joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f8c80
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rbp, r9
mov eax, r8d
mov rdi, rdx
mov rbx, rcx
jb 0x1400f8caa
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x1400f8cb4
mov rcx, qword [rcx]
xor esi, esi
test eax, eax
mov r8d, esi
sete r8b
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400f8cd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rax, str.boost::filesystem::copy_file
mov r9, rbp
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov ecx, esi
call fcn.1400f9d00
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f9020
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0xd0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1403aa6c8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x1400f905e
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400f9085
test rbx, rbx
je 0x1400f907e
mov dword [rbx], 0
call fcn.1400f7cd0
mov qword [rbx + 8], rax
mov al, 1
jmp 0x1400f9150
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov dword [rsp + 0x20], 0
call fcn.1400f7cd0
mov qword [rsp + 0x28], rax
cmp ebp, 0xb7
jne 0x1400f90d4
lea r8, [rsp + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1400fb010
cmp dword [rax], 3
jne 0x1400f90d4
test rbx, rbx
je 0x1400f914e
mov dword [rbx], 0
call fcn.1400f7cd0
jmp 0x1400f914a
test rbx, rbx
jne 0x1400f9143
mov qword [rsp + 0x58], send
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x40], bl
lea r8d, [rbx + 0x23]
lea rdx, str.boost::filesystem::create_directory
lea rcx, [rsp + 0x40]
call fcn.140036260
nop
mov dword [rsp + 0x20], ebp
call fcn.1400f7cd0
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x20]
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400f7f90
lea rdx, [0x140375618]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.1400f7cd0
mov dword [rbx], ebp
mov qword [rbx + 8], rax
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140229810
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x1400f9180
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rbp, rdx
mov r14, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov eax, 1
test esi, esi
cmove esi, eax
mov edx, esi
mov eax, 2
mul rdx
mov r15, 0xffffffffffffffff
cmovo rax, r15
mov rcx, rax
call fcn.140229ab0
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1400f9204
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400f9206
mov eax, edi
lea r8, str.boost::filesystem::current_path
mov rdx, rbp
mov ecx, eax
call fcn.1400f9f20
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], rdi
cmp qword [r14 + 0x18], 8
jb 0x1400f922f
mov rax, qword [r14]
jmp 0x1400f9232
mov rax, r14
mov word [rax], di
cmp word [rbx], 0
je 0x1400f924a
mov rdi, r15
nop
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x1400f9240
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140035960
nop
mov rcx, rbx
call fcn.140229774
mov rax, r14
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400fa580
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, edx
mov r14, r8
and eax, 0x3000
mov esi, edx
mov rdi, rcx
cmp eax, 0x3000
je 0x1400fa661
test eax, eax
je 0x1400fa5b7
test dl, 0x92
je 0x1400fa661
cmp qword [rcx + 0x18], 8
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
jb 0x1400fa5cb
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebp, ebp
mov ebx, eax
test eax, eax
jne 0x1400fa5e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400fa5e3
mov eax, ebp
lea r9, str.boost::filesystem::permissions
mov r8, r14
mov rdx, rdi
mov ecx, eax
call fcn.1400f9e10
test al, al
jne 0x1400fa657
bt esi, 0xc
jae 0x1400fa606
and ebx, 0xfffffffe
jmp 0x1400fa620
bt esi, 0xd
jae 0x1400fa611
or ebx, 1
jmp 0x1400fa620
mov eax, ebx
or ebx, 1
and eax, 0xfffffffe
test sil, 0x92
cmovne ebx, eax
cmp qword [rdi + 0x18], 8
jb 0x1400fa62c
mov rcx, qword [rdi]
jmp 0x1400fa62f
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1400fa643
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea r9, str.boost::filesystem::permissions
mov r8, r14
mov rdx, rdi
mov ecx, ebp
call fcn.1400f9e10
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400fa7d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rsi, rdx
mov rdi, rcx
jb 0x1400fa7ef
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400fa81e
mov r8, rsi
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1400fa680
mov eax, dword [rax]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x1400fa832
mov dword [rsi], 0
call fcn.1400f7cd0
mov qword [rsi + 8], rax
bt ebx, 0xa
jae 0x1400fa879
mov rcx, rdi
call fcn.1400fa020
test al, al
je 0x1400fa864
and bl, 0x10
mov eax, 4
mov ecx, 0xb
cmovne eax, ecx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, 9
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x40]
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400fae00
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
cmp edx, 1
jne 0x1400fae35
test r8, r8
je 0x1400fae28
xor eax, eax
mov dword [r8], eax
call fcn.1400f7cd0
mov qword [rdi + 8], rax
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rdx - 3]
test eax, 0xfffffff7
je 0x1400faeae
cmp qword [rcx + 0x18], 8
jb 0x1400fae49
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400fae87
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
je 0x1400fae87
cmp eax, 0x57
je 0x1400fae87
cmp eax, 0x35
ja 0x1400fae78
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x1400fae87
cmp eax, 0xa1
je 0x1400fae87
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400fae89
xor eax, eax
lea r9, str.boost::filesystem::remove
mov r8, rdi
mov rdx, rbx
mov ecx, eax
call fcn.1400f9e10
test al, al
je 0x1400faf14
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp qword [rcx + 0x18], 8
jb 0x1400faeb8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1400faef6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
je 0x1400faef6
cmp eax, 0x57
je 0x1400faef6
cmp eax, 0x35
ja 0x1400faee7
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x1400faef6
cmp eax, 0xa1
je 0x1400faef6
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400faef8
xor eax, eax
lea r9, str.boost::filesystem::remove
mov r8, rdi
mov rdx, rbx
mov ecx, eax
call fcn.1400f9e10
test al, al
jne 0x1400fae28
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400fb010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x1403aa6c8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
cmp qword [rdx + 0x18], 8
jb 0x1400fb054
mov rcx, qword [rdx]
jmp 0x1400fb057
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x1400fb077
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.1400fa680
jmp 0x1400fb1c9
xor r15d, r15d
bt eax, 0xa
jae 0x1400fb185
cmp qword [rdi + 0x18], 8
jb 0x1400fb090
mov rdx, qword [rdi]
jmp 0x1400fb093
mov rdx, rdi
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp word [rdx], r15w
jne 0x1400fb0b2
mov r8, r15
jmp 0x1400fb0c0
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r15w
jne 0x1400fb0b6
lea rcx, [rsp + 0x50]
call fcn.140035960
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x1400fb125
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.1400381b0
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r15
mov word [rsp + 0x50], r15w
cmp rbx, 0xffffffffffffffff
jne 0x1400fb150
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.1400fa680
nop
jmp 0x1400fb1c9
mov rcx, rdi
call fcn.1400fa020
test al, al
jne 0x1400fb17b
mov edx, ebp
mov rcx, rdi
call fcn.1400fa220
mov dword [rsi], 9
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1400fb1c9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x1400fb196
mov dword [r14], r15d
call fcn.1400f7cd0
mov qword [r14 + 8], rax
mov edx, ebp
mov rcx, rdi
test bpl, 0x10
mov dword [rsp + 0x40], 3
jne 0x1400fb1b1
mov dword [rsp + 0x40], 2
call fcn.1400fa220
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], eax
mov eax, dword [rcx]
mov dword [rsi], eax
mov eax, dword [rcx + 4]
mov dword [rsi + 4], eax
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140229810
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400fb1f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov r14, r8
mov rdi, rdx
mov rbx, rcx
jb 0x1400fb21a
mov rcx, qword [rdx]
jmp 0x1400fb21d
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1400fb23a
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.1400fa680
jmp 0x1400fb2a8
test r14, r14
je 0x1400fb24f
mov dword [r14], 0
call fcn.1400f7cd0
mov qword [r14 + 8], rax
mov rcx, rdi
bt esi, 0xa
jae 0x1400fb278
call fcn.1400fa020
mov dword [rsp + 0x38], 4
mov edx, esi
mov rcx, rdi
test al, al
jne 0x1400fb290
mov dword [rsp + 0x38], 9
jmp 0x1400fb290
mov dword [rsp + 0x38], 3
mov edx, esi
test sil, 0x10
jne 0x1400fb290
mov dword [rsp + 0x38], 2
call fcn.1400fa220
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x3c], eax
mov eax, dword [rcx]
mov dword [rbx], eax
mov eax, dword [rcx + 4]
mov dword [rbx + 4], eax
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400fb690
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403aa6c8]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x11], rcx
xor r14d, r14d
mov dword [rbp - 0x39], r14d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
lea rcx, [rbp - 0x31]
call fcn.14004f470
nop
mov rdi, qword [rbp - 0x31]
mov rdx, qword [rbp - 0x29]
cmp rdi, rdx
sete al
test al, al
jne 0x1400fb762
sub rdx, rdi
sar rdx, 1
mov r8d, edx
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400fb762
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
cmp word [rdi], r14w
jne 0x1400fb732
mov r8d, r14d
jmp 0x1400fb74b
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400fb740
mov rdx, rdi
lea rcx, [rbp - 9]
call fcn.140035960
lea rdx, [rbp - 9]
mov ebx, 1
jmp 0x1400fb77c
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r14
mov word [rbp + 0x17], r14w
lea rdx, [rbp + 0x17]
mov ebx, 2
mov dword [rbp - 0x39], ebx
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r14
cmp qword [rsi + 0x18], 8
jb 0x1400fb797
mov rax, qword [rsi]
jmp 0x1400fb79a
mov rax, rsi
mov word [rax], r14w
mov rcx, rsi
call fcn.140035f80
nop
or ebx, 4
mov dword [rbp - 0x39], ebx
test bl, 2
je 0x1400fb7e3
and ebx, 0xfffffffd
mov dword [rbp - 0x39], ebx
mov r8, qword [rbp + 0x2f]
cmp r8, 8
jb 0x1400fb7d2
inc r8
mov rdx, qword [rbp + 0x17]
lea rcx, [rbp + 0x17]
call fcn.1400381b0
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r14
mov word [rbp + 0x17], r14w
test bl, 1
je 0x1400fb819
and ebx, 0xfffffffe
mov dword [rbp - 0x39], ebx
mov r8, qword [rbp + 0xf]
cmp r8, 8
jb 0x1400fb808
inc r8
mov rdx, qword [rbp - 9]
lea rcx, [rbp - 9]
call fcn.1400381b0
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
test rdi, rdi
je 0x1400fb835
mov r8, qword [rbp - 0x21]
sub r8, rdi
sar r8, 1
mov rdx, rdi
lea rcx, [rbp - 0x31]
call fcn.1400381b0
nop
mov rax, rsi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140229810
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140118e50
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140229de0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14011ebd0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rsp + 0x10], rdx
mov r10, qword [rsp + 0x10]
test r8, r8
je 0x14011ec07
sub r10, rax
nop
movzx edx, byte [r10 + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
xor dl, cl
or r9b, dl
sub r8, 1
jne 0x14011ebf0
movzx eax, r9b
ret

Function at 0x140131960
Capabilities:
Encode data using base64

Disassembly:
xor r10d, r10d
test r8d, r8d
jle 0x140131a53
lea r9, [rdx + 1]
lea r11, [0x140289100]
cmp r8d, 3
jl 0x1401319db
movzx eax, byte [r9]
movzx edx, byte [r9 - 1]
shl rdx, 8
or rdx, rax
movzx eax, byte [r9 + 1]
shl rdx, 8
or rdx, rax
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r11]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 1], al
mov rax, rdx
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 2], al
add rcx, 3
and edx, 0x3f
movzx eax, byte [rdx + r11]
mov byte [rcx], al
jmp 0x140131a34
movzx edx, byte [r9 - 1]
shl edx, 0x10
cmp r8d, 2
jne 0x1401319f2
movzx eax, byte [r9]
shl eax, 8
or edx, eax
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r11]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 1], al
cmp r8d, 1
jne 0x140131a1e
lea eax, [r8 + 0x3c]
jmp 0x140131a2a
shr rdx, 6
and edx, 0x3f
movzx eax, byte [rdx + r11]
mov byte [rcx + 2], al
add rcx, 3
mov byte [rcx], 0x3d
add r10d, 4
add r9, 3
sub r8d, 3
inc rcx
test r8d, r8d
jg 0x140131977
mov byte [rcx], 0
mov eax, r10d
ret
mov byte [rcx], r10b
mov eax, r10d
ret

Function at 0x14013d940
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140229de0
sub rsp, rax
lea rcx, [0x1403b53a0]
add rsp, 0x28
jmp fcn.140118cb0
Function at 0x140145830
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov rsi, r8
mov ecx, 0x4000
mov r15, rdx
call fcn.14022ac1e
mov rbp, rax
test rax, rax
jne 0x14014586b
lea eax, [rbp + 4]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov qword [rsp + 0x48], rdi
cmp rsi, 0xffffffffffffffff
je 0x14014589b
cmp rbx, rsi
jae 0x140145913
mov r8d, 0x4000
mov rax, rsi
sub rax, rbx
cmp rax, r8
cmovb r8, rax
jmp 0x1401458a1
mov r8d, 0x4000
mov r9, r14
mov edx, 1
mov rcx, rbp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov rdi, rax
test rax, rax
je 0x1401458f8
mov r9, r15
mov r8, rax
mov edx, 1
mov rcx, rbp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, rdi
jne 0x1401458d6
add rbx, rdi
jmp 0x140145877
mov rcx, rbp
call case.0x1400ef54e.0
mov rcx, qword [0x1404cc3e0]
lea rdx, str._fcopy:_write_error_n
call fcn.1400a5710
mov eax, 0xa
jmp 0x14014591d
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ferror
test eax, eax
je 0x140145913
mov rcx, rbp
call case.0x1400ef54e.0
mov eax, 0xb
jmp 0x14014591d
mov rcx, rbp
call case.0x1400ef54e.0
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret

Function at 0x140145b10
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1403aa6c8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
lea rdx, [rsp + 0x20]
call fcn.140145f60
test eax, eax
jne 0x140145b59
cmp word [rsp + 0x28], 1
jg 0x140145b76
mov rcx, rdi
call fcn.14022add4
test eax, eax
jne 0x140145bc7
mov rdx, rdi
mov rcx, rsi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_rename
test eax, eax
je 0x140145bfe
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [rax], 0x12
jne 0x140145bc7
lea rdx, [0x14032e668]
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov rbp, rax
test rax, rax
jne 0x140145ba8
mov rcx, qword [0x1404cc3e0]
lea rdx, str._replace:_cant_open__s_n
mov r8, rsi
call fcn.1400a5710
lea eax, [rbp + 0xa]
jmp 0x140145c00
lea rdx, [0x140266b34]
mov rcx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov r14, rax
mov rcx, rbp
test rax, rax
jne 0x140145bce
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov eax, send
jmp 0x140145c00
mov r8d, 0xffffffff
mov rdx, rax
call fcn.140145830
mov rcx, rbp
mov ebx, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
test eax, eax
jne 0x140145c22
test ebx, ebx
jne 0x140145c22
mov rcx, rsi
call fcn.14022add4
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140229810
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.14022add4
test ebx, ebx
je 0x140145c3d
mov eax, recv
cmp ebx, 0xa
cmove ebx, eax
mov eax, ebx
jmp 0x140145c00
mov ebx, recv
mov eax, ebx
jmp 0x140145c00
Function at 0x140145d40
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x1403aa6c8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
movzx ecx, byte [rcx]
call sub.api_ms_win_crt_string_l1_1_0.dll_isalpha
test eax, eax
je 0x140145d70
cmp byte [rbx + 1], 0x3a
je 0x140145d93
lea r9, [rsp + 0x48]
mov edx, 0x104
lea r8, [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea rbx, [rsp + 0x170]
mov r8d, 3
mov qword [rsp + 0x48], rbx
mov rdx, rbx
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strncpy
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov byte [rsp + 0x43], 0
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x170]
lea rax, [rsp + 0x54]
mov r8d, 0x104
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rcx, [rsp + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll__strupr
mov rcx, rax
lea rdx, [0x14028cc1c]
mov r8d, 3
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
test eax, eax
je 0x140145e51
mov r8d, 4
lea rdx, str.VFAT
lea rcx, [rsp + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
test eax, eax
je 0x140145e51
mov r8d, 4
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_strncmp
test eax, eax
je 0x140145e51
xor eax, eax
jmp 0x140145e56
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140229810
add rsp, 0x290
pop rbx
ret
Function at 0x140146220
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11, r8
mov r10, rdx
test rdx, rdx
jne 0x140146236
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
lea rdi, [0x14028cc60]
not ecx
test r8, r8
je 0x14014626d
test r10b, 3
je 0x14014626d
movzx edx, byte [r10]
mov eax, ecx
xor rdx, rax
inc r10
shr eax, 8
movzx r8d, dl
mov ecx, dword [rdi + r8*4]
xor ecx, eax
sub r11, 1
jne 0x140146248
cmp r11, 0x10
jb 0x140146389
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 4
imul rax, rbx, 0xfffffffffffffff0
add r11, rax
nop word [rax + rax]
xor ecx, dword [r10]
movzx edx, cl
shr ecx, 8
mov r8d, dword [rdi + rdx*4]
xor r8d, ecx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov r9d, dword [rdi + rcx*4]
xor r9d, r8d
xor r9d, dword [r10 + 4]
movzx ecx, r9b
shr r9d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r9d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
xor r8d, dword [r10 + 8]
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
xor r8d, dword [r10 + 0xc]
add r10, 0x10
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov ecx, dword [rdi + rcx*4]
xor ecx, edx
sub rbx, 1
jne 0x140146290
mov rbx, qword [rsp + 0x10]
cmp r11, 4
jb 0x1401463e3
mov r9, r11
shr r9, 2
imul rax, r9, 0xfffffffffffffffc
add r11, rax
nop dword [rax]
xor ecx, dword [r10]
add r10, 4
movzx edx, cl
shr ecx, 8
mov r8d, dword [rdi + rdx*4]
xor r8d, ecx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [rdi + rcx*4]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [rdi + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov ecx, dword [rdi + rcx*4]
xor ecx, r8d
sub r9, 1
jne 0x1401463a0
test r11, r11
je 0x140146410
nop dword [rax + rax]
movzx edx, byte [r10]
lea r10, [r10 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rdi + r8*4]
xor ecx, eax
sub r11, 1
jne 0x1401463f0
mov rdi, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret