joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011d60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [0x1400578d4]
mov rdi, rcx
test eax, eax
jne 0x140011daa
mov r8d, edx
mov rdx, rcx
mov ecx, dword [0x140055bb0]
call fcn.140036050
mov esi, eax
cmp eax, 0xffffffff
je 0x140011f2f
test eax, eax
jne 0x140011eea
jmp 0x140011f2f
cmp eax, 1
jne 0x140011e4c
shr edx, 1
mov ebx, edx
mov r8d, edx
add rbx, rcx
mov ecx, dword [0x140055bb0]
mov rdx, rbx
call fcn.140036050
mov esi, eax
mov ebp, eax
cmp eax, 0xffffffff
je 0x140011f2d
test eax, eax
je 0x140011f2d
mov ecx, dword [0x140055fc0]
cmp ecx, 0xffffffff
jne 0x140011e02
mov edx, esi
mov rcx, rbx
call fcn.140019a20
xor ecx, ecx
test eax, eax
sete cl
mov dword [0x140055fc0], ecx
cmp ecx, 1
je 0x140011e39
nop word [rax + rax]
movzx eax, byte [rbx]
inc rdi
inc rbx
mov byte [rdi - 1], al
cmp al, 0xa
jne 0x140011e2b
mov word [rdi - 1], 0xa0d
inc rdi
inc esi
dec ebp
jne 0x140011e10
mov eax, esi
sub rdi, rax
jmp 0x140011eea
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.140023790
jmp 0x140011eea
lea r8d, [rdx - 1]
mov rbx, rcx
mov rdx, rcx
mov ecx, dword [0x140055bb0]
call fcn.140036050
mov esi, eax
mov ebp, eax
cmp eax, 0xffffffff
je 0x140011f2d
test eax, eax
je 0x140011f2d
mov ecx, dword [0x140055fc0]
cmp ecx, 0xffffffff
jne 0x140011e98
mov edx, esi
mov rcx, rdi
call fcn.140019a20
xor ecx, ecx
test eax, eax
sete cl
mov dword [0x140055fc0], ecx
cmp ecx, 1
je 0x140011eea
mov byte [rsi + rdi], 0xa
movzx eax, byte [rbx]
inc rdi
inc rbx
mov byte [rdi - 1], al
cmp al, 0xd
jne 0x140011ebb
cmp byte [rbx], 0xa
jne 0x140011ebb
dec rdi
dec esi
dec ebp
jne 0x140011ea1
test esi, esi
jne 0x140011edb
mov ecx, dword [0x140055bb0]
mov esi, 1
mov rdx, rdi
mov r8d, esi
call fcn.140036050
jmp 0x140011eea
mov eax, esi
lea ecx, [rsi - 1]
sub rdi, rax
cmp byte [rcx + rdi], 0x1a
cmove esi, ecx
mov ecx, dword [0x140055ba4]
mov r8d, esi
mov rdx, rdi
mov ebx, esi
call fcn.14001a940
mov rcx, qword [0x140055ba8]
mov dword [0x140055ba4], eax
mov rax, rcx
add rcx, rbx
mov qword [0x140055ba8], rcx
cmp rcx, rax
jge 0x140011f2d
lea rdx, str.overflow_in_byte_count
mov ecx, 6
call fcn.140001310
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140013110
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov r12, rcx
mov rsi, rcx
xor edi, edi
mov qword [0x1400a5320], rcx
call fcn.1400262d4
mov rcx, rsi
movsxd rdx, eax
call fcn.140025e98
movsxd rbp, eax
mov rax, qword [0x1400a5320]
movzx ebx, byte [rax]
add rbp, rsi
test ebx, ebx
je 0x1400132db
mov qword [rsp + 0x40], r13
lea r13, [0x1400a5340]
cmp ebx, 0x20
je 0x1400132a3
cmp ebx, 0x3a
je 0x1400132a3
cmp ebx, 0x22
je 0x1400132a3
cmp ebx, 0x2a
je 0x1400132a3
cmp ebx, 0x2b
je 0x1400132a3
cmp ebx, 0x2c
je 0x1400132a3
cmp ebx, 0x3b
je 0x1400132a3
cmp ebx, 0x3c
je 0x1400132a3
cmp ebx, 0x3d
je 0x1400132a3
cmp ebx, 0x3e
je 0x1400132a3
cmp ebx, 0x3f
je 0x1400132a3
cmp ebx, 0x5b
je 0x1400132a3
cmp ebx, 0x5d
je 0x1400132a3
cmp ebx, 0x7c
je 0x1400132a3
cmp ebx, 0x2f
jne 0x140013215
mov qword [0x1400a5320], rsi
call fcn.1400262d4
mov rcx, rsi
movsxd rdx, eax
call fcn.140025e98
movsxd rcx, eax
mov rax, qword [0x1400a5320]
add rsi, rcx
mov byte [rax], bl
xor edi, edi
jmp 0x1400132a3
cmp ebx, 0x2e
jne 0x140013259
test edi, edi
je 0x1400132a3
cmp edi, 9
jge 0x140013252
mov qword [0x1400a5320], rsi
call fcn.1400262d4
mov rcx, rsi
movsxd rdx, eax
call fcn.140025e98
lea edi, [rbx - 0x25]
movsxd rcx, eax
mov rax, qword [0x1400a5320]
mov byte [rax], bl
add rsi, rcx
jmp 0x1400132a3
mov edi, 0xc
jmp 0x1400132a3
cmp edi, 0xc
jge 0x1400132a3
cmp edi, 8
je 0x1400132a3
call fcn.1400262d4
mov rcx, rbp
movsxd rdx, eax
call fcn.140025e98
mov qword [0x1400a5320], rsi
add edi, eax
call fcn.1400262d4
mov rcx, rsi
movsxd rdx, eax
call fcn.140025e98
movsxd rcx, eax
mov rax, qword [0x1400a5320]
add rsi, rcx
movzx ecx, bl
movzx edx, byte [rcx + r13]
mov byte [rax], dl
mov qword [0x1400a5320], rbp
call fcn.1400262d4
mov rcx, rbp
movsxd rdx, eax
call fcn.140025e98
movsxd rcx, eax
mov rax, qword [0x1400a5320]
movzx ebx, byte [rax]
add rbp, rcx
test ebx, ebx
jne 0x140013165
mov r13, qword [rsp + 0x40]
mov byte [rsi], bl
jmp 0x1400132df
mov byte [r12], dil
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rax, r12
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x140013300
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
movzx eax, byte [rcx]
xor r12d, r12d
mov rbp, rcx
mov rdi, rcx
mov rsi, rcx
mov ebx, r12d
test ax, ax
je 0x14001340e
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r14
lea r14d, [r12 + 0x2e]
lea r13d, [r12 + 0x2f]
add rsi, 2
cmp ax, 0x20
je 0x1400133f8
cmp ax, 0x3a
je 0x1400133f8
cmp ax, 0x22
je 0x1400133f8
cmp ax, 0x2a
je 0x1400133f8
cmp ax, 0x2b
je 0x1400133f8
cmp ax, 0x2c
je 0x1400133f8
cmp ax, 0x3b
je 0x1400133f8
cmp ax, 0x3c
je 0x1400133f8
cmp ax, 0x3d
je 0x1400133f8
cmp ax, 0x3e
je 0x1400133f8
cmp ax, 0x3f
je 0x1400133f8
cmp ax, 0x5b
je 0x1400133f8
cmp ax, 0x5d
je 0x1400133f8
cmp ax, 0x7c
je 0x1400133f8
cmp ax, r13w
jne 0x1400133bc
mov word [rdi], r13w
mov ebx, r12d
jmp 0x1400133f4
cmp ax, r14w
jne 0x1400133dd
test ebx, ebx
je 0x1400133f8
cmp ebx, 9
jge 0x1400133d6
mov word [rdi], r14w
mov ebx, 9
jmp 0x1400133f4
mov ebx, 0xc
jmp 0x1400133f8
cmp ebx, 0xc
jge 0x1400133f8
cmp ebx, 8
je 0x1400133f8
movzx ecx, ax
inc ebx
call fcn.1400288a0
mov word [rdi], ax
add rdi, 2
movzx eax, byte [rsi]
test ax, ax
jne 0x140013341
mov r14, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rax, rbp
mov rbp, qword [rsp + 0x58]
mov word [rdi], r12w
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret

Function at 0x140013950
Capabilities:
Check if file exists

Disassembly:
jmp 0x14003d1e4
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x14003d214
call fcn.140021ab8
and dword [rax], ebx
call fcn.140021a98
mov dword [rax], 0x16
call fcn.14002a864
or eax, 0xffffffff
jmp 0x14003d24c
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14003d22e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140021ad8
jmp 0x14003d20f
test dil, dil
jns 0x14003d238
and eax, 0xfffffffe
jmp 0x14003d23b
or eax, 1
mov edx, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x14003d21f
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140013a40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, rcx
mov ecx, 0x4000
mov rdi, r8
mov r13, rdx
call fcn.140022488
mov rbp, rax
test rax, rax
jne 0x140013a7b
lea eax, [rbp + 4]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov qword [rsp + 0x48], rsi
cmp rdi, 0xffffffffffffffff
je 0x140013aab
cmp rbx, rdi
jae 0x140013b23
mov r8d, 0x4000
mov rax, rdi
sub rax, rbx
cmp rax, r8
cmovb r8, rax
jmp 0x140013ab1
mov r8d, 0x4000
mov r9, r12
mov edx, 1
mov rcx, rbp
call fcn.140026874
mov rsi, rax
test rax, rax
je 0x140013b08
mov r9, r13
mov r8, rax
mov edx, 1
mov rcx, rbp
call fcn.140023e4c
cmp rax, rsi
jne 0x140013ae6
add rbx, rsi
jmp 0x140013a87
mov rcx, rbp
call fcn.140021628
mov rcx, qword [0x1400a3dd0]
lea rdx, str._fcopy:_write_error_n
call fcn.140021b20
mov eax, 0xa
jmp 0x140013b2d
mov rcx, r12
call fcn.140024038
test eax, eax
je 0x140013b23
mov rcx, rbp
call fcn.140021628
mov eax, 0xb
jmp 0x140013b2d
mov rcx, rbp
call fcn.140021628
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x14001a630
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
mov r12, rcx
mov rcx, r8
mov rdi, r9
mov rbp, rdx
call fcn.140022318
mov rbx, rax
test rax, rax
je 0x14001a677
movzx ecx, byte [rax]
call fcn.140024528
test eax, eax
je 0x14001a672
movzx ecx, byte [rbx + 1]
inc rbx
call fcn.140024528
test eax, eax
jne 0x14001a662
cmp byte [rbx], 0
jne 0x14001a6b9
mov rcx, rdi
call fcn.140022318
mov rbx, rax
test rax, rax
je 0x14001a888
movzx ecx, byte [rax]
call fcn.140024528
test eax, eax
je 0x14001a6b0
nop word [rax + rax]
movzx ecx, byte [rbx + 1]
inc rbx
call fcn.140024528
test eax, eax
jne 0x14001a6a0
cmp byte [rbx], 0
je 0x14001a888
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r14
call fcn.140019920
or rcx, 0xffffffffffffffff
mov r13d, eax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
call fcn.140022488
mov rdi, rax
test rax, rax
jne 0x14001a6fd
lea rdx, str.Cant_get_memory_for_arguments
lea ecx, [rax + 4]
call fcn.140001310
mov rcx, rdi
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rcx + rbx - 1], al
test al, al
jne 0x14001a710
mov eax, dword [r12]
lea eax, [rax + r13 + 1]
movsxd rcx, eax
shl rcx, 3
call fcn.140022488
mov rsi, rax
test rax, rax
jne 0x14001a752
mov rcx, rdi
call fcn.140021628
lea rdx, str.Cant_get_memory_for_arguments
lea ecx, [rsi + 4]
call fcn.140001310
mov rcx, qword [rbp]
mov r14, rsi
add rsi, 8
mov rdx, qword [rcx]
mov qword [rsi - 8], rdx
add qword [rbp], 8
nop dword [rax]
cmp byte [rdi], 0x22
jne 0x14001a7ab
inc rdi
add rsi, 8
mov qword [rsi - 8], rdi
movsx eax, byte [rdi]
test eax, eax
je 0x14001a7f5
cmp eax, 0x22
je 0x14001a7ef
call fcn.1400262d4
mov rcx, rdi
movsxd rdx, eax
call fcn.140025e98
movsxd rcx, eax
add rdi, rcx
movsx eax, byte [rdi]
test eax, eax
jne 0x14001a787
jmp 0x14001a7f5
mov qword [rsi], rdi
movsx ebx, byte [rdi]
add rsi, 8
test ebx, ebx
je 0x14001a7f5
nop dword [rax]
movzx ecx, bl
call fcn.140024528
test eax, eax
jne 0x14001a7eb
call fcn.1400262d4
mov rcx, rdi
movsxd rdx, eax
call fcn.140025e98
movsxd rcx, eax
add rdi, rcx
movsx ebx, byte [rdi]
test ebx, ebx
jne 0x14001a7c0
jmp 0x14001a7f5
test ebx, ebx
je 0x14001a7f5
mov byte [rdi], 0
inc rdi
movsx ebx, byte [rdi]
test ebx, ebx
je 0x14001a833
nop dword [rax]
movzx ecx, bl
call fcn.140024528
test eax, eax
je 0x14001a82b
call fcn.1400262d4
mov rcx, rdi
movsxd rdx, eax
call fcn.140025e98
movsxd rcx, eax
add rdi, rcx
movsx ebx, byte [rdi]
test ebx, ebx
jne 0x14001a800
jmp 0x14001a833
test ebx, ebx
jne 0x14001a770
mov eax, dword [r12]
add r13d, eax
dec eax
mov dword [r12], eax
je 0x14001a86a
nop word [rax + rax]
mov rax, qword [rbp]
add rsi, 8
mov rcx, qword [rax]
mov qword [rsi - 8], rcx
add qword [rbp], 8
dec dword [r12]
jne 0x14001a850
mov qword [rsi], 0
mov rsi, qword [rsp + 0x40]
mov qword [rbp], r14
mov r14, qword [rsp + 0x50]
mov dword [r12], r13d
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
Function at 0x14001a940
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11, r8
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x14001a959
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x14004a570]
test r8, r8
je 0x14001a995
nop dword [rax]
test r10b, 3
je 0x14001a995
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec r11
jne 0x14001a970
mov qword [rsp + 0x10], rbx
cmp r11, 0x10
jb 0x14001aab4
mov rbx, r11
shr rbx, 4
mov rax, rbx
imul rax, rax, 0xfffffffffffffff0
add r11, rax
nop word [rax + rax]
xor r9d, dword [r10]
add r10, 0x10
movzx ecx, r9b
shr r9d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r9d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
xor r8d, dword [r10 - 0xc]
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
xor r8d, dword [r10 - 8]
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
xor r8d, dword [r10 - 4]
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r9d, dword [rdi + rcx*4]
xor r9d, edx
dec rbx
jne 0x14001a9c0
cmp r11, 4
jb 0x14001ab12
mov rbx, r11
shr rbx, 2
mov rax, rbx
imul rax, rax, 0xfffffffffffffffc
add r11, rax
nop dword [rax + rax]
xor r9d, dword [r10]
add r10, 4
movzx ecx, r9b
shr r9d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r9d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r9d, dword [rdi + rcx*4]
xor r9d, edx
dec rbx
jne 0x14001aad0
mov rbx, qword [rsp + 0x10]
test r11, r11
je 0x14001ab3f
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec r11
jne 0x14001ab20
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret
Function at 0x14001cf80
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rdx, rcx
lea rcx, [rsp + 0x58]
mov r8d, 3
call fcn.140026430
movzx ecx, byte [rsp + 0x58]
call fcn.1400243a0
test eax, eax
je 0x14001cfcc
cmp byte [rsp + 0x59], 0x3a
jne 0x14001cfcc
movzx eax, byte [rbx]
lea rcx, [0x1400a5340]
mov word [rsp + 0x5a], 0x5c
movzx ecx, byte [rax + rcx]
mov byte [rsp + 0x58], cl
jmp 0x14001cfd5
mov cl, 0x5c
mov word [rsp + 0x58], 0x5c
cmp byte [0x140072a56], cl
jne 0x14001cfe9
mov eax, dword [0x140072a58]
add rsp, 0x40
pop rbx
ret
xor ebx, ebx
lea rax, [rsp + 0x68]
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x14001d03a
mov rcx, qword [0x1400a3dd0]
lea rdx, str.zip_diagnostic:_GetVolumeInformation_failed_n
call fcn.140021b20
xor eax, eax
add rsp, 0x40
pop rbx
ret
cmp dword [rsp + 0x60], 0xc
movzx ecx, byte [rsp + 0x58]
setbe bl
mov byte [0x140072a56], cl
mov dword [0x140072a58], ebx
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x14001d060
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400546f0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov rdx, rcx
lea rcx, [rsp + 0x48]
mov r8d, 3
call fcn.1400296d4
movzx ecx, word [rsp + 0x48]
mov edx, 0x103
call fcn.14002966c
test eax, eax
je 0x14001d0c1
cmp word [rsp + 0x4a], 0x3a
jne 0x14001d0c1
movzx ecx, word [rbx]
call fcn.1400288a0
mov dword [rsp + 0x4c], 0x5c
movzx r11d, ax
mov word [rsp + 0x48], ax
jmp 0x14001d0cd
mov eax, 0x5c
mov r11d, eax
mov dword [rsp + 0x48], eax
xor ebx, ebx
cmp word [0x140072a5c], r11w
jne 0x14001d0f2
mov eax, dword [0x140072a60]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400235a0
add rsp, 0x60
pop rbx
ret
mov dword [rsp + 0x38], ebx
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rcx, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x14001d14e
mov rcx, qword [0x1400a3dd0]
lea rdx, str.zip_diagnostic:_GetVolumeInformation_failed_n
call fcn.140021b20
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400235a0
add rsp, 0x60
pop rbx
ret
cmp dword [rsp + 0x40], 0xc
movzx ecx, word [rsp + 0x48]
setbe bl
mov word [0x140072a5c], cx
mov dword [0x140072a60], ebx
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400235a0
add rsp, 0x60
pop rbx
ret

Function at 0x14001d180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14001d1ae
lea rcx, str.reading_file_attributes_failed:
mov rdx, rbx
call fcn.140001860
mov eax, 0x20
add rsp, 0x20
pop rbx
ret
and eax, 0x37
add rsp, 0x20
pop rbx
ret
Function at 0x14001d1c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001d201
mov rcx, rbx
call fcn.140014d10
lea rcx, str.reading_file_attributes_failed:
mov rdx, rax
mov rbx, rax
call fcn.140001860
mov rcx, rbx
call fcn.140021628
mov eax, 0x20
add rsp, 0x20
pop rbx
ret
and eax, 0x37
add rsp, 0x20
pop rbx
ret

Function at 0x14001d210
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001d23f
mov rcx, qword [0x1400a3dd0]
lea rdx, str.zip_diagnostic:_GetFileAttributes_failed_n
call fcn.140021b20
xor eax, eax
add rsp, 0x20
pop rbx
ret
and eax, 0xffffffdf
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14001d278
mov rcx, qword [0x1400a3dd0]
lea rdx, str.zip_diagnostic:_SetFileAttributes_failed_n
call fcn.140021b20
lea rcx, str.SetFileAttributes
call fcn.1400232a0
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x14001d290
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14001d2bf
mov rcx, qword [0x1400a3dd0]
lea rdx, str.zip_diagnostic:_GetFileAttributes_failed_n
call fcn.140021b20
xor eax, eax
add rsp, 0x20
pop rbx
ret
and eax, 0xffffffdf
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x14001d2f8
mov rcx, qword [0x1400a3dd0]
lea rdx, str.zip_diagnostic:_SetFileAttributes_failed_n
call fcn.140021b20
lea rcx, str.SetFileAttributes
call fcn.1400232a0
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x14001d310
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x1400546f0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
movzx ecx, byte [rcx]
call fcn.1400243a0
test eax, eax
je 0x14001d340
cmp byte [rbx + 1], 0x3a
je 0x14001d363
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x170]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea rbx, [rsp + 0x170]
lea rcx, [rsp + 0x40]
mov r8d, 3
mov rdx, rbx
mov qword [rsp + 0x48], rbx
call fcn.140026430
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x170]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov r8d, 0x104
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x43], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rcx, [rsp + 0x60]
call fcn.14003d63c
lea rdx, [0x14004ad7c]
mov r8d, 3
mov rcx, rax
call fcn.1400288c0
test eax, eax
je 0x14001d421
lea rdx, [0x14004ad74]
lea rcx, [rsp + 0x60]
mov r8d, 4
call fcn.1400288c0
test eax, eax
je 0x14001d421
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
mov r8d, 4
call fcn.1400288c0
test eax, eax
je 0x14001d421
xor eax, eax
jmp 0x14001d426
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400235a0
add rsp, 0x290
pop rbx
ret

Function at 0x14001d440
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x490
mov rax, qword [0x1400546f0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rbx, rcx
movzx ecx, word [rcx]
mov edx, 0x103
call fcn.14002966c
test eax, eax
je 0x14001d476
cmp word [rbx + 2], 0x3a
je 0x14001d499
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x270]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rbx, [rsp + 0x270]
lea rcx, [rsp + 0x58]
mov r8d, 3
mov rdx, rbx
mov qword [rsp + 0x40], rbx
call fcn.1400296d4
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x4c]
lea rdx, [rsp + 0x270]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor ebx, ebx
mov r8d, 0x104
mov qword [rsp + 0x20], rax
mov word [rsp + 0x5e], bx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea rcx, [rsp + 0x60]
call fcn.140029980
lea r8d, [rbx + 3]
lea rdx, [0x14004ada0]
mov rcx, rax
call fcn.14002971c
test eax, eax
je 0x14001d551
lea r8d, [rbx + 4]
lea rdx, str.VFAT
lea rcx, [rsp + 0x60]
call fcn.14002971c
test eax, eax
je 0x14001d551
lea r8d, [rbx + 4]
lea rdx, [0x14004ad80]
lea rcx, [rsp + 0x60]
call fcn.14002971c
test eax, eax
mov eax, ebx
jne 0x14001d556
mov eax, 1
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400235a0
add rsp, 0x490
pop rbx
ret
Function at 0x14001d670
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov edx, 1
xor ebp, ebp
mov rdi, r9
mov esi, ecx
mov dword [r8], 0x28
mov r8d, edx
xor r9d, r9d
mov ecx, 0x7bc
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call fcn.140013790
mov ecx, eax
mov dword [rbx], eax
call fcn.140013870
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov qword [rdi], rax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], 0x5c3a78
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x60]
test esi, esi
lea r8d, [rbp + 0xd]
lea rdx, [0x140072a48]
cmove rcx, rbp
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x60], sil
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x14001d717
lea rax, [0x140072a48]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret