joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fbc0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov ebp, 0x2000
lea rdi, [0x14003b890]
xor esi, esi
mov r8d, ebp
mov rdx, rdi
mov word [0x14003b890], si
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000fc14
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
cmp byte [0x140043aa5], sil
je 0x14000fcdd
lea rdx, [0x1400323f4]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14000fd2c
lea rdx, str.ERRORLEVEL
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14000fd0e
lea rdx, str.CMDEXTVERSION
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14001d044
lea rdx, str.CMDCMDLINE
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14001d04f
lea rdx, str.DATE
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14000fd3e
lea rdx, str.TIME
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14000fce4
lea rdx, str.RANDOM
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14001d05b
lea rdx, str.HIGHESTNUMANODENUMBER
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14001d069
xor eax, eax
jmp 0x14000fbff
mov r9d, ebp
mov r8, rdi
mov edx, 1
xor ecx, ecx
call fcn.1400124fc
movsxd rcx, eax
add rcx, rcx
cmp rcx, 0x4000
jae 0x14000fd52
mov word [rcx + rdi], si
jmp 0x14000fbfc
mov r9d, dword [0x14004390c]
lea r8, [0x140032858]
mov rdx, rbp
mov rcx, rdi
call fcn.140012978
jmp 0x14000fbfc
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call fcn.14001321c
jmp 0x14000fbfc
mov r9d, ebp
mov r8, rdi
mov edx, 1
xor ecx, ecx
call fcn.140005ec8
jmp 0x14000fcf6
call fcn.1400184b8
int3
mov r9d, 2
jmp 0x14000fd15
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
nop
jmp 0x14000fbff
call qword [sym.imp.msvcrt.dll_rand]
mov r9d, eax
jmp 0x14000fd15
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x38], esi
call qword [sym.imp.api_ms_win_core_systemtopology_l1_1_0.dll_GetNumaHighestNodeNumber]
mov r9d, dword [rsp + 0x38]
jmp 0x14000fd15
Function at 0x140011cf0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14003b0f8]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], cx
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
mov dword [rsp + 0x22], 0x5c003a
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 1
seta bl
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400182e0
add rsp, 0x30
pop rbx
ret
Function at 0x140012a2c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, r9
mov ebx, r8d
mov rsi, rdx
mov r15d, r8d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
cmp byte [0x140056aa4], 0
mov rbp, rax
jne 0x14001e1de
mov r13d, 0x2000
lea r14, [0x140047ba0]
cmp ebx, r13d
ja 0x14001e1fc
test ebx, ebx
je 0x140012ad3
and qword [rsp + 0x38], 0
or r9d, 0xffffffff
and qword [rsp + 0x30], 0
mov r8, rsi
mov ecx, dword [0x14003f8a8]
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
and qword [rsp + 0x20], 0
mov r9, rdi
mov rdx, r14
mov rcx, rbp
lea ebx, [rax - 1]
mov r8d, ebx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x140012afa
cmp dword [rdi], ebx
jne 0x140012afa
mov dword [rdi], r15d
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
ret
xor eax, eax
jmp 0x140012adb
and qword [rsp + 0x20], 0
mov r9, rdi
mov r8d, ebx
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop
jmp 0x140012adb
and qword [rsp + 0x38], 0
mov r9d, 0x1000
and qword [rsp + 0x30], 0
mov r8, rsi
mov ecx, dword [0x14003f8a8]
xor edx, edx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_WideCharToMultiByte]
and qword [rsp + 0x20], 0
lea rdx, [0x140047ba0]
mov r8d, eax
mov r9, rdi
mov rcx, rbp
mov r14d, eax
add rsi, r13
add ebx, 0xffffe000
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x140012afa
cmp dword [rdi], r14d
jne 0x140012afa
jmp 0x140012a71
Function at 0x1400139b8
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov byte [0x140047b50], dil
test rdx, rdx
je 0x1400139e6
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], di
jne 0x1400139d4
neg rax
sbb rax, rax
and rdx, rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, qword [0x14003f898]
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
call fcn.140013a2c
test ebx, ebx
mov qword [0x14003f898], rax
mov rbx, qword [rsp + 0x30]
sete dil
mov eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x140013a2c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
mov edi, ebp
test rax, rax
je 0x140013aae
mov rcx, rax
cmp word [rax], bp
je 0x140013a6b
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140013a5a
cmp word [rcx], bp
jne 0x140013a5a
sub rcx, rbx
add rcx, 2
sar rcx, 1
lea esi, [rcx + rcx]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8d, esi
mov edx, 8
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140013aa5
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140014aa4
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140014ab6
cmp byte [0x140043aac], 0
jne 0x140014abb
add rsp, 0x28
ret
cmp qword [0x140043a90], 0
jne 0x140014ab6
jmp 0x14001ea66
call qword [sym.imp.api_ms_win_core_console_l2_2_0.dll_SetConsoleTitleW]
and dword [0x140043a50], 0
mov byte [0x140043aac], 0
jmp 0x140014ab6
Function at 0x140016008
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x14003b0f8]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
xor r14d, r14d
mov rsi, rcx
test rcx, rcx
je 0x1400161bf
mov r8d, 0x104
mov qword [rbp + 0x148], r14
xor edx, edx
mov qword [rbp + 0x158], r8
lea rcx, [rsp + 0x40]
mov byte [rbp + 0x150], 1
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x150]
lea rcx, [rsp + 0x40]
neg al
sbb rdx, rdx
and edx, 0xfdc6
add rdx, 0x208
call fcn.14000c130
test eax, eax
js 0x1400161c3
mov rax, qword [rbp + 0x148]
lea rbx, [rsp + 0x40]
test rax, rax
mov rcx, rsi
cmovne rbx, rax
call fcn.140011130
mov edx, dword [rbp + 0x158]
lea r9, [rsp + 0x30]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
mov edi, eax
test eax, eax
je 0x140016158
mov rax, qword [rbp + 0x148]
lea rbx, [rsp + 0x40]
test rax, rax
lea r8d, [r14 + 4]
lea rdx, str.._
cmovne rbx, rax
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsncmp]
test eax, eax
je 0x14001f21c
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14001f294
cmp word [rax], r14w
je 0x14001f294
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rcx, [0x140017250]
lea rax, [rbp + 0x160]
mov r8d, 0x1037
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.140016f4c
mov rcx, qword [rsp + 0x38]
movzx edi, al
call fcn.140012b04
test edi, edi
je 0x14001619a
mov rcx, qword [rbp + 0x148]
mov qword [rbp + 0x148], r14
test rcx, rcx
je 0x140016171
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov eax, edi
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1400182e0
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
cmp word [rbx + 2], 0x5c
je 0x14001f278
cmp word [rbx + 2], 0x3a
jne 0x140016158
cmp word [rbx + 4], 0x5c
jne 0x140016158
cmp word [rbx + 6], r14w
jne 0x140016158
jmp 0x14001f278
xor eax, eax
jmp 0x140016173
mov edi, r14d
jmp 0x140016158
add rbx, 8
mov rcx, rsi
mov rdx, rbx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.msvcrt.dll_wcsstr]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001f25f
cmp rax, rsi
jbe 0x14001f25f
movzx ebx, word [rax]
mov rcx, rsi
mov word [rax], r14w
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
mov rax, qword [rsp + 0x30]
cmp edi, 0xffffffff
mov word [rax], bx
jmp 0x14001f26d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140016158
jmp 0x1400161c3
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140016158
mov edi, 1
jmp 0x140016158
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov edi, r14d
setne dil
jmp 0x140016158
Function at 0x140016dc0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
xor edi, edi
mov rsi, rcx
bt edx, 0xa
jb 0x140016ead
or qword [rbp + 0x77], 0xffffffffffffffff
lea r9, [rbp - 9]
xor r8d, r8d
lea rdx, [rbp - 0x29]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U_WithStatus]
test eax, eax
js 0x140016ead
cmp word [rbp - 9], di
ja 0x14001f80c
mov eax, edi
lea rcx, [rbp - 0x29]
mov qword [rbp + 7], rax
mov qword [rbp + 0x27], rcx
lea r9, [rbp - 0x19]
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x5040
lea rcx, [rbp + 0x77]
mov dword [rbp + 0x17], 0x30
lea r8, [rbp + 0x17]
mov qword [rbp + 0x1f], rax
mov edx, 0x10000
mov dword [rbp + 0x2f], 0x40
movdqu xmmword [rbp + 0x37], xmm0
mov dword [rsp + 0x20], 4
call qword [sym.imp.ntdll.dll_NtOpenFile]
lea rcx, [rbp - 9]
mov ebx, eax
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test ebx, ebx
js 0x140016ead
mov rcx, qword [rbp + 0x77]
call fcn.140016ecc
mov ebx, 1
test eax, eax
jne 0x14001f819
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test ebx, ebx
je 0x140016ead
mov rbx, qword [rsp + 0xc0]
mov eax, edi
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
test eax, eax
jne 0x140016e98
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x140016e98
mov rax, qword [rbp + 7]
lea rcx, [rbp - 9]
jmp 0x140016e15
mov rcx, qword [rbp + 0x77]
lea r8, [rbp + 0x6f]
mov r9d, ebx
mov byte [rbp + 0x6f], bl
lea rdx, [rbp - 0x19]
mov dword [rsp + 0x20], 0xd
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
mov ebx, edi
setns bl
jmp 0x140016e8a
Function at 0x140016f4c
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
push r15
sub rsp, 0x30
mov rax, rdx
mov dword [rsp + 0x28], 2
xor edx, edx
mov ebp, r8d
mov r8, qword [rsp + 0x60]
mov r14, rcx
xor bl, bl
mov rcx, rax
test r9d, r9d
sete dl
and qword [r11 - 0x18], 0
xor r9d, r9d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileExW]
mov rdi, qword [rsp + 0x68]
or r15, 0xffffffffffffffff
mov qword [rdi], rax
cmp rax, r15
jne 0x140016fd0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x140043b28], eax
mov al, bl
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
mov rcx, qword [rsp + 0x60]
mov edx, ebp
mov rax, r14
call qword [0x140031e48]
test eax, eax
je 0x140017058
and dword [0x140043b28], 0
mov bl, 1
mov rax, qword [rdi]
cmp rax, r15
je 0x140017028
mov r8, qword [0x140043b40]
test r8, r8
je 0x140017031
mov edx, dword [0x140043b48]
cmp edx, dword [0x140043b4c]
jge 0x140017078
test r8, r8
je 0x140017026
mov rax, qword [rdi]
movsxd rcx, edx
inc edx
mov dword [0x140043b48], edx
mov qword [r8 + rcx*8], rax
mov bl, 1
test bl, bl
jne 0x140016fb3
jmp 0x140016fa7
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x28]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov r8, rax
mov edx, dword [0x140043b48]
mov qword [0x140043b40], rax
jmp 0x14001700f
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
je 0x1400170b1
cmp qword [rdi], r15
jne 0x140016fd0
jmp 0x140016fa7
lea eax, [rdx + 1]
movsxd rbx, eax
shl rbx, 3
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
mov r8, qword [0x140043b40]
mov r9, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapReAlloc]
mov r8, rax
test rax, rax
je 0x140023c6e
inc dword [0x140043b4c]
jmp 0x140017049
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
mov rax, r15
mov qword [rdi], r15
jmp 0x140016ff0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rcx, qword [rdi]
mov dword [0x140043b28], eax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
xor al, al
mov qword [rdi], r15
jmp 0x140016fb5
Function at 0x140017690
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x14003b0f8]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r12d, r12d
lea rdx, [rsp + 0x20]
mov r15d, r12d
mov ebp, r12d
mov r13, rcx
call fcn.14001784c
test eax, eax
js 0x140023ee2
mov eax, dword [rsp + 0x20]
cmp eax, 3
jae 0x140023f42
test eax, eax
jne 0x140023ef2
lea r15d, [rax + 1]
mov ecx, 0x40002748
mov esi, r15d
call fcn.1400177f0
mov rbp, rax
test rax, rax
je 0x140023f32
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], r12w
jne 0x140017715
mov r14d, 0x104
cmp rdi, r14
jae 0x140017799
mov ecx, 0x208
call fcn.14000c480
mov rbx, rax
test rax, rax
je 0x140017799
mov r8, rbp
mov edx, r14d
mov rcx, rax
call fcn.1400106e0
test r13, r13
je 0x140023f4a
mov r8, qword [r13 + 0x78]
test r8, r8
je 0x1400177e2
mov edx, r14d
mov rcx, rbx
call fcn.140010600
test eax, eax
jne 0x14001778c
test rbx, rbx
je 0x140017784
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_console_l2_2_0.dll_SetConsoleTitleW]
mov byte [0x140043aac], r12b
mov esi, r12d
test r15d, r15d
je 0x140017799
test rbx, rbx
je 0x140017799
mov rcx, rbx
call fcn.14000f5b0
test rbp, rbp
je 0x1400177a7
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
test esi, esi
jne 0x140023f32
mov eax, esi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400182e0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov esi, r12d
jmp 0x14001778c
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
test r13, r13
je 0x140023fad
mov rcx, qword [r13 + 0x78]
call fcn.14000fd60
mov rbx, rax
test rax, rax
je 0x140017784
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], r12w
jne 0x140023f14
mov r14d, 0x104
cmp rdi, r14
jb 0x14001776f
mov esi, 1
xor edx, edx
lea ecx, [rdx + 8]
call fcn.140015118
nop
jmp 0x1400177af
add eax, 0xfffffff0
jmp 0x1400176ec
mov edx, r14d
lea rcx, [rsp + 0x30]
lea r12, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_console_l2_2_0.dll_GetConsoleTitleW]
test eax, eax
je 0x14001778c
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
je 0x140023f8f
add rdi, rdi
add r12, rdi
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
test rax, rax
jne 0x140023f7b
mov r8, r12
mov rdx, r14
mov rcx, rbx
call fcn.140010600
xor r12d, r12d
test eax, eax
jne 0x14001778c
jmp 0x14001776f
mov rbx, r12
jmp 0x14001776f
Function at 0x14001873c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140018788
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140018780
cmp dword [rcx + 0x3c], edx
jl 0x140018780
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140018780
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140018788
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14002b490
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x30
mov rsi, rcx
mov r14d, r8d
mov ecx, dword [rcx]
mov r15, r9
mov rbp, rdx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FlushFileBuffers]
mov ecx, dword [rsi]
call fcn.14000c8e8
xor edx, edx
mov rcx, rbp
call fcn.140006494
mov dword [rsi], eax
cmp eax, 0xffffffff
je 0x14002b58c
mov ebx, r14d
mov ecx, eax
neg ebx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r9d, 2
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
mov ecx, dword [rsi]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rdx, qword [rsp + 0x70]
lea r9, [rsp + 0x50]
and qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, r14d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
je 0x14002b582
cmp dword [rsp + 0x50], r14d
jne 0x14002b582
mov rdx, qword [rsp + 0x70]
mov r8d, r14d
mov rcx, r15
call sub.msvcrt.dll_memcmp
mov ecx, dword [rsi]
mov ebx, eax
call fcn.14000c8e8
mov edx, 1
test ebx, ebx
je 0x14002b553
or dword [rsi], 0xffffffff
jmp 0x14002b591
mov rcx, rbp
call fcn.140006494
mov dword [rsi], eax
cmp eax, 0xffffffff
je 0x14002b58c
mov ecx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r9d, 2
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
xor eax, eax
jmp 0x14002b5a3
mov ecx, dword [rsi]
call fcn.14000c8e8
or dword [rsi], 0xffffffff
mov edx, 1
mov r8, rbp
mov ecx, 0x4000271f
call fcn.140015118
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rsi
ret

Function at 0x14002c39c
Capabilities:
Delete file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, r9
mov ebp, r8d
mov rbx, rdx
mov esi, ecx
xor edi, edi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov rcx, rax
mov r8d, ebp
mov rdx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
je 0x14002c3f3
cmp ebp, dword [rsp + 0x30]
jne 0x14002c3f3
cmp dword [0x14003f8a4], edi
je 0x14002c46a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [rsp + 0x70]
mov dword [0x140043b28], eax
call fcn.14000c8e8
mov ecx, esi
call fcn.14000c8e8
mov ecx, esi
call fcn.14000f7c8
test eax, eax
je 0x14002c421
mov edi, 0x1d
jmp 0x14002c42a
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov ecx, dword [0x140043b28]
mov eax, 0x70
and dword [0x140043b18], 0
test ecx, ecx
cmove ecx, eax
cmp dword [0x14003f8a4], 0
mov dword [0x140043b28], ecx
je 0x14002c454
xor edi, edi
jmp 0x14002c45d
test edi, edi
jne 0x14002c45d
call fcn.14002cc98
mov edx, 1
mov ecx, edi
call fcn.14002b5c0
int3
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14002c770
Capabilities:
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x158]
sub rsp, 0x250
mov rax, qword [0x14003b0f8]
xor rax, rsp
mov qword [rbp + 0x148], rax
mov esi, 0x104
mov byte [rbp + 0x130], 1
mov ebx, ecx
mov qword [rbp + 0x138], rsi
xor r14d, r14d
lea rcx, [rsp + 0x20]
mov r8d, esi
mov qword [rbp + 0x128], r14
xor edx, edx
mov edi, r14d
call sub.msvcrt.dll_memset
mov al, byte [rbp + 0x130]
lea rcx, [rsp + 0x20]
neg al
sbb rdx, rdx
and edx, 0x7ee3
add rdx, rsi
call fcn.14000c130
test eax, eax
js 0x14002c935
lea eax, [r14 + 0x3d]
mov dword [rbp + 0x144], 0x3a
add bx, 0x40
mov word [rbp + 0x140], ax
lea rcx, [rbp + 0x140]
mov word [rbp + 0x142], bx
call fcn.14000fbc0
mov rbx, rax
test rax, rax
je 0x14002c84b
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetCurrentDirectoryW]
test al, al
jne 0x14002c912
lea ecx, [r14 + 1]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetErrorMode]
mov edi, eax
mov rcx, qword [rbp + 0x128]
lea rdx, [rsp + 0x20]
test rcx, rcx
cmovne rdx, rcx
movzx ecx, word [rbp + 0x142]
mov word [rdx], cx
lea rdx, [rsp + 0x20]
mov rcx, qword [rbp + 0x128]
movzx eax, word [rbp + 0x144]
test rcx, rcx
cmovne rdx, rcx
lea rcx, [rsp + 0x20]
mov word [rdx + 2], ax
lea rdx, [rsp + 0x20]
mov rax, qword [rbp + 0x128]
test rax, rax
cmovne rcx, rax
mov eax, 0x5c
mov word [rcx + 4], ax
lea rcx, [rsp + 0x20]
mov rax, qword [rbp + 0x128]
test rax, rax
cmovne rcx, rax
mov word [rcx + 6], r14w
lea rcx, [rbp + 0x140]
mov rax, qword [rbp + 0x128]
test rax, rax
cmovne rdx, rax
call fcn.1400139b8
mov rax, qword [rbp + 0x128]
lea rcx, [rsp + 0x20]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x14002c905
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
xor edx, edx
call fcn.140015118
test rbx, rbx
je 0x14002c912
mov ecx, edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetErrorMode]
mov rax, qword [0x140056668]
lea rcx, [0x140056460]
mov edx, dword [0x140056678]
test rax, rax
cmovne rcx, rax
xor r8d, r8d
call fcn.14001321c
mov rcx, qword [rbp + 0x128]
mov qword [rbp + 0x128], r14
test rcx, rcx
je 0x14002c94e
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp + 0x148]
xor rcx, rsp
call fcn.1400182e0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14002c980
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov edx, 1
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
test eax, eax
jne 0x14002c99f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [0x140043b28], eax
xor eax, eax
add rsp, 0x28
ret