0x10
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov ecx, dword [rdi + rcx*4]
xor ecx, edx
sub rbx, 1
jne 0x140110930
mov rbx, qword [rsp + 0x10]
cmp r11, 4
jb 0x140110a83
mov r9, r11
shr r9, 2
imul rax, r9, 0xfffffffffffffffc
add r11, rax
nop dword [rax]
xor ecx, dword [r10]
add r10, 4
movzx edx, cl
shr ecx, 8
mov r8d, dword [rdi + rdx*4]
xor r8d, ecx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov ecx, dword [rdi + rcx*4]
xor ecx, r8d
sub r9, 1
jne 0x140110a40
test r11, r11
je 0x140110ab0
nop dword [rax + rax]
movzx edx, byte [r10]
lea r10, [r10 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rdi + r8*4]
xor ecx, eax
sub r11, 1
jne 0x140110a90
mov rdi, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret
Function at 0x140114490
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1401144d3
xor ebx, ebx
jmp 0x140114549
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x80090016
jne 0x140114545
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000048
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140114508
xor ebx, ebx
jmp 0x140114549
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x8009000f
jne 0x140114545
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14011453d
xor ebx, ebx
jmp 0x140114549
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x140114576
mov rcx, qword [rsp + 0x58]
mov r8, rbp
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x140114565
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
je 0x140114580
mov rdx, rdi
mov ecx, ebx
call fcn.1401143a0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret