joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401466ac
Capabilities:
Create directory
Packed with generic packer

Disassembly:
xor dword fs:[rbx + 0x5b], edi
xor esi, dword [rcx + 0x7a]
push rdx
sub edx, dword [rdx + 0x4f]
cmp byte [rbp + 0x4f], al
outsb dx, byte [rsi]
sub byte [0x15459840c], bl
sbb eax, 0x14451d48

Function at 0x1401466c7
Capabilities:
Create directory
Packed with generic packer

Disassembly:
jbe 0x14014670a
cmp dword [rax + 0x5b], ebp
jae 0x14014671c
jp 0x1401466f1
jb 0x140146724
cmp al, 0x55
invalid
cmp eax, 0x542f505d
and ch, byte [rbx]
jl 0x14014672a
imul ebx, dword [rcx + 0x3e], 0x2c
pop rcx
jno 0x140146729
jp 0x140146733
pop rcx
cmp eax, 0x32db3dde
loop 0x140146744
jrcxz 0x140146745
loope 0x14014674d
fldenv [rsi + rdx*2 + 0x57]
js 0x140146793
jns 0x140146778
jns 0x140146778
xor eax, 0x56412159
jp 0x14014679d
js 0x140146796
jo 0x14014677d
push rsi
invalid
pop rbx
and byte [rax + rax*2], dh
invalid
mov ah, byte [rsi - 0x58765d6b]
and eax, 0x2e745468
push 0x462e7454
hlt
and dword [rsi], edi
and byte [r8 + 0x1d], r8b
cmp eax, 0x3b204022
invalid
invalid
sbb dword [rsi], edi
sbb bh, byte [rcx]
sbb bh, byte [rcx]
and eax, 0x1a3c1e44
invalid

Function at 0x1401466e1
Capabilities:
Create directory
Packed with generic packer

Disassembly:
mov edx, 0xb45abf5d
pop rbx
mov dl, 0x7b
jnp 0x140146740
push rdi
push rdi
pop rdx
ja 0x140146728
cmp byte [0x19443b753], bh
and al, 0x5b

Function at 0x1401466e9
Capabilities:
Create directory
Packed with generic packer

Disassembly:
mov edx, 0xb45abf5d
pop rbx
mov dl, 0x7b
jnp 0x140146740
push rdi
push rdi
pop rdx
ja 0x140146728
cmp byte [0x19443b753], bh
and al, 0x5b

Function at 0x140146706
Capabilities:
Create directory
Packed with generic packer

Disassembly:
loop 0x14014673f
fidivr dword [0x172efa4ed]
invalid

Function at 0x140146731
Capabilities:
Create directory
Packed with generic packer

Disassembly:
mov byte [rcx - 0x5d6a5976], ch
mov dword [rdi + 0x4b674d3e], esp
xor rax, 0x39272e63

Function at 0x140146739
Capabilities:
Create directory
Packed with generic packer

Disassembly:
xor rax, 0x39272e63
xor eax, 0x54682530
je 0x140146777
mov dil, 0xea
mov esp, 0xbbf5aff4
call 0x1683f560b
sub ch, byte [rax]
cmp byte [rsi + 0x2a], ah
pop rdi
jns 0x1401467d6
pop rax
pop r9
xor eax, 0x4d473041
invalid
and dword [rsi], r15d
invalid
cmp dword [rdx], ebx
cmp dword [0x15a5085e5], esp
cmp dword [rbx], esp
invalid
push rsp
jae 0x14014684d
invalid

Function at 0x1401467c5
Capabilities:
Create directory
Packed with generic packer

Disassembly:
pop rsp
jns 0x140146814
cmp eax, dword [rdi + 0x54]
je 0x14014682f
push rcx
xor ah, byte [rcx + 0x3e]
insd dword [rdi], dx
and al, 0x45
pop rax
lahf
invalid
jnp 0x140146877
xor esi, dword [rbx]
pop rdi
invalid
push 0x6a
push 0x6e62755c
push 0x6a746377
imul ebp, dword [rax + 0x71], 0x68
jne 0x1401468f3
push 0x716a756a
invalid
xor word [rdx + 0x4a], si
push rsi
js 0x14014694e
pop rsp
and eax, 0x356f3e2e
xor byte [rsi + 0x7b], ch
jp 0x14014695b
push rbp
loopne 0x14014692f
loopne 0x14014692f
jns 0x1401469bd
Function at 0x1401467fb
Capabilities:
Create directory
Packed with generic packer

Disassembly:
je 0x140146833
insb byte [rdi], dx
cmp ecx, dword [rdx + 0x75]
jae 0x14014685c
je 0x140146845
insd dword [rdi], dx
xor dword [rsi], esi
and dword [rbp + rdx*2 + 0x61], ebx
push r15
xor eax, 0x2e6b3244
jnp 0x140146877

Function at 0x140146858
Capabilities:
Create directory
Packed with generic packer

Disassembly:
mov ebx, eax
pop rsi
pop rbp
add eax, 0xcb87c68e

Function at 0x140146864
Capabilities:
Create directory
Packed with generic packer

Disassembly:
jnp 0x140146898
pop rcx
push 0x38
jne 0x1401468b1
sub byte [rsi + 0x72], bh
outsb dx, byte [rsi]
jge 0x1401468eb
push rax
push rbx
and byte [rbp + 0x6a], al
push 0x70666d5e
push 0x5d695f76
jno 0x14014690a
insd dword [rdi], dx
outsb dx, byte [esi]
invalid
invalid
pop rbp
outsd dx, dword [rsi]
pop rsi
je 0x140146953
outsb dx, byte [rsi]
loopne 0x14014692f
shl byte [rsi], cl
loope fcn.140146934
xlatb
sub edx, ebx
sub eax, 0x29d82cd4
invalid
cmp ecx, dword [rdx + 0x24]
mov r10b, 0x4a
mov r10b, 0x4a
mov ebp, 0xb14cbc44
mov r12d, 0xb248bb4b
mov r10d, 0xb542bf3f
ror byte [rbx - 0x4e], 0x34
jns 0x1401469bd
outsd dx, dword [rsi]
and eax, 0x40403167
xor dword [rax + 0x40], eax
pop rsi
cmp ax, 0x654a
sub ah, byte [rax]
xor byte [rcx + 0x58], ah
pop rax
fisub word [rax - 0x27]
pop rsi
ficom word [rdx - 0x2d]
push rbx
fst qword [rcx - 0x22]
sbb dl, byte [rdi + 0x4a7a941c]
cmp al, 0x2f
cmp eax, 0x7a593a7e
push rbx
sub dl, byte [r9 + r14*2 + 0x33]
invalid

Function at 0x140146879
Capabilities:
Create directory
Packed with generic packer

Disassembly:
push 0x68
pop rsp
jne 0x1401468e0
outsb dx, byte [rsi]
jno 0x140146948
jae 0x14014694d
push 0x65
jbe 0x140146950
push 0x67
push 0x5d

Function at 0x140146923
Capabilities:
Create directory

Disassembly:
cmp al, 0x5f
sub byte [0x17949bf81], ch
jge fcn.14014696b
and al, 0x65
mov r10b, 0x4a
mov r10b, 0x4a

Function at 0x14014696b
Capabilities:
Create directory

Disassembly:
push rdx
rcl dword [rbx - 0x23], cl
push rcx
fiadd word [rdi + 0x6d]
insd dword [rdi], dx
jrcxz 0x1401469f6
jrcxz 0x1401469fa
call 0x125934a0b
jl 0x140146965
jle 0x140146969
je 0x1401469f5
cmp ebx, dword [rcx + 0x38]
cmp byte [rbx + 0x6f], spl
ja 0x1401469ba
invalid
xchg ebx, eax
invalid
cmp ebp, dword [rbx + rcx*2]
sub al, 0x4b
push 0x33
pop rsi
jb 0x140146a50
xor ebx, dword [rsi + 0x72]
push rdx
sub al, 0x77
outsb dx, byte [rsi]
xchg ebx, eax
scasb al, byte [rdi]
xchg edi, eax
movsb byte [rdi], byte [rsi]
sahf
cmpsd dword [rsi], dword [rdi]
pushfq
cmpsd dword [rsi], dword [rdi]
cwde
test eax, 0xaf8fa697
sahf
movabs dword [0xa394a99daf99a49a], eax
invalid
Function at 0x14014697f
Capabilities:
Create directory

Disassembly:
push rdx
rcl dword [rbx - 0x23], cl
push rcx
fiadd word [rdi + 0x6d]
insd dword [rdi], dx
jrcxz 0x1401469f6
jrcxz 0x1401469fa
call 0x125934a0b
jl 0x140146965
jle 0x140146969
je 0x1401469f5
cmp ebx, dword [rcx + 0x38]
cmp byte [rbx + 0x6f], spl
ja 0x1401469ba
invalid
xchg ebx, eax
invalid
cmp ebp, dword [rbx + rcx*2]
sub al, 0x4b
push 0x33
pop rsi
jb 0x140146a50
xor ebx, dword [rsi + 0x72]
push rdx
sub al, 0x77
outsb dx, byte [rsi]
xchg ebx, eax
scasb al, byte [rdi]
xchg edi, eax
movsb byte [rdi], byte [rsi]
sahf
cmpsd dword [rsi], dword [rdi]
pushfq
cmpsd dword [rsi], dword [rdi]
cwde
test eax, 0xaf8fa697
sahf
movabs dword [0xa394a99daf99a49a], eax
invalid

Function at 0x14014698d
Capabilities:
Create directory

Disassembly:
push rdx
rcl dword [rbx - 0x23], cl
push rcx
fiadd word [rdi + 0x6d]
insd dword [rdi], dx
jrcxz 0x1401469f6
jrcxz 0x1401469fa
call 0x125934a0b
jl 0x140146965
jle 0x140146969
je 0x1401469f5
cmp ebx, dword [rcx + 0x38]
cmp byte [rbx + 0x6f], spl
ja 0x1401469ba
invalid
xchg ebx, eax
invalid
cmp ebp, dword [rbx + rcx*2]
sub al, 0x4b
push 0x33
pop rsi
jb 0x140146a50
xor ebx, dword [rsi + 0x72]
push rdx
sub al, 0x77
outsb dx, byte [rsi]
xchg ebx, eax
scasb al, byte [rdi]
xchg edi, eax
movsb byte [rdi], byte [rsi]
sahf
cmpsd dword [rsi], dword [rdi]
pushfq
cmpsd dword [rsi], dword [rdi]
cwde
test eax, 0xaf8fa697
sahf
movabs dword [0xa394a99daf99a49a], eax
invalid

Function at 0x140146a83
Capabilities:
Create directory

Disassembly:
cmp spl, byte [rsi]
jo 0x140146ac0
invalid
push 0x36505f54
sub edi, edi
and eax, 0x7f68a
jmp qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
fild word [rax]
cli
invalid
fild word [rax]
cli
invalid

Function at 0x140169e0c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140152622
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140152605
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1401525f0
Function at 0x140193898
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1401935e8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401935e8
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401935e8
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401935e8
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401935e8
cmp dword [rcx + 0x84], 0xe
jbe 0x1401935e8
cmp dword [rcx + 0xf8], esi
je 0x1401935e8
mov ecx, r14d
call fcn.1401937ac
mov ecx, 2
call fcn.1401988d0
nop
cmp byte [0x1401efbe8], 0
jne 0x1401936b2
mov r15d, 1
mov eax, r15d
xchg dword [0x1401efbd8], eax
test ebx, ebx
jne 0x14019365b
mov rdi, qword [0x1401ed038]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1401efbe0]
cmp rcx, rax
je 0x140193652
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14014821c]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1401f0170]
jmp 0x140193667
cmp ebx, r15d
jne 0x14019366d
lea rcx, [0x1401f0188]
call fcn.1401a6a5c
nop
test ebx, ebx
jne 0x140193684
lea rdx, [0x1401c6770]
lea rcx, [0x1401c6750]
call fcn.1401a6fe8
lea rdx, [0x1401c6780]
lea rcx, [0x1401c6778]
call fcn.1401a6fe8
movzx eax, byte [0x1401efbe8]
test esi, esi
cmove eax, r15d
mov byte [0x1401efbe8], al
jmp 0x1401936b2
mov ecx, 2
call fcn.140198924
test esi, esi
jne 0x1401936c9
mov ecx, r14d
call fcn.1401936e4
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140193578
Function at 0x1401aef34
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1401aeb60
call fcn.140185960
mov dword [rax], 0x16
call fcn.1401856f8
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401aeb48
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1401aeb48
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1401aeb92
lock or dword [rax + 0x14], 0x10
jmp 0x1401aeb48
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1401aebaf
mov rcx, qword [rbp + 0x10]
call fcn.1401b0c80
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1401aaebc
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1401b0308
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1401aec06
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1401aeb48
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401aec72
mov rcx, qword [rbp + 0x10]
call fcn.1401aaebc
cmp eax, 0xffffffff
je 0x1401aec59
mov rcx, qword [rbp + 0x10]
call fcn.1401aaebc
cmp eax, 0xfffffffe
je 0x1401aec59
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1401aaebc
movsxd rdi, eax
lea rsi, [0x1401f0850]
mov rcx, rbx
sar rdi, 6
call fcn.1401aaebc
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1401aec60
lea rax, [0x1401ed400]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401aec72
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1401aeca8
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1401aeca4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1401aeca4
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1401aeb4b
jmp 0x1401aeb18
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
xor byte [rcx - 0x6f], dh
int1
mov byte [rbp + 0xd], bh
mov bh, 0x4f
sub eax, 0x9ca5ca99
xchg esi, eax
invalid
Function at 0x1400159d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x10090
call fcn.140040010
sub rsp, rax
mov rax, qword [0x140058040]
xor rax, rsp
mov qword [rsp + 0x10080], rax
xor eax, eax
lea rsi, str.PYTHON_FROZEN_MODULES
mov word [rsp + 0x80], ax
lea rbx, [rsp + 0x30]
mov word [rsp + 0x30], ax
mov edi, 0x28
mov dl, 0x50
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x140015a3d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140015a30
cmp rcx, 1
jb 0x140015aea
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140015a60
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1400335e8
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140015a20
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140015ae6
lea rcx, [rsp + 0x80]
call fcn.140034dbc
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140024560
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
xor eax, eax
jmp 0x140015ac1
call fcn.140028b50
int3
Function at 0x140024f34
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140024f7e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140024f7e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140024f7e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140024f7e
cmp dword [rcx + 0x84], 0xe
jbe 0x140024f7e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140024f80
xor al, al
add rsp, 0x28
ret

Function at 0x140028eb0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140028d1b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140028d1b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140028d1b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140028d1b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140028d1b
cmp dword [rcx + 0x84], 0xe
jbe 0x140028d1b
cmp dword [rcx + 0xf8], 0
je 0x140028d1b
mov ecx, ebx
call fcn.140028dcc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140028ba8
nop
cmp dword [rbp + 0x20], 0
je 0x140028d69
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140028d74
int3
xor r8d, r8d
xor edx, edx
jmp 0x140028cac
Function at 0x140039ae4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140039b6b
mov rsi, rbx
cmp word [rax], bp
je 0x140039b2a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140039b14
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140039b10
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14003736c
mov rdi, rax
test rax, rax
je 0x140039b58
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140040670
mov rbp, rdi
xor ecx, ecx
call fcn.14003573c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003d6e0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003d6f6
mov al, 1
jmp 0x14003d756
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003d707
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003d754
mov ecx, dword [rcx + 0x18]
nop
call fcn.14003a288
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003d754
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003d754
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003d754
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003d756
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14003ff20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003ff48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003ff48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001c20
Capabilities:
Create thread
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x440
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x430], rax
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x400
call fcn.14000b680
lea rdx, [rsp + 0x30]
mov ecx, 0x200
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ebp, ebp
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rbp
lea r8, [fcn.140001d10]
xor edx, edx
mov dword [rsp + 0x20], ebp
xor ecx, ecx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, ebp
test esi, esi
je 0x140001ceb
mov qword [rsp + 0x450], rdi
lea rdi, [rsp + 0x30]
cmp word [rdi], bp
jne 0x140001cd9
lea eax, [rbx + 1]
mov qword [rsp + 0x28], rbp
lea r9, [rsp + 0x30]
mov dword [rsp + 0x20], ebp
lea r9, [r9 + rax*4]
xor edx, edx
lea r8, [fcn.140001d10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add rdi, 2
cmp ebx, esi
jb 0x140001ca5
mov rdi, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14000a700
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x140001d10
Capabilities:
Create process on windows
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x6b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rbx, rcx
call fcn.1400019a0
xor edx, edx
lea rcx, [rsp + 0x490]
mov r8d, 0x208
call fcn.14000b680
mov rdx, rbx
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140023550]
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001da0
xor eax, eax
jmp 0x140001efa
lea rdx, [0x140023558]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140001ecd
lea rdx, [0x14002355c]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140001ecd
test dword [rsp + 0x30], 0x400
jne 0x140001ecd
xor edx, edx
lea rcx, [rsp + 0x280]
mov r8d, 0x208
call fcn.14000b680
mov rdx, rbx
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x280]
call fcn.1400019a0
test byte [rsp + 0x30], 0x10
je 0x140001e61
lea rdx, [0x140023564]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x280]
call fcn.140001d10
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140001ecd
mov ecx, dword [0x140030bb0]
mov eax, ecx
shl eax, 0xd
xor ecx, eax
mov eax, ecx
shr eax, 0x11
xor ecx, eax
mov eax, ecx
shl eax, 5
xor ecx, eax
mov eax, 0xaaaaaaab
mul ecx
mov dword [0x140030bb0], ecx
shr edx, 4
lea eax, [rdx + rdx*2]
shl eax, 3
cmp ecx, eax
je 0x140001ea6
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140001ecd
mov dword [rsp + 0x28], 5
lea r8, [rsp + 0x280]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea rdx, [0x140023568]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140001da0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, 1
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.14000a700
mov rbx, qword [rsp + 0x6c8]
add rsp, 0x6b0
pop rdi
ret