joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1408991fb
Capabilities:
Allocate thread local storage
Packed with generic packer

Disassembly:
mov rsi, qword [rsp + 0x40]
mov rsi, qword [rsi]
jl 0x140890a14
jle fcn.1409918c8
setl r10b
setae r10b
xor r10b, r10b
lea rsi, [rsi - 0x53e250c6]
movsx r10, r10b
test r10, 0x6a2c09b2
mov qword [rsp + r10*4 + 8], r10
jge 0x14094e30c
mov qword [rsp + r10*2 + 0x40], r10
movzx r10w, r10b
lea r10, [r10*8 + 0x1ab4a087]
jl 0x1409702ce
jae 0x1409c1919
mov rcx, qword [rsp + r15*2 + 8]
mov rcx, qword [rcx + r15*8]
not dil
setno dil
xor r15d, 0x662fa4bc
call fcn.1408a4252

Function at 0x14089a9b0
Capabilities:
Terminate process

Disassembly:
xchg qword [rsp + 0x10], rax
call fcn.1409a3bdf

Function at 0x1408a2330
Capabilities:
Allocate thread local storage

Disassembly:
mov rcx, r14
or word [rsp + rcx - 0x5fbfb384], cx
ja 0x1409a8e3c
mov rcx, qword [rsp + 0x38]
call fcn.14089d89c
int1
mov eax, 0xc0000005
movabs r14, 0x5324ea237224ce29
xor byte [rsp + 0x18], 0x9f
jg 0x140957fdc
mov r14, qword [rsp + 0x20]
call fcn.14088ef86
add qword [rsp + 0x10], 0xffffffffffef5dcf
or dword [rsp + 8], 0x46adb39c
mov rsi, qword [rsp + 8]
test sil, sil
push rcx
push r14
mov rsi, qword [rsp + rsi - 0x5fbfb37c]
mov rsi, qword [rsi]
mov r14, qword [rsp + 0x18]
js 0x14088fd6f
xchg qword [rsp + 0x68], rdi
mov rsi, qword [rsp + 0x10]
jb 0x1409809c6
neg ecx
xor word [rsp + 8], 0x61bf
jae 0x1408936eb
in al, dx
movabs eax, dword [0xcccccccccccccca7]
int3
xchg qword [rsp + 0x18], rsi
push rsi
movabs rsi, 0xd13f7e32fe228a8d
mov rsi, qword [rsp]
mov qword [rsp + 0x18], rsi
mov qword [rsp], 0x5bbeb239
pushfq
sub byte [rsp + 8], 0x39
js 0x140978512
je 0x1408a2330

Function at 0x140901678
Capabilities:
Encode data using xor

Disassembly:
jl 0x1408a3902
sbb byte [rdx - 0x7f], cl
test byte [rsi + riz*8 - 1], cl
int1
invalid
add qword [rsp + r9*2 - 0x310e001a], 0xffffffffbf65251a
add qword [rsp + r9 - 0x1886ffe9], 0xffffffffbf75ca35
shr qword [rsp + r9 - 0x18870031], 0x7c
setb r9b
add r9b, byte [rsp + r9*2 - 0x310dffaf]
mov r9, qword [rsp + r9 - 0x1886ffc8]
jbe 0x1409b6003
xchg edx, eax
rol dword [rsi + 2], 0x8c
push rcx
add dl, dh
invalid
jge 0x1408a38dc
invalid
movabs rax, 0x85a127ab7d35b699
or al, 0xad
not rsi
add al, 0x33
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + rsi*4 - 0x65f44234]
xor rsi, 0x2fa2fb82
jo 0x1408a38df
add qword [rsp + rsi*2 - 0x6dbfd5fe], 0xffffffffbf6444a5
call fcn.140894261

Function at 0x140905869
Capabilities:
Allocate thread local storage
Packed with generic packer

Disassembly:
test r8w, 0xd214
movabs rsi, 0x601203bbf9958587
call fcn.1409698e7
Function at 0x140905883
Capabilities:
Allocate thread local storage
Packed with generic packer

Disassembly:
jb 0x140972fc6
test r13, 0xfffffffff72763b0
mov qword [rsp + 0x30], rax
movzx r15w, r15b
push r14
push rdx
jae 0x140980268
bswap r13
shl r13w, 0x9f
lea r15, [rdx + rdx - 0x42a18264]
lea rax, [rax + rdx - 0x7ffd2c84]
call fcn.14098bb9a
push rcx
pushfq
movabs rcx, 0xed927795828bc6a6
lea rcx, [rcx*8 + 0x527cb1e]
call fcn.14099bcee
add r15b, 0x19
nop
xor r15d, 0x680ba602
mov rax, r15
shr r13b, 0xf6
mov rdx, r15
test r13w, 0xbb0
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
jle 0x140908cc9
in eax, 0x25
invalid

Function at 0x14090da07
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1409425f2
mov rdx, qword [rsp + 0x30]
jbe 0x140952c1c
ja 0x1409b9de1
jo 0x1408973b1
jl 0x1409697f0
sub edx, r15d
xchg qword [rsp + rsi*8 - 0x165b0], rdi
mov rsi, qword [rsp + 0x18]
add dl, dh
cmovae dx, word [rsp + 0x2c]
jno 0x1408a518e
cmp byte [rsp + 0x28], 0x85
jno 0x1409ba4b4
add dword [rsp + 0x28], 0x7d014a9a
movsx r15w, r15b
mov r15, qword [rsp + 0x48]
and dword [rsp + 0x40], 0x1e0ed2b6
call fcn.140897431

Function at 0x14091563b
Capabilities:
Terminate process

Disassembly:
lea rbp, [rbp - 0x9707cf5]
cmp r10d, dword [rsp + 0x19]
push r15
mov r14w, r11w
not r10w
push rdx
xchg qword [rsp + 0x40], rbp
mov r14, qword [rsp + 0x38]
not dword [rsp + 0x28]
jle 0x14089bc65

Function at 0x140915aa7
Capabilities:
Encode data using xor

Disassembly:
pop rbx
push r13
pushfq
movabs r13, 0x1b956cae022650bb
and r13w, 0x8a17
jne 0x140960448

Function at 0x14091715b
Capabilities:
Allocate thread local storage
Packed with generic packer

Disassembly:
not edi
sub r8w, 0x711b
movabs r8, 0x86ad52a279a8169e
mov qword [rsp + rdi - 0x4c4c4db7], r10
lea rax, [rax - 0x3a7eeff9]
push rdx
not rdi
sub r8b, r8b

Function at 0x140925b8e
Capabilities:
Encode data using base64

Disassembly:
movabs rax, 0x250617022480be2e
push rbp
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp qword [rsp], 0xffffffff8c03fa09
jae fcn.140894624
test rsi, rsi
je 0x14089145e
jg 0x14094c3ff
or rcx, 0xffffffffb4a3ad8c
movabs rbp, 0x709af2b880a3af86
cmp ecx, ebp
mov qword [rsp + 0x30], rbp
push r8
lea rax, [rax - 0x5bff7f70]
jae 0x140914846

Function at 0x14093b5a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
jae 0x140958537
add al, bl
loopne 0x14093b60d
fsub st(0)
mov esi, 0xc301c98d
mov esi, 0xc301c98d
or byte [rsp + riz*8], ah
xor rax, 0x20c50113
adc al, 0xec
sub eax, 0x4875c907
je 0x14093b5a5
push rax
test dword [rbx - 0x655778af], edi
insb byte [rdi], dx
sal ch, cl
sar dword [rcx + 0x3236eede], 1
out dx, al
cmp al, 0xf3
lodsb al, byte [rsi]
xchg esp, eax
sub dh, byte [rcx]
scasb al, byte [rdi]
invalid
xor dword [rsi - 0x74], esp
invalid
mov rbp, qword [rsp + 0x28]
call fcn.14089995b
invalid

Function at 0x1409429ee
Capabilities:
Allocate thread local storage
Packed with generic packer

Disassembly:
mov rbp, qword [rsp + 0x20]
push r11
lea rbp, [rbp + 1]
pushfq
movabs r11, 0x1610c921e5bc4d11
or r11, r11
call fcn.1409b4049
Function at 0x14097dc94
Capabilities:
Allocate thread local storage
Packed with generic packer

Disassembly:
neg qword [rsp + 0x18]
jae 0x14001b4a0
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x50]
ret
xor di, dx
test di, di
xchg qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x20]
call fcn.140920631
lea r14, [rcx*8 - 0x256d1fa]
push 0x3e9c7802
mov qword [rsp + 0x58], rax
neg dword [rsp]
shl rbp, 0xdf
sub r14b, bpl
call fcn.14095df5d
mov r11, qword [rsp + 0x48]
setae byte [rsp + 0x30]
shl dword [rsp + 0x30], 0xb6
shr word [rsp + 0x18], 0x53
jns 0x14092fbb6
js 0x140961fb1
je 0x14097cc05
and r8b, 7
mov qword [rsp + 0x18], r8
lea rdi, [rdi + 0x5929cb95]
mov word [rsp + 0x18], 0xf0be
push r14
call fcn.1409a1f14

Function at 0x14099eb4e
Capabilities:
Terminate process

Disassembly:
mov rbp, qword [rsp + 0x68]
jo fcn.140944492
not rdi
sub esi, dword [rsp + 0x4a]
shl r11d, 0xb1
je 0x14091561e
sets dil
mov rsi, qword [rsp + r11 - 0x22ffffb0]
add dil, byte [rsp + r11 - 0x22ffffb1]
jae 0x14096460e
shl sil, 0x81
movabs rsi, 0x9bf331d4b164610
mov esi, 0x6e82a986
not si
sub si, 0x419c
jg 0x14088f705
call section.klamdkla_1
jno 0x14088f280

Function at 0x1409a8470
Capabilities:
Encode data using xor

Disassembly:
push rsi
lea rbx, [rbx + r15*2 - 0x2007a2b]
xor r15w, r15w
call fcn.14098cb5c
push r15
pushfq
movabs r15, 0x33013f80163dc7a0
not r15w
xor esp, dword [rsi + 0x41]
not edi
and r15b, 0xb1
and r15b, 0x83
mov rbx, qword [rsp + 0x20]
and r15w, 1
bswap r15d
jne 0x14089615e
jrcxz 0x1409a847c
invalid

Function at 0x1409a9934
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 0x28]
call fcn.1409697a0
mov r11, qword [rsp + 0x10]
mov qword [rsp + 0x10], rax
jbe 0x14088f4e6
and rdx, 0xffffffffdfa9c400
pop rax
pushfq
push r10
movabs r10, 0xf29fdf0203159085
test r10b, 0x10
xchg qword [rsp + 0x10], rax
call fcn.1408a26ae
xor dx, 0x213b
jge 0x140927028
lea rbp, [rbp - 0x4754d6c6]

Function at 0x1413f3898
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
sal bl, 0x38
bt r10d, 0x95
xor r11b, 0x9a
mov qword [rsp + 0x10], rdi
xor edi, edi
movzx ebx, r8b
bswap r8
dec r10d
mov r11, rcx
movzx r8d, r9w
not r10w
inc r10b
mov r8, rdi
xchg r9w, r10w
nop
dec r9b
movzx r9, cx
movzx r9d, byte [r11]
movzx r10, r11w
cmovb r10w, r14w
movzx r10d, byte [rdx]
jmp 0x1413f38ed
inc r11
jmp 0x1413f38f5
inc rdx
clc
cmp spl, 0x3e
test bl, bl
je 0x1413f391f
mov ecx, r8d
mov eax, 0xa3cf417
stc
rol eax, cl
add al, r8b
xor r9b, al
jmp 0x1413f391b
inc r8
cmc
test r9b, r9b
jmp 0x1413f3927
je 0x1413f393b
cmp r9b, r10b
jmp 0x1413f3935
je 0x1413f38d7
cmp r9b, r10b
jae 0x1413f395d
or eax, 0xffffffff
cmovns ebx, edx
mov rbx, qword [rsp + 8]
not di
mov rdi, qword [rsp + 0x10]
jmp 0x1413f395c
ret
mov rbx, qword [rsp + 8]
mov al, ch
movsx eax, r11w
bswap ax
seta dil
jmp 0x1413f3979
mov eax, edi
jmp 0x1413f3980
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
push rsi
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor r9, r9
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021

Function at 0x14054438c
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xf71d02f5
xor byte [rbx + rsi*2], al
invalid
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x40]
call fcn.140b8152e
pop rbp
cli
mov ebx, 0xf028022b
outsb dx, byte [rsi]
pop rbp
add ah, ah
sbb eax, 0x2342eba6
sbb edi, dword [rdi - 0x63cada21]
leave
sbb al, 0x14
sub dl, byte [rbx]
mov edi, 0x224276d0
jrcxz 0x140544349
fiadd word [rdi + 6]
int1
and bpl, r12b
wait
invalid
Function at 0x1400015e6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14009b6f0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x130
mov rax, qword [0x1401199f8]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rbp, r8
mov rsi, rdx
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14009b724
cmp qword [rcx + 0x18], 8
mov r14, rcx
jb 0x14009b73b
mov r14, qword [rcx]
mov rdi, qword [rcx + 0x10]
mov qword [rsp + 0x150], r15
test rbx, rbx
je 0x14009b7c0
cmp rbp, rdi
jae 0x14009b7c0
mov r15d, 0x100
lea rcx, [rsp + 0x20]
mov r8d, r15d
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsi + rbx*2]
mov rcx, rsi
cmp rsi, rdx
je 0x14009b78c
movzx eax, word [rcx]
cmp ax, r15w
jae 0x14009b7f7
movzx eax, al
add rcx, 2
mov byte [rsp + rax + 0x20], 1
cmp rcx, rdx
jne 0x14009b772
lea rdx, [r14 + rdi*2]
lea rcx, [r14 + rbp*2]
cmp rcx, rdx
jae 0x14009b7c0
nop dword [rax]
movzx eax, word [rcx]
cmp ax, r15w
jae 0x14009b7b7
movzx eax, ax
cmp byte [rsp + rax + 0x20], 0
jne 0x14009b843
add rcx, 2
cmp rcx, rdx
jb 0x14009b7a0
mov rax, 0xffffffffffffffff
mov r15, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140001c17
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea r9, [r14 + rdi*2]
lea rdx, [r14 + rbp*2]
cmp rdx, r9
jae 0x14009b82c
mov rcx, rbx
mov rax, rsi
test rbx, rbx
je 0x14009b823
movzx r8d, word [rdx]
cmp word [rax], r8w
je 0x14009b838
add rax, 2
sub rcx, 1
jne 0x14009b813
add rdx, 2
cmp rdx, r9
jb 0x14009b804
mov rdx, 0xffffffffffffffff
mov rax, rdx
jmp 0x14009b7c7
sub rdx, r14
sar rdx, 1
mov rax, rdx
jmp 0x14009b7c7
sub rcx, r14
sar rcx, 1
mov rax, rcx
jmp 0x14009b7c7
Function at 0x14000160e
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400a0000
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, r8
mov r14, rdx
mov ecx, dword [0x140119b18]
cmp ecx, 0xffffffff
je 0x1400a003f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x1400a005c
call fcn.1400a1d90
mov ecx, dword [0x140119b18]
cmp ecx, 0xffffffff
jne 0x1400a0053
xor esi, esi
jmp 0x1400a005c
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rax, qword [r14]
mov qword [rsp + 0x38], rax
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x40], rcx
mov edx, 1
test rcx, rcx
je 0x1400a0088
mov eax, edx
lock xadd dword [rcx + 8], eax
test rcx, rcx
je 0x1400a0088
lock xadd dword [rcx + 8], edx
mov qword [rsp + 0x68], rbp
mov edi, 0xffffffff
test rcx, rcx
je 0x1400a00c9
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400a00c9
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400a00c9
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x88], rbp
lea rdx, [rsp + 0x70]
lea rcx, [rsi + 0x28]
call fcn.1400031d4
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsi + 0x28]
call fcn.1400013f7
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400a0175
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400a0175
mov rbx, qword [rsp + 0x80]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400a0175
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rbx, qword [r14 + 8]
test rbx, rbx
je 0x1400a01a7
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400a01a7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400a01a7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
nop
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001613
Capabilities:
Check if file exists

Disassembly:
jmp 0x140098950
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov rdi, rcx
mov rcx, rdx
mov rbx, r8
mov rsi, rdx
jb 0x140098973
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14d, eax
cmp eax, 0xffffffff
jne 0x1400989a0
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140097450
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x40], rbp
xor ebp, ebp
test rbx, rbx
je 0x1400989b7
mov dword [rbx], ebp
call fcn.140002c2a
mov qword [rbx + 8], rax
mov rcx, rsi
bt r14d, 0xa
jae 0x1400989e6
call fcn.140096c60
mov edx, r14d
mov rcx, rsi
movzx ebx, al
call fcn.1400971d0
mov ecx, 4
test bl, bl
jne 0x1400989e2
mov ecx, 9
mov dword [rdi], ecx
jmp 0x140098a12
mov edx, r14d
mov ebx, r14d
call fcn.1400971d0
and ebx, 0x10
je 0x1400989fc
mov ecx, dword [rsp + 0x48]
jmp 0x140098a02
mov ecx, eax
mov eax, dword [rsp + 0x48]
test ebx, ebx
setne bpl
add ebp, 2
test ebx, ebx
mov dword [rdi], ebp
cmove eax, ecx
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov dword [rdi + 4], eax
mov rax, rdi
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140001672
Capabilities:
Check if file exists

Disassembly:
jmp 0x1400987c0
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x1400987f6
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x140098816
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140097450
jmp 0x1400988db
mov r15d, 3
bt ebp, 0xa
jae 0x1400988aa
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140098833
mov rcx, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x140098877
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140097450
nop
jmp 0x1400988db
mov rcx, rdi
call fcn.140096c60
test al, al
jne 0x1400988a1
mov edx, ebp
mov rcx, rdi
call fcn.1400971d0
mov dword [rsi], 9
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400988db
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1400988bf
mov dword [r14], 0
call fcn.140002c2a
mov qword [r14 + 8], rax
mov edx, ebp
mov rcx, rdi
call fcn.1400971d0
test bpl, 0x10
jne 0x1400988d5
mov r15d, 2
mov dword [rsi], r15d
mov dword [rsi + 4], eax
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140001848
Capabilities:
Get memory capacity

Disassembly:
jmp 0x14005f910
mov r11, rsp
sub rsp, 0x98
mov rax, qword [0x1401199f8]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rcx, [r11 - 0x58]
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov dword [rsp + 0x40], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x14005f981
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140001c17
add rsp, 0x98
ret
lea rdx, str.GlobalMemoryStatusEx_failed
lea rcx, [rsp + 0x20]
call fcn.1400016b3
lea rdx, [0x140117a08]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x140001929
Capabilities:
Terminate process

Disassembly:
jmp 0x14008f958
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x140001b3b
Capabilities:
Get common file path

Disassembly:
jmp 0x14005c200
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1401199f8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdi, rcx
mov qword [rbp - 0x31], rcx
xor r13d, r13d
mov dword [rbp - 0x49], r13d
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 7
mov word [rcx], r13w
mov dword [rbp - 0x49], 1
mov qword [rbp - 0x41], r13
lea r9, [rbp - 0x41]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400e22b0]
call sub.SHELL32.dll_SHGetKnownFolderPath
movdqa xmm0, xmmword [0x1400d1c80]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r13w
mov rdx, qword [rbp - 0x41]
test rdx, rdx
je 0x14005c2be
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14005c2a0
lea rcx, [rbp - 9]
call fcn.140001f5f
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea r14, [rbp - 9]
mov rsi, qword [rbp - 9]
mov r15, qword [rbp + 0xf]
cmp r15, 8
cmovae r14, rsi
mov r12, qword [rbp + 7]
cmp r12, 8
jae 0x14005c2ee
movups xmm6, xmmword [r14]
movups xmmword [rbp - 0x29], xmm6
mov qword [rbp - 0x11], 7
jmp 0x14005c332
mov rbx, r12
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x29]
call fcn.14000187f
mov qword [rbp - 0x29], rax
lea r8, [r12*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x11], rbx
movups xmm6, xmmword [rbp - 0x29]
mov qword [rbp - 0x19], r12
lea rax, [rbp - 0x29]
cmp rdi, rax
je 0x14005c364
mov rcx, rdi
call fcn.140001325
movups xmmword [rdi], xmm6
movups xmm0, xmmword [rbp - 0x19]
movups xmmword [rdi + 0x10], xmm0
movdqa xmm1, xmmword [0x1400d1c80]
movdqu xmmword [rbp - 0x19], xmm1
mov word [rbp - 0x29], r13w
lea rcx, [rbp - 0x29]
call fcn.140001325
nop
cmp r15, 8
jb 0x14005c3ac
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14005c3a4
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005c3a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140001785
mov rax, rdi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140001c17
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140002275
Capabilities:
Check if file exists

Disassembly:
jmp 0x140097c10
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rbp, rdx
mov dword [rsp + 0x20], esi
mov rdi, rcx
call fcn.140002c2a
cmp qword [rdi + 0x18], 8
mov rcx, rdi
mov qword [rsp + 0x28], rax
jb 0x140097c47
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140097c6e
lea r8, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140097450
mov esi, dword [rsp + 0x20]
mov ebx, dword [rax]
jmp 0x140097ca7
call fcn.140002c2a
bt ebx, 0xa
jae 0x140097c9e
mov rcx, rdi
call fcn.140096c60
test al, al
je 0x140097c97
test bl, 0x10
mov eax, VariantTimeToDosDateTime
mov ebx, 4
cmovne ebx, eax
jmp 0x140097ca7
mov ebx, 9
jmp 0x140097cab
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
test ebx, ebx
je 0x140097cad
xor esi, esi
lea r9, str.boost::filesystem::remove
mov r8, rbp
mov rdx, rdi
mov ecx, esi
call fcn.1400962d0
test al, al
je 0x140097cc9
xor al, al
jmp 0x140097cd6
mov r8, rbp
mov edx, ebx
mov rcx, rdi
call fcn.140098240
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140002cca
Capabilities:
Write file on windows

Disassembly:
jmp 0x140037460
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401199f8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14003750c
cmp byte [rcx + 0x71], 0
je 0x14003750c
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400374cd
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400374d1
sub eax, 1
je 0x1400374d5
sub eax, 2
je 0x14003750c
xor al, al
jmp 0x14003750e
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140037503
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400374cd
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14003750e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001c17
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret