joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400012b0
Capabilities:
Read file on windows

Disassembly:
push rsi
push r14
sub rsp, 0x28
mov rax, qword [rcx]
mov rsi, rdx
mov r14, rcx
test rax, rax
jne 0x1400012f8
add rcx, 0x78
lea rdx, [0x14002a570]
call fcn.140002de0
mov qword [r14], rax
test rax, rax
jne 0x1400012f8
lea rdx, [rsi + 0x12]
lea rcx, [0x14002a778]
call fcn.140001c50
xor eax, eax
add rsp, 0x28
pop r14
pop rsi
ret
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [r14 + 8]
mov rcx, rax
call fcn.14000eca4
test eax, eax
jns 0x14000132f
lea r8, [rsi + 0x12]
lea rdx, [0x14002a7b0]
lea rcx, [0x14002a7ec]
call fcn.140001c10
xor eax, eax
add rsp, 0x28
pop r14
pop rsi
ret
mov ecx, dword [rsi + 0xc]
mov qword [rsp + 0x20], r15
call fcn.14001415c
mov r15, rax
test rax, rax
jne 0x140001364
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, [0x14002a800]
lea rcx, [0x14002a614]
call fcn.140001c10
jmp 0x140001414
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r12
jne 0x140001395
mov r9, r15
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.140001050
test eax, eax
je 0x140001400
jmp 0x1400013f5
mov ebx, dword [rsi + 0xc]
mov rbp, r15
test rbx, rbx
je 0x140001400
mov r12d, 0x2000
nop word [rax + rax]
mov r9, qword [r14]
cmp rbx, r12
mov rdi, rbx
mov r8d, 1
cmova rdi, r12
mov rcx, rbp
mov rdx, rdi
call fcn.14000e96c
cmp rax, 1
jb 0x1400013de
add rbp, rdi
sub rbx, rdi
jne 0x1400013b0
jmp 0x140001400
lea r8, [rsi + 0x12]
lea rdx, [0x14002a6f8]
lea rcx, [0x14002a72c]
call fcn.140001c10
mov rcx, r15
call fcn.140014148
xor r15d, r15d
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x58]
mov rcx, qword [r14]
test rcx, rcx
je 0x140001428
call fcn.14000e61c
mov qword [r14], 0
mov rax, r15
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rsi
ret
Function at 0x140001440
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x30
mov rdi, rdx
mov r14, rcx
call fcn.140005880
cmp eax, 0xffffffff
jne 0x140001462
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
lea rcx, [r14 + 0x3078]
lea rbp, [rdi + 0x12]
mov qword [rsp + 0x60], r12
mov rdx, rbp
call fcn.140005ba0
mov r12, rax
test rax, rax
jne 0x1400014a7
mov r8, rbp
lea rdx, [0x14002a848]
lea rcx, [0x14002a87c]
call fcn.140001c10
lea eax, [r12 - 1]
jmp 0x140001635
mov rax, qword [r14]
test rax, rax
jne 0x1400014e0
lea rcx, [r14 + 0x78]
lea rdx, [0x14002a570]
call fcn.140002de0
mov qword [r14], rax
test rax, rax
jne 0x1400014e0
mov rdx, rbp
lea rcx, [0x14002a778]
call fcn.140001c50
mov ebx, 0xffffffff
jmp 0x140001617
mov edx, dword [rdi + 4]
xor r8d, r8d
add rdx, qword [r14 + 8]
mov rcx, rax
call fcn.14000eca4
test eax, eax
jns 0x140001516
mov r8, rbp
lea rdx, [0x14002a7b0]
lea rcx, [0x14002a7ec]
call fcn.140001c10
mov ebx, 0xffffffff
jmp 0x140001617
cmp byte [rdi + 0x10], 1
jne 0x140001534
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, r14
call fcn.140001050
mov ebx, eax
jmp 0x140001617
mov qword [rsp + 0x28], r13
xor ebx, ebx
mov r13d, 0x2000
mov qword [rsp + 0x20], r15
mov ecx, r13d
call fcn.14001415c
mov r15, rax
test rax, rax
jne 0x140001575
mov r8, rbp
lea rdx, [0x14002a6b8]
lea rcx, [0x14002a614]
call fcn.140001c10
lea ebx, [r15 - 1]
jmp 0x14000160d
mov edi, dword [rdi + 0xc]
test rdi, rdi
je 0x140001605
mov qword [rsp + 0x58], rsi
nop word [rax + rax]
mov r9, qword [r14]
cmp rdi, r13
mov rsi, rdi
mov r8d, 1
cmova rsi, r13
mov rcx, r15
mov rdx, rsi
call fcn.14000e96c
cmp rax, 1
jb 0x1400015e5
mov r9, r12
mov r8d, 1
mov rdx, rsi
mov rcx, r15
call fcn.14000f0ac
cmp rax, 1
jb 0x1400015d5
sub rdi, rsi
jne 0x140001590
jmp 0x140001600
lea rdx, [0x14002a738]
lea rcx, [0x14002a76c]
jmp 0x1400015f3
lea rdx, [0x14002a6f8]
lea rcx, [0x14002a72c]
mov r8, rbp
call fcn.140001c10
mov ebx, 0xffffffff
mov rsi, qword [rsp + 0x58]
mov rcx, r15
call fcn.140014148
mov r13, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
mov rcx, qword [r14]
test rcx, rcx
je 0x14000162b
call fcn.14000e61c
mov qword [r14], 0
mov rcx, r12
call fcn.14000e61c
mov eax, ebx
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret
Function at 0x1400017b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x14003d018]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1400017ef
lea rcx, [rbx + 0x78]
lea rdx, [0x14002a570]
call fcn.140002de0
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x140001842
mov rax, qword [0x14002ca50]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov r8d, 8
shr rax, 0x18
add al, 0xc
mov byte [rsp + 0x23], al
call fcn.140006370
mov rdi, rax
test rax, rax
je 0x140001842
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, rax
call fcn.14000eca4
test eax, eax
jns 0x14000184c
lea rdx, [0x14002a888]
lea rcx, [0x14002a7ec]
call fcn.140001c10
mov eax, 0xffffffff
jmp 0x1400019b3
mov r9, qword [rbx]
lea rcx, [rbx + 0x20]
mov edx, 0x58
lea r8d, [rdx - 0x57]
call fcn.14000e96c
cmp rax, 1
jae 0x140001884
lea rdx, [0x14002a8b0]
lea rcx, [0x14002a72c]
call fcn.140001c10
mov eax, 0xffffffff
jmp 0x1400019b3
mov ecx, dword [rbx + 0x28]
xor r8d, r8d
mov eax, dword [rbx + 0x2c]
bswap eax
mov dword [rbx + 0x2c], eax
mov eax, dword [rbx + 0x30]
bswap eax
mov dword [rbx + 0x30], eax
mov eax, dword [rbx + 0x34]
bswap ecx
mov ecx, ecx
sub rdi, rcx
mov dword [rbx + 0x28], ecx
bswap eax
add rdi, 0x58
mov dword [rbx + 0x34], eax
mov qword [rbx + 8], rdi
xor edi, edi
mov dword [rbx + 0x507c], edi
mov dword [0x14003dc84], eax
mov edx, dword [rbx + 0x2c]
add rdx, qword [rbx + 8]
mov rcx, qword [rbx]
call fcn.14000eca4
movsxd rcx, dword [rbx + 0x30]
call fcn.14001415c
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1400018fe
lea rdx, [0x14002a8c8]
lea rcx, [0x14002a614]
call fcn.140001c10
lea eax, [rdi - 1]
jmp 0x1400019b3
movsxd rdx, dword [rbx + 0x30]
mov r8d, 1
mov r9, qword [rbx]
mov rcx, rax
call fcn.14000e96c
cmp rax, 1
jae 0x140001925
lea rdx, [0x14002a8f0]
jmp 0x14000186e
movsxd rax, dword [rbx + 0x30]
add rax, qword [rbx + 0x10]
mov rcx, qword [rbx]
mov qword [rbx + 0x18], rax
call fcn.14000e6e0
test eax, eax
je 0x140001950
lea rcx, [0x14002a910]
call fcn.140001c50
mov eax, 0xffffffff
jmp 0x1400019b3
mov rax, qword [rbx + 0x10]
cmp rax, qword [rbx + 0x18]
jae 0x1400019a1
nop word [rax + rax]
mov ecx, dword [rax + 4]
mov edx, dword [rax]
bswap ecx
mov dword [rax + 4], ecx
mov ecx, dword [rax + 8]
bswap ecx
mov dword [rax + 8], ecx
mov ecx, dword [rax + 0xc]
bswap ecx
mov dword [rax + 0xc], ecx
bswap edx
mov dword [rax], edx
movsxd rcx, edx
add rcx, rax
mov rax, rcx
cmp rcx, qword [rbx + 0x10]
jb 0x140001995
cmp rcx, qword [rbx + 0x18]
jb 0x140001960
jmp 0x1400019a1
lea rcx, [0x14002a550]
call fcn.140001c50
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400019b1
call fcn.14000e61c
mov qword [rbx], rdi
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14000a110
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400055e0
Capabilities:
Create directory
Query environment variable

Disassembly:
push rdi
mov eax, 0x4030
call fcn.14000a140
sub rsp, rax
mov rax, qword [0x14003d018]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.140006dc0
mov rdi, rax
test rax, rax
jne 0x140005629
lea rcx, [0x14002ca60]
call fcn.140001c50
xor eax, eax
jmp 0x140005738
mov r8d, 0x1000
mov qword [rsp + 0x4048], rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
mov ebx, eax
call fcn.140014148
test ebx, ebx
jne 0x140005666
lea rcx, [0x14002caa0]
call fcn.140001c50
xor eax, eax
jmp 0x140005730
lea rcx, [rsp + 0x20]
call fcn.140006970
test eax, eax
je 0x140005680
lea rcx, [rsp + 0x20]
call fcn.1400160b8
jmp 0x140005692
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
xor ecx, ecx
call fcn.1400153c8
mov rbx, rax
test rax, rax
jne 0x1400056ad
lea rcx, [0x14002caf0]
call fcn.140001c50
xor eax, eax
jmp 0x140005730
xor edx, edx
lea rcx, [rsp + 0x2020]
mov r8d, 0x2000
call fcn.14000b890
mov edx, 0x5c
mov rcx, rbx
call fcn.14000b704
mov rdi, rax
test rax, rax
je 0x140005722
nop word [rax + rax]
mov r8, rdi
lea rcx, [rsp + 0x2020]
sub r8, rbx
mov rdx, rbx
sar r8, 1
inc r8
call fcn.14001613c
xor edx, edx
lea rcx, [rsp + 0x2020]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x5c
lea rcx, [rdi + 2]
call fcn.14000b704
mov rdi, rax
test rax, rax
jne 0x1400056e0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, rbx
mov rbx, qword [rsp + 0x4048]
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.14000a110
add rsp, 0x4030
pop rdi
ret

Function at 0x140005760
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1030
call fcn.14000a140
sub rsp, rax
mov rax, qword [0x14003d018]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rbx, rdx
mov rdi, r8
lea rdx, [0x14002a570]
call fcn.140002de0
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call fcn.140005ba0
xor edi, edi
mov rbx, rax
test rsi, rsi
je 0x140005853
mov rcx, rsi
test rax, rax
je 0x14000585b
call fcn.14000e6b4
test eax, eax
jne 0x14000583f
nop word [rax + rax]
mov r9, rsi
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1000
call fcn.14000e96c
test rax, rax
jne 0x1400057fe
mov rcx, rsi
call fcn.14000e6e0
test eax, eax
je 0x140005824
mov rcx, rsi
jmp 0x140005835
mov r9, rbx
lea rcx, [rsp + 0x20]
mov r8, rax
mov edx, 1
call fcn.14000f0ac
test rax, rax
je 0x140005832
mov rcx, rbx
call fcn.14000e6e0
test eax, eax
jne 0x140005832
mov rcx, rsi
call fcn.14000e6b4
test eax, eax
je 0x1400057d0
jmp 0x14000583f
mov rcx, rbx
call fcn.1400174fc
mov edi, 0xffffffff
mov rcx, rsi
call fcn.14000e61c
mov rcx, rbx
call fcn.14000e61c
mov eax, edi
jmp 0x140005865
test rbx, rbx
je 0x140005860
mov rcx, rbx
call fcn.14000e61c
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000a110
add rsp, 0x1030
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400058e0
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2050
call fcn.14000a140
sub rsp, rax
mov rax, qword [0x14003d018]
xor rax, rsp
mov qword [rsp + 0x2040], rax
xor edi, edi
mov rbp, rdx
mov r15, rcx
mov esi, edi
test rdx, rdx
je 0x14000596d
lea rcx, [0x14002cb34]
call fcn.140005af0
mov rcx, rbp
mov rsi, rax
call fcn.1400055e0
mov r14, rax
test rax, rax
je 0x140005a3f
mov rdx, rax
lea rcx, [0x14002cb38]
call fcn.140016828
mov rcx, r14
mov ebx, eax
call fcn.140014148
test ebx, ebx
je 0x14000596d
lea rcx, [0x14002cb40]
call fcn.140001c50
xor eax, eax
jmp 0x140005ac8
lea rdx, [rsp + 0x40]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.KERNEL32.dll_GetCurrentProcessId
mov r9d, eax
lea r8, [0x14002cb78]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140006620
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400174e0
mov rcx, rax
mov rbx, rax
call fcn.140006a70
test eax, eax
je 0x140005a46
mov rcx, rbx
call fcn.140014148
inc edi
cmp edi, 5
jl 0x1400059a0
test rbp, rbp
je 0x140005a3f
xor r8d, r8d
lea rdx, [0x14002cb34]
xor ecx, ecx
call fcn.140006dc0
test rsi, rsi
je 0x140005a29
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.140006dc0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140016828
mov rcx, rdi
call fcn.140014148
mov rcx, rbx
call fcn.140014148
mov rcx, rsi
call fcn.140014148
xor eax, eax
jmp 0x140005ac8
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.140014148
xor eax, eax
jmp 0x140005ac8
mov r8d, 0x1000
mov rdx, rbx
mov rcx, r15
call fcn.140006ed0
mov rcx, rbx
call fcn.140014148
test rbp, rbp
je 0x140005ac3
xor r8d, r8d
lea rdx, [0x14002cb34]
xor ecx, ecx
call fcn.140006dc0
test rsi, rsi
je 0x140005aad
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.140006dc0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140016828
mov rcx, rdi
call fcn.140014148
mov rcx, rbx
call fcn.140014148
mov rcx, rsi
jmp 0x140005abe
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.140014148
mov eax, 1
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.14000a110
mov rbx, qword [rsp + 0x2090]
add rsp, 0x2050
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006140
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2110
call fcn.14000a140
sub rsp, rax
mov rax, qword [0x14003d018]
xor rax, rsp
mov qword [rsp + 0x2100], rax
mov rdx, rcx
xor edi, edi
lea rcx, [rsp + 0x100]
mov dword [rsp + 0x50], edi
mov r8d, 0x1000
call fcn.140006dc0
mov ebx, 1
lea rcx, [0x1400055c0]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x58], 0x18
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], ebx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xorps xmm0, xmm0
mov qword [rsp + 0x98], rdi
xor ecx, ecx
movdqa xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0xcc], 0x101
mov word [rsp + 0xd0], bx
call fcn.140014320
mov rcx, rax
call fcn.1400192f4
mov ecx, eax
call fcn.14001706c
cmp rax, 0xffffffffffffffff
mov ecx, ebx
cmove rax, rdi
mov qword [rsp + 0xe0], rax
call fcn.140014320
mov rcx, rax
call fcn.1400192f4
mov ecx, eax
call fcn.14001706c
cmp rax, 0xffffffffffffffff
lea ecx, [rdi + 2]
cmove rax, rdi
mov qword [rsp + 0xe8], rax
call fcn.140014320
mov rcx, rax
call fcn.1400192f4
mov ecx, eax
call fcn.14001706c
cmp rax, 0xffffffffffffffff
cmove rax, rdi
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x100]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400062c0
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x50]
jmp 0x1400062d8
lea rdx, [0x14002cc70]
lea rcx, [0x14002cc90]
call fcn.140001cb0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2100]
xor rcx, rsp
call fcn.14000a110
mov rbx, qword [rsp + 0x2128]
add rsp, 0x2110
pop rdi
ret
Function at 0x140006a70
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2070
call fcn.14000a140
sub rsp, rax
mov rax, qword [0x14003d018]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor ebx, ebx
mov qword [rsp + 0x38], 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
mov rdi, rcx
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x38]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140006b41
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140006af8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140006b41
mov edx, dword [rsp + 0x30]
mov ecx, 1
call fcn.140014140
mov rbx, rax
test rax, rax
je 0x140006b41
mov r9d, dword [rsp + 0x30]
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov r8, rbx
mov edx, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140006b41
mov rcx, qword [rbx]
lea rdx, [rsp + 0x40]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov rcx, rbx
call fcn.140014148
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x140006b5a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
lea r9, [0x14002cea0]
test rbx, rbx
lea r8, [0x14002ceb0]
mov edx, 0x1000
lea rcx, [rsp + 0x60]
cmovne r9, rbx
call fcn.140006770
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r9d, r9d
mov dword [rsp + 0x48], 0x18
lea r8, [rsp + 0x50]
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x60]
lea edx, [r9 + 1]
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x140006bce
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
sbb eax, eax
neg eax
dec eax
jmp 0x140006bd3
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.14000a110
mov rbx, qword [rsp + 0x2088]
add rsp, 0x2070
pop rdi
ret
Function at 0x140001b30
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x250
lea rsi, fcn.1400e5320
movq xmm0, rsi
mov r9, qword [r8 + 8]
mov r8, qword [r8]
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x28], r9
mov rax, rcx
lea rcx, [rsp + 0x30]
movq xmm1, rbx
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x20]
punpcklqdq xmm0, xmm1
movaps xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x14021b930]
movaps xmmword [rsp + 0x40], xmm0
call rax
mov rdi, qword [str._N_r_]
mov ecx, 2
call rdi
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.msvcrt.dll_fputc
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x30], rsi
cmp rcx, rbx
je 0x140001bd5
call fcn.14020b170
nop
add rsp, 0x250
pop rbx
pop rsi
pop rdi
ret
Function at 0x140003fe0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x698
lea rdi, fcn.1400e5320
xor r9d, r9d
movq xmm0, rdi
mov r10, qword [rdx]
mov r11, qword [rdx + 8]
mov rdx, qword [r8 + 8]
mov rax, qword [r8]
lea rbp, [rsp + 0x80]
lea r13, [rsp + 0x40]
mov qword [rsp + 0x38], rdx
mov rbx, rcx
movq xmm1, rbp
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x30]
mov rdx, r13
punpcklqdq xmm0, xmm1
mov qword [rsp + 0x40], r10
movaps xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x14021b930]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x30], rax
movaps xmmword [rsp + 0x70], xmm0
call fcn.1400e4930
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__fileno]
mov esi, eax
mov ecx, eax
call qword [sym.imp.msvcrt.dll__isatty]
mov rcx, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
test eax, eax
jne 0x1400040c0
mov r9, rbx
mov r8, r12
mov edx, 1
call sub.msvcrt.dll_fwrite
cmp rax, r12
jb 0x14020c088
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
cmp rcx, rbp
je 0x1400040ac
call fcn.14020b170
nop
add rsp, 0x698
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rsp + 0x40], rcx
mov rdx, r13
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x48], r12
call fcn.140001c90
mov rax, qword [rsp + 0x290]
mov dword [rsp + 0x5c], 0
mov ecx, esi
mov r12, qword [rsp + 0x288]
lea rbx, [rax - 1]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
lea r9, [rsp + 0x5c]
mov r8d, ebx
mov rdx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
test eax, eax
je 0x14020c047
lea rax, fcn.1400e5480
mov rcx, qword [rsp + 0x288]
mov qword [rsp + 0x280], rax
lea rax, [rsp + 0x2a0]
cmp rcx, rax
je 0x140004097
call fcn.14020b170
jmp 0x140004097
mov ecx, 0x10
call fcn.14020b270
lea rdx, str.failed_to_write_to_console
mov rcx, rax
mov rsi, rax
call fcn.1401d2470
lea rax, [0x140239740]
lea r8, [0x140001850]
mov rcx, rsi
mov qword [rsi], rax
lea rdx, [0x140234ea0]
call fcn.14020b7f0
mov rbx, rax
jmp 0x14020c0de
mov ecx, 0x18
call fcn.14020b270
mov rsi, rax
call qword [sym.imp.msvcrt.dll__errno]
mov edx, dword [rax]
lea rbx, str.cannot_write_to_file
mov r8, r13
mov rcx, rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0x14
call fcn.1400e5290
lea r8, [0x140001890]
lea rdx, [0x140234ec0]
mov rcx, rsi
call fcn.14020b7f0
mov rcx, rsi
mov rbx, rax
call fcn.14020b4d0
lea rax, fcn.1400e5480
mov rcx, qword [rsp + 0x288]
mov qword [rsp + 0x280], rax
lea rax, [rsp + 0x2a0]
cmp rcx, rax
je 0x14020c107
call fcn.14020b170
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rdi
cmp rcx, rbp
je 0x14020c11b
call fcn.14020b170
mov rcx, rbx
call fcn.1400c9b90
mov rbx, rax
jmp 0x14020c107
Function at 0x14000c950
Capabilities:
Set console window title

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rax, [0x140239950]
mov qword [rcx], rax
mov rbx, rcx
mov rdi, rdx
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], 0
mov ecx, 1
call fcn.1400698f0
cmp eax, 0xe
je 0x14000c9a0
cmp eax, 7
je 0x14000c9a0
mov rax, qword [0x140232f20]
mov byte [rax], 0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov ecx, 0x158
call fcn.14020b1c0
mov qword [rbx + 8], rax
mov rsi, rax
call fcn.1400849e0
xor r9d, r9d
mov r8d, 1
mov rdx, rsi
mov rcx, rax
call fcn.140079e80
test eax, eax
js 0x14000c98b
mov rcx, qword [rbx + 8]
xor edx, edx
call fcn.14007b0a0
mov rax, qword [rbx + 8]
mov ecx, 0xfffffff6
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000ca0f
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
jne 0x14000ca48
cmp byte [rdi], 0
je 0x14000c995
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140016960
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14000c995
call fcn.14020b160
jmp 0x14000c995
mov edx, dword [rsp + 0x20]
mov rcx, rbx
and edx, 0xffffffbf
mov dword [rsp + 0x20], edx
or dl, 0x80
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
jmp 0x14000ca0f
Function at 0x140043ce0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
lea r10, [0x1402737e0]
mov r8, rcx
lea r9, [rcx + rdx]
test rdx, rdx
jne 0x140043d48
jmp 0x140043d70
lea rdx, [rax + 1]
mov eax, dword [r10 + rax*4]
add r8, 1
mov qword [0x1402741a0], rdx
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
shr rax, 0x18
mov byte [r8 - 1], al
cmp r9, r8
je 0x140043d70
mov rax, qword [0x1402741a0]
cmp rax, 0x26f
jbe 0x140043d00
mov rcx, r10
call fcn.1401deb40
mov rax, qword [0x1402741a0]
jmp 0x140043d00
add rsp, 0x28
ret

Function at 0x14005edd0
Capabilities:
Check for time delay via gettickcount
Get system information on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x58
xor ebx, ebx
nop dword [rax + rax]
mov ecx, 0x5f5e100
call sub.msvcrt.dll_malloc
mov rcx, rax
test rax, rax
je 0x14005ee00
call fcn.1400d4858
nop word [rax + rax]
mov ecx, 0x5f5e100
mov esi, ebx
add ebx, 1
call sub.msvcrt.dll_malloc
mov rcx, rax
test rax, rax
je 0x14005ee1c
call fcn.1400d4858
imul eax, ebx, 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555554
jbe 0x14005ee00
lea ebx, [rsi + 2]
cmp ebx, 7
jle 0x14005ede0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x40], 1
jle 0x14005ee69
mov rsi, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rsi
mov ecx, 0x3e8
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call rsi
sub eax, ebx
cmp eax, 0x3e7
jg 0x14005ee75
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
ret
xor ebx, ebx
nop word [rax + rax]
mov ecx, 0x5f5e100
call sub.msvcrt.dll_malloc
mov rcx, rax
test rax, rax
je 0x14005eea0
call fcn.1400d4858
nop word [rax + rax]
mov ecx, 0x5f5e100
mov esi, ebx
add ebx, 1
call sub.msvcrt.dll_malloc
mov rcx, rax
test rax, rax
je 0x14005eebc
call fcn.1400d4858
imul eax, ebx, 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555554
jbe 0x14005eea0
lea ebx, [rsi + 2]
cmp ebx, 7
jle 0x14005ee80
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
ret