joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002170
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13d0]
mov eax, 0x14d0
call fcn.14000b4f0
sub rsp, rax
mov rax, qword [0x140011010]
xor rax, rsp
mov qword [rbp + 0x13c0], rax
mov r14, r8
mov esi, edx
mov rdi, rcx
mov r15, qword [rbp + 0x1438]
xor ebx, ebx
mov word [rbp + 0x3c0], bx
mov byte [rbp - 0x40], bl
mov r8, qword [rbp + 0x1440]
mov ecx, dword [r8]
mov dword [rsp + 0x28], ecx
mov eax, dword [r8 + 4]
mov dword [rsp + 0x2c], eax
call fcn.140002a70
mov r12d, eax
mov edx, 1
mov dword [rsp + 0x20], edx
mov ecx, ebx
mov eax, 8
cmp byte [r8 + 8], cl
cmovne ecx, eax
mov dword [rsp + 0x24], ecx
lock xadd dword [0x140011b40], edx
inc edx
mov dword [rsp + 0x30], edx
mov rcx, qword [rbp + 0x1448]
test rcx, rcx
je 0x140001fb9
cmp word [rcx], bx
mov qword [rsp + 0x38], rcx
jne 0x140001fbe
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], r12d
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], rdi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
xorps xmm1, xmm1
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x78], xmm1
mov rax, qword [0x140011ae0]
test rax, rax
je 0x14000201a
call qword [0x14000c380]
mov qword [rbp - 0x60], rax
jmp 0x14000201e
mov qword [rbp - 0x60], rbx
mov rax, qword [0x140011ae8]
test rax, rax
je 0x14000203f
mov r8d, 0x400
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call qword [0x14000c380]
mov rax, qword [0x140011af0]
test rax, rax
je 0x140002056
lea rcx, [rsp + 0x20]
call qword [0x14000c380]
mov rax, qword [0x140011af8]
test rax, rax
je 0x14000206d
lea rcx, [rsp + 0x20]
call qword [0x14000c380]
cmp dword [rsp + 0x28], ebx
jge 0x140002162
cmp byte [0x140011b00], bl
jne 0x1400020cb
mov rax, qword [0x140011b08]
test rax, rax
je 0x140002096
call qword [0x14000c380]
movzx ebx, al
jmp 0x1400020a1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne bl
test ebx, ebx
jne 0x1400020cb
mov rax, qword [0x140011b28]
test rax, rax
je 0x140002125
cmp byte [0x140011b20], bl
jne 0x140002125
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [0x14000c380]
jmp 0x140002125
mov rax, qword [0x140011b28]
test rax, rax
je 0x1400020f8
cmp byte [0x140011b20], 0
jne 0x1400020f8
mov r8d, 0x800
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x20]
call qword [0x14000c380]
cmp word [rbp + 0x3c0], 0
jne 0x140002118
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3c0]
call fcn.140002d30
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x140011b30], 0
je 0x140002141
mov rax, qword [0x140011b38]
test rax, rax
je 0x140002141
call qword [0x14000c380]
nop
mov rcx, qword [rbp + 0x13c0]
xor rcx, rsp
call fcn.140006aa0
add rsp, 0x14d0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140001e50
nop
int3
jmp 0x140001f10
Function at 0x1400026d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x13c0]
mov eax, 0x14c0
call fcn.14000b4f0
sub rsp, rax
mov r15, r8
mov r14d, edx
mov rsi, rcx
mov r12, qword [rbp + 0x1428]
xor edi, edi
mov word [rbp + 0x3c0], di
mov byte [rbp - 0x40], dil
mov rbx, qword [rbp + 0x1430]
mov ecx, dword [rbx]
mov dword [rsp + 0x28], ecx
mov eax, dword [rbx + 4]
mov dword [rsp + 0x2c], eax
call fcn.140002c00
mov r13d, eax
mov dword [rsp + 0x20], 3
mov ecx, edi
mov eax, 8
cmp byte [rbx + 8], cl
cmovne ecx, eax
mov dword [rsp + 0x24], ecx
mov ecx, 1
lock xadd dword [0x140011b40], ecx
inc ecx
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp + 0x1438]
test rcx, rcx
je 0x140002770
cmp word [rcx], di
mov qword [rsp + 0x38], rcx
jne 0x140002775
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x64], r13d
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], rsi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
xorps xmm1, xmm1
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x78], xmm1
mov rax, qword [0x140011ae0]
test rax, rax
je 0x1400027d2
call qword [0x14000c380]
mov qword [rbp - 0x60], rax
jmp 0x1400027d6
mov qword [rbp - 0x60], rdi
mov rax, qword [0x140011ae8]
test rax, rax
je 0x1400027f7
mov r8d, 0x400
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call qword [0x14000c380]
mov rax, qword [0x140011af0]
test rax, rax
je 0x14000280e
lea rcx, [rsp + 0x20]
call qword [0x14000c380]
mov rax, qword [0x140011af8]
test rax, rax
je 0x140002825
lea rcx, [rsp + 0x20]
call qword [0x14000c380]
cmp dword [rsp + 0x28], edi
jl 0x140002841
mov dword [rsp + 0x28], 0x8000ffff
mov ecx, 0x8000ffff
call fcn.1400036c0
mov dword [rsp + 0x2c], eax
cmp byte [0x140011b00], dil
jne 0x140002898
mov rax, qword [0x140011b08]
test rax, rax
je 0x140002861
call qword [0x14000c380]
movzx edi, al
jmp 0x14000286d
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne dil
test edi, edi
jne 0x140002898
mov rax, qword [0x140011b28]
test rax, rax
je 0x1400028f2
cmp byte [0x140011b20], dil
jne 0x1400028f2
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [0x14000c380]
jmp 0x1400028f2
mov rax, qword [0x140011b28]
test rax, rax
je 0x1400028c5
cmp byte [0x140011b20], 0
jne 0x1400028c5
mov r8d, 0x800
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x20]
call qword [0x14000c380]
cmp word [rbp + 0x3c0], 0
jne 0x1400028e5
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3c0]
call fcn.140002d30
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x140011b30], 0
je 0x14000290e
mov rax, qword [0x140011b38]
test rax, rax
je 0x14000290e
call qword [0x14000c380]
nop
lea rcx, [rsp + 0x20]
call fcn.140003320
int3
Function at 0x14000c930
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
movapd xmmword [rsp + 0x40], xmm7
movapd xmmword [rsp + 0x30], xmm6
mov r12, qword [rcx]
cmp dword [r12 + 4], 0
jne 0x14000caf0
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
movsxd r15, dword [r12]
mov rcx, qword [rcx + 8]
cmp rcx, rdx
je 0x14000c992
mov qword [rsp + 0x28], r12
add r12, 8
mov qword [rsp + 0x20], r12
mov r8d, 1
mov rdx, rbx
mov r9d, 1
call fcn.14000bb80
jmp 0x14000c9e2
mov rcx, r15
shl rcx, 4
call fcn.14006da4c
mov r14, rax
lea rax, [r12 + 8]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
mov r8d, 1
mov rcx, r14
mov rdx, rbx
mov r9d, 1
call fcn.14000bb80
movsxd r8, dword [r12]
shl r8, 4
mov rcx, rbx
mov rdx, r14
call fcn.140090170
mov rcx, r14
call fcn.14006ce38
mov rax, qword [rdi + 8]
movsd xmm0, qword [rax]
movsd xmm1, qword [rax + 8]
movapd xmm2, xmm0
addsd xmm2, xmm1
movsd qword [rsi], xmm2
subsd xmm0, xmm1
mov rax, r15
shl rax, 4
movsd qword [rsi + rax], xmm0
mov qword [rsi + 8], 0
mov qword [rsi + rax + 8], 0
cmp r15d, 2
jl 0x14000cad8
add rax, 0xfffffffffffffff0
shr r15d, 1
shl r15, 4
xor ecx, ecx
movapd xmm0, xmmword [0x140092020]
movapd xmm1, xmmword [0x1400927b0]
nop word cs:[rax + rax]
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
movupd xmm3, xmmword [rdx + rcx + 0x10]
movupd xmm4, xmmword [rdx + rax]
movapd xmm2, xmm3
addpd xmm2, xmm4
subpd xmm3, xmm4
movapd xmm4, xmm3
movsd xmm4, xmm2
movupd xmm5, xmmword [r8 + rcx]
movapd xmm6, xmm2
xorpd xmm6, xmm0
unpckhpd xmm6, xmm2
movapd xmm7, xmm3
unpcklpd xmm7, xmm3
mulpd xmm7, xmm5
shufpd xmm5, xmm5, 1
mulpd xmm5, xmm6
addpd xmm7, xmm5
addpd xmm4, xmm7
mulpd xmm4, xmm1
movupd xmmword [rsi + rcx + 0x10], xmm4
shufpd xmm2, xmm7, 2
shufpd xmm7, xmm3, 2
subpd xmm2, xmm7
mulpd xmm2, xmm1
movupd xmmword [rsi + rax], xmm2
add rax, 0xfffffffffffffff0
add rcx, 0x10
cmp r15, rcx
jne 0x14000ca50
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 2
call fcn.14005a7b0
lea rcx, str.kiss_fft_usage_error:_improper_alloc_n
mov edx, 0x25
mov r8d, 1
mov r9, rax
call fcn.14006cf7c
mov ecx, 1
call fcn.1400626e4
int3

Function at 0x14000ccc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx + 0x20]
jmp fcn.14000ccd0
Function at 0x14002f060
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x14002f0f6
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x14002f0fd
mov r15, rsi
jmp 0x14002f0bb
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call fcn.140090170
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x14002f0ee
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14002f0d3
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x14002f090
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14002f0ee
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x14002f0bb
sub rsi, r15
jmp 0x14002f1ea
xor esi, esi
jmp 0x14002f1ea
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14002f150
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x14002f150
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.140090170
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x14002f161
jmp 0x14002f1e7
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x14002f1e7
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x14002f190
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
nop dword [rax]
cmp r14, 0x1000
jb 0x14002f1c3
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.14006cbb8
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x14002f190
jmp 0x14002f1e7
test r14, r14
je 0x14002f1e4
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.14006cbb8
sub r14, rax
jmp 0x14002f1e7
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140038f20
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x270
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1e8], 0xfffffffffffffffe
mov rax, qword [rcx + 0x28]
inc rax
cmp rax, 1
jbe 0x1400390b6
mov rdi, r8
test r8, r8
je 0x140038fb9
mov rbx, rdx
mov rsi, rcx
xor r15d, r15d
lea r14, [rbp + 0x1dc]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
nop word cs:[rax + rax]
mov dword [rbp + 0x1dc], 0
mov r8d, edi
sub r8d, r15d
lea rdx, [rbx + r15]
mov rcx, qword [rsi + 0x28]
mov qword [rsp + 0x20], 0
mov r9, r14
call r12
test eax, eax
je 0x140038fcb
mov eax, dword [rbp + 0x1dc]
add r15, rax
cmp r15, rdi
jb 0x140038f80
add rsp, 0x270
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rdx, str.Error_writing_to_file__
lea rdi, [rbp - 0x58]
mov rcx, rdi
call fcn.140034a30
add rsi, 0x20
mov rcx, rdi
mov rdx, rsi
call fcn.140033190
lea rdx, [0x1400a7532]
lea rcx, [rbp - 0x58]
call fcn.140032dc0
lea rcx, [rbp + 0x1e0]
call fcn.140048850
lea rcx, [rbp - 0x58]
lea rdx, [rbp + 0x1e0]
call fcn.140033190
mov rcx, qword [rbp + 0x1e0]
test rcx, rcx
je 0x140039040
mov qword [rbp + 0x1e0], 0
lock dec dword [rcx + 8]
jne 0x140039040
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rcx, [rbp + 0x1e0]
lea rdx, [rbp - 0x58]
call fcn.140033280
mov dword [rbp + 0x1c0], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1c8], 0
mov rax, qword [rbp + 0x1e0]
test rax, rax
je 0x14003908a
mov qword [rbp + 0x1c8], rax
lock inc dword [rax + 8]
mov qword [rbp + 0x1d0], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp + 0x1b8], rax
lea rdx, [0x1400b3e80]
lea rcx, [rbp + 0x1b8]
call fcn.140057f8c
lea rdx, str.File_output_is_no_longer_open
lea rcx, [rbp + 0x1e0]
call fcn.140032870
mov dword [rbp - 0x50], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0
mov rax, qword [rbp + 0x1e0]
test rax, rax
je 0x1400390f7
mov qword [rbp - 0x48], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x40], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1400b3e80]
lea rcx, [rbp - 0x58]
call fcn.140057f8c
int3
Function at 0x140041930
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
test r8, r8
je 0x140041980
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x140041984
mov dword [rbp - 0x14], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x14]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400419e4
mov eax, dword [rbp - 0x14]
add rsp, 0x80
pop rbp
ret
xor eax, eax
jmp 0x140041977
lea rdx, str.File_is_not_open
lea rcx, [rbp - 0x10]
call fcn.140032870
mov dword [rbp - 0x50], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x1400419bf
mov qword [rbp - 0x48], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x40], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1400b3e80]
lea rcx, [rbp - 0x58]
call fcn.140057f8c
jmp 0x140041a42
lea rdx, str.ReadFile___failed
lea rcx, [rbp - 0x10]
call fcn.140032870
mov dword [rbp - 0x30], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140041a1f
mov qword [rbp - 0x28], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x20], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x38], rax
lea rdx, [0x1400b3e80]
lea rcx, [rbp - 0x38]
call fcn.140057f8c
int3

Function at 0x140042390
Capabilities:
Get file size

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x1400423cc
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14004242c
mov rax, qword [rbp - 0x10]
add rsp, 0x80
pop rbp
ret
lea rdx, str.File_is_not_open
lea rcx, [rbp - 0x10]
call fcn.140032870
mov dword [rbp - 0x50], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140042407
mov qword [rbp - 0x48], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x40], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1400b3e80]
lea rcx, [rbp - 0x58]
call fcn.140057f8c
jmp 0x14004248a
lea rdx, str.Could_not_get_length_of_file
lea rcx, [rbp - 0x18]
call fcn.140032870
mov dword [rbp - 0x30], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x140042467
mov qword [rbp - 0x28], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x20], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x38], rax
lea rdx, [0x1400b3e80]
lea rcx, [rbp - 0x38]
call fcn.140057f8c
int3
Function at 0x14004c1f0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x288
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x200], 0xfffffffffffffffe
cmp qword [rdx], 0
je 0x14004c311
mov rsi, rdx
lea rdx, str.Drives
mov rcx, rsi
call fcn.1400337f0
test eax, eax
je 0x14004c311
lea rdx, str.Network
mov rcx, rsi
call fcn.1400337f0
test eax, eax
je 0x14004c311
lea rbx, [rbp - 0x60]
mov rcx, rbx
mov rdx, rsi
call fcn.140049b90
lea r8, [0x1400c27d8]
lea rdi, [rbp + 0x1b0]
mov rcx, rbx
mov rdx, rdi
call fcn.140033930
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14004c292
mov qword [rbp - 0x60], 0
lock dec dword [rcx + 8]
jne 0x14004c292
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
cmp qword [rbp + 0x1c8], 8
jb 0x14004c2a3
mov rdi, qword [rbp + 0x1b0]
mov rcx, rdi
call fcn.14006802c
test eax, eax
je 0x14004c2c5
call fcn.140064ca4
cmp dword [rax], 0x11
jne 0x14004c31e
mov rdx, rsi
call fcn.14004c040
test al, al
je 0x14004c31e
mov rax, qword [rbp + 0x1c8]
cmp rax, 8
jb 0x14004c311
mov rcx, qword [rbp + 0x1b0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14004c30c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14004c414
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400530c4
nop
add rsp, 0x288
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.Could_not_create_directory
lea rcx, [rbp - 0x60]
call fcn.140034a30
lea rcx, [rbp - 0x60]
mov rdx, rdi
call fcn.140035000
lea rdx, [0x1400a7537]
lea rcx, [rbp - 0x60]
call fcn.1400335a0
lea rcx, [rbp + 0x1f8]
call fcn.140048850
lea rcx, [rbp - 0x60]
lea rdx, [rbp + 0x1f8]
call fcn.1400335e0
lea rcx, [rbp + 0x1f0]
lea rdx, [rbp - 0x60]
call fcn.140033280
mov rcx, qword [rbp + 0x1f8]
test rcx, rcx
je 0x14004c39d
mov qword [rbp + 0x1f8], 0
lock dec dword [rcx + 8]
jne 0x14004c39d
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rbp + 0x1a0]
test rcx, rcx
je 0x14004c3ae
call fcn.14006ce38
mov dword [rbp + 0x1d8], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1e0], 0
mov rax, qword [rbp + 0x1f0]
test rax, rax
je 0x14004c3e8
mov qword [rbp + 0x1e0], rax
lock inc dword [rax + 8]
mov qword [rbp + 0x1e8], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp + 0x1d0], rax
lea rdx, [0x1400b3e80]
lea rcx, [rbp + 0x1d0]
call fcn.140057f8c
call fcn.1400669d4
int3

Function at 0x140056d78
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140056dc2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140056dc2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140056dc2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140056dc2
cmp dword [rcx + 0x84], 0xe
jbe 0x140056dc2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140056dc4
xor al, al
add rsp, 0x28
ret
Function at 0x1400626e4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14006282c
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14006289b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006289b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006289b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006289b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006289b
cmp dword [rcx + 0x84], 0xe
jbe 0x14006289b
cmp dword [rcx + 0xf8], 0
je 0x14006289b
mov ecx, ebx
call fcn.140062764
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400629c0
nop
cmp dword [rbp + 0x20], 0
je 0x1400628e9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400627f8
int3

Function at 0x14006282c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14006282c
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14006289b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006289b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006289b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006289b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006289b
cmp dword [rcx + 0x84], 0xe
jbe 0x14006289b
cmp dword [rcx + 0xf8], 0
je 0x14006289b
mov ecx, ebx
call fcn.140062764
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400629c0
nop
cmp dword [rbp + 0x20], 0
je 0x1400628e9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400627f8
int3
Function at 0x14006580c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1400be3c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x1400aad98]
mov rbp, rcx
call fcn.140081534
xor edi, edi
test rax, rax
je 0x1400658f2
mov ebx, edi
call fcn.140064ca4
mov r14d, dword [rax]
call fcn.140064ca4
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.140084244
mov rsi, rax
test rax, rax
je 0x140065883
call fcn.140064ca4
mov dword [rax], r14d
jmp 0x1400658ad
call fcn.140064ca4
cmp dword [rax], 0x22
jne 0x1400658ea
call fcn.140064ca4
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140084244
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x1400658ea
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1400658b1
cmp rax, 3
je 0x1400658cc
mov rcx, rsi
call fcn.140065768
test al, al
je 0x1400658dd
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1400658dd
mov dil, 1
mov rcx, rbx
call fcn.14006ce38
mov al, dil
jmp 0x1400658f4
mov rcx, rbx
call fcn.14006ce38
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140054110
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret