joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013f48
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140013f78
xor eax, eax
jmp 0x14001403b
mov rbp, rbx
cmp word [rax], si
je 0x140013f9d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140013f84
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140013f80
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140013e68
movsxd r14, eax
test eax, eax
jne 0x140013fdb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140013f71
mov rcx, r14
call fcn.1400106fc
mov rdi, rax
test rax, rax
jne 0x140013ff4
xor ecx, ecx
call fcn.14000fa84
jmp 0x140013fd0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140013e68
test eax, eax
jne 0x140014025
mov rcx, rdi
call fcn.14000fa84
jmp 0x14001402f
xor ecx, ecx
call fcn.14000fa84
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001835c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140018372
mov al, 1
jmp 0x1400183d2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140018383
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400183d0
mov ecx, dword [rcx + 0x18]
nop
call fcn.140014868
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400183d0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400183d0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400183d0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400183d2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140019410
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140012f38
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14001949a
cmp byte [rbp - 0x21], r15b
je 0x140019495
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400194d0
call fcn.14000fcd4
test eax, eax
jne 0x1400194bc
cmp byte [rbp - 0x21], r15b
je 0x1400194b4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400194d0
cmp byte [rbp - 0x21], r15b
je 0x1400194cd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140012518
test eax, eax
jne 0x140019570
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140012f38
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14001950f
cmp byte [rbp - 0x21], r15b
je 0x140019544
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140019544
call fcn.14000fcd4
test eax, eax
jne 0x140019530
cmp byte [rbp - 0x21], r15b
je 0x140019529
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140019544
cmp byte [rbp - 0x21], r15b
je 0x140019541
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140012518
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140019570
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140019573
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140019581
mov rcx, rdi
call fcn.14000fa84
cmp byte [rbp + 0x3f], r15b
je 0x140019590
mov rcx, qword [rbp + 0x27]
call fcn.14000fa84
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14001bb00
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001bb28
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001bb28
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001290
Capabilities:
Encode data using xor

Disassembly:
add r14, rdi
xor rbx, rbx
rol r11, 0xf
mov rdi, qword [rsp + rbx]
xorps xmm1, xmm4
mov rax, 0x6b1d2372
xorps xmm3, xmm1
mov r10, 0x6b3903ff
subps xmm0, xmm1
xor rax, r10
test r13, r11
sub rdi, rax
shr rbx, 0x37
mov r12, 0x3cca0b84
add r15, r14
mov rax, 0x3ce502c4
addps xmm7, xmm0
xor r12, rax
sub r10, rbx
add r12, rdi
add rax, rbx
mov rbx, qword [r12]
cmp r14, rax
mov r15, 0x71908f05
xor r13, r14
mov rax, 0x71a02acd
and r10, 0xe
xor r15, rax
inc r10
add r15, rdi
inc rsi
mov r12, 0x7f8f935c
and r10, r11
mov rdi, 0x7f8f3c59
add r14, 0x62
xor r12, rdi
add r13, r10
mov r13, 0xa9
xchg rsi, r14
mov rax, 0xad
lea rsi, [rsi + 0xc8]
xor r13, rax
dec r14
push r15
rol r11, 0x28
push r12
inc rax
push rbx
inc r10
sub rsp, 0x20
xor r10, r14
mov rcx, r15
cmp r10, r11
mov rdx, r12
inc r14
mov r8, r13
nop
lea r9, [rsp + 0x48]
push rax
pop r15
call rbx
or r13, rax
add rsp, 0x20
shr rdi, 0x3a
pop r15
or r14, r11
pop rax
rol rsi, 0x20
pop rbx
nop
xor r14, r14
addps xmm9, xmm14
lea rsi, [rbx + r14]
mov r13, r10
mov dil, byte [rsi]
push r10
pop r12
xor dil, 0xb5
inc r10
add dil, 0x82
and r11, 0x40
mov byte [rsi], dil
xorps xmm10, xmm8
inc r14
pop r12
mov r11, r12
push r11
cmp r14, rax
mov r10, 0xc2
jne 0x140001391
test r13, r11
mov r10, 0x80
xchg r11, r13
mov rdi, 0xa0
shl r13, 0x14
shl ebp, 0x14
xor r10, rdi
and r13, 0xd2
push rbx
test rdi, r14
sub rsp, 0x20
xorps xmm10, xmm3
mov rcx, rbx
shr rsi, 0x1b
mov rdx, rax
xorps xmm4, xmm7
mov r8, r10
subps xmm1, xmm7
lea r9, [rsp + 0x48]
shl r10, 0xd
call r15
mfence
add rsp, 0x20
shl r10, 0x2e
ret
Function at 0x140026e30
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x858
mov rsi, rdx
mov rax, qword [0x1402f4538]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov qword [rdx + 8], 0
lea rdi, [rsp + 0x50]
xor r13d, r13d
lea rbp, [0x140243ca0]
mov rbx, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r14, [rsp + 0x38]
jmp 0x140026e95
inc r13
cmp r13, 3
sete al
or al, r15b
cmp al, 1
je 0x140026f5c
mov r15, qword [rbp + r13*8]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0x400
mov r12d, 0x400
xor r8d, r8d
nop word [rax + rax]
cmp r8, r12
je 0x140026eea
ja 0x140026ee2
cmp qword [rsp + 0x48], r12
jae 0x140026ee2
mov r9d, 2
mov rcx, r14
mov rdx, rdi
mov r8, r12
call fcn.14001cd30
mov qword [rsp + 0x40], r12
mov r8, r12
mov rdx, qword [rsp + 0x38]
mov rcx, r15
call rbx
test eax, eax
je 0x140026f40
mov r12d, eax
mov r8, qword [rsp + 0x40]
cmp r8, r12
jb 0x140026ec0
mov qword [rsp + 0x40], r12
mov r8, qword [rsp + 0x38]
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x28]
mov edx, 0xfde9
mov r9, r12
call fcn.14002ce10
cmp dword [rsp + 0x28], 0
sete r15b
jmp 0x140026f43
xor r15d, r15d
mov rcx, qword [rsp + 0x38]
cmp rcx, rdi
je 0x140026e80
call qword [0x1402f0bf8]
jmp 0x140026e80
test r15b, r15b
je 0x140026f7a
mov rcx, rsi
xor edx, edx
call fcn.140025480
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.140027de0
jmp 0x140026fbf
mov rax, qword [rsi + 8]
lea r8, [rax + 7]
cmp qword [rsi + 0x10], r8
jae 0x140026f9e
lea rdx, [rsi + 0x18]
mov r9d, 1
mov rcx, rsi
call fcn.14001cd30
mov rax, qword [rsi + 8]
mov rcx, qword [rsi]
mov dword [rcx + rax + 3], 0x706d6554
mov dword [rcx + rax], 0x545c3a43
add qword [rsi + 8], 7
mov rcx, rsi
xor edx, edx
call fcn.140025480
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.140241350
nop
add rsp, 0x858
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140027f80
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x258
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402f4538]
xor rax, rsp
mov qword [rsp + 0x250], rax
lea rdi, [rsp + 0x48]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0x104
mov eax, 0x104
xor ecx, ecx
mov r12, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r14, [rsp + 0x30]
nop word [rax + rax]
mov r15d, eax
cmp rcx, r15
je 0x14002800d
ja 0x140028005
cmp qword [rsp + 0x40], r15
jae 0x140028005
mov r9d, 2
mov rcx, r14
mov rdx, rdi
mov r8, r15
call fcn.14001cd30
mov qword [rsp + 0x38], r15
mov rcx, r15
mov rdx, qword [rsp + 0x30]
call r12
test eax, eax
je 0x140028085
mov r9d, eax
mov rcx, qword [rsp + 0x38]
cmp rcx, r9
jb 0x140027fe0
mov qword [rsp + 0x38], r9
mov r8, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov edx, 0xfde9
call fcn.14002ce10
cmp dword [rsi], 0
jne 0x140028095
mov rcx, rbx
xor edx, edx
call fcn.140025480
mov dword [rsi], 0
mov eax, dword [0x1402f5d00]
mov ecx, dword [0x1402f6910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400280c9
lea rax, str._4__
mov qword [rsi + 8], rax
jmp 0x140028095
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.1400715f0
mov rcx, qword [rsp + 0x30]
cmp rcx, rdi
je 0x1400280a5
call qword [0x1402f0bf8]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140241350
mov rax, rsi
add rsp, 0x258
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x1402f5d00]
call fcn.14024119c
cmp dword [0x1402f5d00], 0xffffffff
jne 0x140028078
lea rcx, [fcn.1400039b0]
call fcn.140241370
lea rcx, [0x1402f5d00]
call fcn.140241204
jmp 0x140028078

Function at 0x140028530
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x140
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x1402f4538]
xor rax, rsp
mov qword [rsp + 0x138], rax
lea rdi, [rsp + 0x38]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0x80
lea r8, [rsp + 0x20]
mov r9d, 0xf8
call fcn.140029010
cmp dword [rsi], 0
jne 0x1400285d7
mov rcx, qword [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400285a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140028605
test bl, bl
je 0x140028605
mov dword [rsi], 0
mov eax, dword [0x1402f5d00]
mov ecx, dword [0x1402f6910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140028611
lea rax, str._4__
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0x20]
cmp rcx, rdi
je 0x1400285e7
call qword [0x1402f0bf8]
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140241350
mov rax, rsi
add rsp, 0x140
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
mov edx, eax
call fcn.1400715f0
jmp 0x1400285d7
lea rcx, [0x1402f5d00]
call fcn.14024119c
cmp dword [0x1402f5d00], 0xffffffff
jne 0x1400285cc
lea rcx, [fcn.1400039b0]
call fcn.140241370
lea rcx, [0x1402f5d00]
call fcn.140241204
jmp 0x1400285cc
Function at 0x140028ed0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov qword [rsp + 0x30], rcx
mov rax, qword [0x1402f4538]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [r8 + 8]
lea rcx, [r8 + 0x18]
mov qword [rsp + 0x38], rcx
mov r12d, 0xffffffff
cmp r9, r12
cmovb r12, r9
lea r13, [rsp + 0x5c]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov rsi, rax
nop word cs:[rax + rax]
lea rbp, [rsi + rbx]
cmp rax, rbp
je 0x140028f5b
ja 0x140028f57
cmp qword [rdi + 0x10], rbp
jae 0x140028f57
mov r9d, 1
mov rcx, rdi
mov rdx, qword [rsp + 0x38]
mov r8, rbp
call fcn.14001cd30
mov qword [rdi + 8], rbp
mov rdx, qword [rdi]
add rdx, rsi
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x20], 0
mov rcx, r14
mov r8d, r12d
mov r9, r13
call r15
test eax, eax
jne 0x140028fa0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x140028fa0
cmp eax, 0x26
jne 0x140028fe4
nop word cs:[rax + rax]
mov eax, dword [rsp + 0x5c]
test rax, rax
je 0x140028fb5
add rsi, rax
mov rax, qword [rdi + 8]
jmp 0x140028f30
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov qword [rbx], rax
mov qword [rdi + 8], rsi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140241350
mov rax, rbx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x40]
mov rcx, rbx
mov edx, eax
call fcn.1400715f0
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.14001a120
mov rax, qword [rsp + 0x50]
jmp 0x140028fb7
Function at 0x1400295f0
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
sub rsp, 0x148
mov rsi, rcx
mov rax, qword [0x1402f4538]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0x80
lea r8, [rsp + 0x28]
mov r9d, 0x104
call fcn.140029010
cmp dword [rsi], 0
jne 0x140029692
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x140029682
mov dword [rsi], 0
mov eax, dword [0x1402f5d00]
mov ecx, dword [0x1402f6910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400296bf
lea rax, str._4__
mov qword [rsi + 8], rax
jmp 0x140029692
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.1400715f0
mov rcx, qword [rsp + 0x28]
cmp rcx, rdi
je 0x1400296a2
call qword [0x1402f0bf8]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140241350
mov rax, rsi
add rsp, 0x148
pop rdi
pop rsi
ret
lea rcx, [0x1402f5d00]
call fcn.14024119c
cmp dword [0x1402f5d00], 0xffffffff
jne 0x140029675
lea rcx, [fcn.1400039b0]
call fcn.140241370
lea rcx, [0x1402f5d00]
call fcn.140241204
jmp 0x140029675
Function at 0x140029b20
Capabilities:
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x1402f4538]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0x80
mov r15d, 0x80
mov r13, qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
lea r12, [rsp + 0x28]
nop word cs:[rax + rax]
mov rcx, qword [rsp + 0x30]
cmp rcx, r15
je 0x140029bdb
ja 0x140029bd6
cmp qword [rsp + 0x38], r15
jae 0x140029bbc
mov r9d, 2
mov rcx, r12
mov rdx, rdi
mov r8, r15
call fcn.14001cd30
mov rcx, qword [rsp + 0x30]
mov r8, r15
sub r8, rcx
je 0x140029bd6
add rcx, rcx
add rcx, qword [rsp + 0x28]
add r8, r8
xor edx, edx
call fcn.140242c10
mov qword [rsp + 0x30], r15
mov rdx, qword [rsp + 0x28]
mov rcx, qword [r14]
mov r8d, r15d
call r13
test eax, eax
jne 0x140029c06
call rbp
add r15, r15
cmp eax, 0x7a
je 0x140029b90
mov rcx, rsi
mov edx, eax
call fcn.1400715f0
jmp 0x140029c96
mov rax, qword [rsp + 0x30]
lea r8, [rax + 1]
cmp r8, qword [rsp + 0x38]
ja 0x140029cfd
mov rcx, qword [rsp + 0x28]
mov word [rcx + rax*2], 0
inc qword [rsp + 0x30]
mov r14, qword [rsp + 0x28]
mov rcx, r14
call qword [0x1402f0c78]
mov qword [rsp + 0x30], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea ecx, [rax - 4]
cmp ecx, 3
jb 0x140029c5d
cmp eax, 2
je 0x140029c5d
cmp eax, 3
jne 0x140029ccd
mov byte [rbx], 1
jmp 0x140029c60
mov byte [rbx], 0
mov dword [rsi], 0
mov eax, dword [0x1402f5d00]
mov ecx, dword [0x1402f6910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140029d1a
lea rax, str._4__
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0x28]
cmp rcx, rdi
je 0x140029ca6
call qword [0x1402f0bf8]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140241350
mov rax, rsi
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x1402f5d04]
mov ecx, dword [0x1402f6910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140029d50
mov dword [rsi], 2
lea rax, str.P4__
jmp 0x140029c92
lea rcx, [rsp + 0x28]
mov r9d, 2
mov rdx, rdi
call fcn.14001cd30
mov rax, qword [rsp + 0x30]
jmp 0x140029c1a
lea rcx, [0x1402f5d00]
call fcn.14024119c
cmp dword [0x1402f5d00], 0xffffffff
jne 0x140029c8b
lea rcx, [fcn.1400039b0]
call fcn.140241370
lea rcx, [0x1402f5d00]
call fcn.140241204
jmp 0x140029c8b
lea rcx, [0x1402f5d04]
call fcn.14024119c
cmp dword [0x1402f5d04], 0xffffffff
jne 0x140029cee
lea rcx, [fcn.1400039b0]
call fcn.140241370
lea rcx, [0x1402f5d04]
call fcn.140241204
jmp 0x140029cee
Function at 0x14002a9b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x140
mov edi, r8d
mov rsi, rcx
mov rax, qword [0x1402f4538]
xor rax, rsp
mov qword [rsp + 0x138], rax
lea rbx, [rsp + 0x38]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0x80
lea r8, [rsp + 0x20]
mov r9d, 0x104
call fcn.140029010
cmp dword [rsi], 0
jne 0x14002ab0a
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002aa2b
cmp edi, 1
jne 0x14002aa48
mov ecx, eax
and ecx, 1
je 0x14002aa48
mov dword [rsi], 0
jmp 0x14002aa5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 4]
cmp ecx, 0xfffffffd
ja 0x14002aa98
mov rcx, rsi
mov edx, eax
call fcn.1400715f0
jmp 0x14002ab0a
mov dword [rsi], 0
cmp edi, 2
jne 0x14002aada
and eax, 0x10
je 0x14002aada
mov qword [rsi + 8], 0
mov eax, dword [0x1402f5d04]
mov ecx, dword [0x1402f6910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002ab38
mov dword [rsi], 0xd
lea rax, str.P4__
jmp 0x14002ab06
mov dword [rsi], 0
mov qword [rsi + 8], 0
mov eax, dword [0x1402f5d04]
mov ecx, dword [0x1402f6910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002ab6e
mov dword [rsi], 2
lea rax, str.P4__
jmp 0x14002ab06
mov eax, dword [0x1402f5d00]
mov ecx, dword [0x1402f6910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002aba4
lea rax, str._4__
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0x20]
cmp rcx, rbx
je 0x14002ab1a
call qword [0x1402f0bf8]
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140241350
mov rax, rsi
add rsp, 0x140
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1402f5d04]
call fcn.14024119c
cmp dword [0x1402f5d04], 0xffffffff
jne 0x14002aa89
lea rcx, [fcn.1400039b0]
call fcn.140241370
lea rcx, [0x1402f5d04]
call fcn.140241204
jmp 0x14002aa89
lea rcx, [0x1402f5d04]
call fcn.14024119c
cmp dword [0x1402f5d04], 0xffffffff
jne 0x14002aacb
lea rcx, [fcn.1400039b0]
call fcn.140241370
lea rcx, [0x1402f5d04]
call fcn.140241204
jmp 0x14002aacb
lea rcx, [0x1402f5d00]
call fcn.14024119c
cmp dword [0x1402f5d00], 0xffffffff
jne 0x14002aaff
lea rcx, [fcn.1400039b0]
call fcn.140241370
lea rcx, [0x1402f5d00]
call fcn.140241204
jmp 0x14002aaff
Function at 0x14002acb0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, r8
mov rsi, rcx
mov rax, qword [0x1402f4538]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp rdx, 0xffffffffffffffff
je case.default.0x14002acf2
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, eax
lea rcx, [0x14002aec0]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002ae6e
pxor xmm0, xmm0
movdqu xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
movabs rax, 0xffff00000009
jmp 0x14002ae1c
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je case.default.0x14002acf2
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x48]
movdqu xmm0, xmmword [rsp + 0x2c]
pshufd xmm0, xmm0, 0xb1
pshufd xmm1, xmmword [rsp + 0x20], 0x50
movdqu xmmword [rdi], xmm0
movq xmm0, qword [rsp + 0x40]
pand xmm1, xmmword [0x140243b90]
pxor xmm2, xmm2
pcmpeqd xmm2, xmm1
movdqa xmm1, xmm2
pandn xmm1, xmmword [0x140243ba0]
pand xmm2, xmmword [0x140243bb0]
por xmm2, xmm1
punpcklqdq xmm0, xmm2
movdqu xmmword [rdi + 0x10], xmm0
mov dword [rdi + 0x20], ecx
mov dword [rdi + 0x24], eax
mov rax, qword [rsp + 0x4c]
mov qword [rdi + 0x28], rax
jmp 0x14002ae25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
pxor xmm0, xmm0
cmp ecx, 2
jne 0x14002adc8
movdqu xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov dword [rdi + 0x18], 1
jmp 0x14002ae62
cmp eax, 0x20
jne 0x14002ae59
movdqu xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov dword [rdi + 0x18], 9
jmp 0x14002ae62
pxor xmm0, xmm0
movdqu xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
movabs rax, 0xffff00000006
jmp 0x14002ae1c
pxor xmm0, xmm0
movdqu xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
movabs rax, 0xffff00000007
mov qword [rdi + 0x18], rax
movdqu xmmword [rdi + 0x20], xmm0
mov dword [rsi], 0
mov eax, dword [0x1402f5d00]
mov ecx, dword [0x1402f6910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002ae90
lea rax, str._4__
mov qword [rsi + 8], rax
jmp 0x14002ae78
movdqu xmmword [rdi + 0xc], xmm0
movdqu xmmword [rdi], xmm0
mov dword [rdi + 0x1c], 0xffff
movdqu xmmword [rdi + 0x20], xmm0
mov rcx, rsi
mov edx, eax
call fcn.1400715f0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140241350
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1402f5d00]
call fcn.14024119c
cmp dword [0x1402f5d00], 0xffffffff
jne 0x14002ae4c
lea rcx, [fcn.1400039b0]
call fcn.140241370
lea rcx, [0x1402f5d00]
call fcn.140241204
jmp 0x14002ae4c
Function at 0x14002b260
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x1402f4538]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14002b2dc
mov rax, qword [rsi]
cmp rax, 2
jae 0x14002b2f1
mov dil, 1
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test dil, dil
jne 0x14002b2d2
cmp dword [rsi + 0x18], 1
jne 0x14002b2d2
mov eax, dword [0x1402f5ef4]
mov ecx, dword [0x1402f6910]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002b32d
cmp byte [0x1402f5ef1], 0
je 0x14002b2d2
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140241350
nop
add rsp, 0x48
pop rdi
pop rsi
ret
movzx edx, word [rcx]
cmp edx, 0x5a4d
jne 0x14002b28a
cmp rax, 0x40
jb 0x14002b28a
mov edx, dword [rcx + 0x3c]
cmp rax, rdx
cmovb rdx, rax
sub rax, rdx
cmp rax, 4
jb 0x14002b28a
cmp dword [rcx + rdx], 0x4550
jne 0x14002b28a
xor edi, edi
jmp 0x14002b28d
lea rcx, [0x1402f5ef4]
call fcn.14024119c
cmp dword [0x1402f5ef4], 0xffffffff
jne 0x14002b2bf
movaps xmm0, xmmword [0x140243bc0]
movaps xmmword [rsp + 0x30], xmm0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.14006dc00
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14002df90
mov byte [0x1402f5ef1], al
lea rcx, [0x1402f5ef4]
call fcn.140241204
jmp 0x14002b2bf

Function at 0x14002b390
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x1402f4538]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140241350
mov eax, esi
add rsp, 0x60
pop rsi
ret