joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014e20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rax, dword [0x1401ba2c0]
mov rdi, rdx
imul r8, rax, 0x38
mov rax, qword [0x140175020]
mov rbx, rcx
test byte [r8 + rax + 0x18], 0x20
je 0x140012c23
mov r8, qword [r8 + rax]
lea rcx, str._s_MONITOR:_s:
mov rdx, qword [section..data]
call fcn.140002310
mov r8, rbx
lea rcx, str.Copy___s__to___s__n
mov rdx, rdi
call fcn.140001fb0
mov rdx, rdi
mov rcx, rbx
call fcn.14001d3e0
test eax, eax
jne 0x140012c3d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.14001ceb0
test eax, eax
je 0x140012c51
mov rcx, rbx
call fcn.14001cc60
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140014e20
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x1020
call fcn.140156570
sub rsp, rax
mov rbx, rdx
mov rbp, rcx
mov rcx, rbx
lea rdx, [0x14017ae9c]
xor r14d, r14d
call fcn.14001ccc0
mov rdi, rax
test rax, rax
jne 0x140014e7a
mov r9, rbx
lea r8, str.Copy_failed_to_open_source_file___s__n
lea edx, [rax + 1]
mov ecx, 0x3ff
call fcn.140001480
jmp 0x140014f49
lea rdx, [0x14017aeac]
mov qword [rsp + 0x1030], rsi
mov rcx, rbp
call fcn.14001ccc0
mov rsi, rax
test rax, rax
jne 0x140014eb5
mov r9, rbp
lea r8, str.Copy_failed_to_open_destination_file___s__n
lea edx, [rax + 1]
mov ecx, 0x400
call fcn.140001480
jmp 0x140014f41
mov r9, rdi
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
jle 0x140014f0e
mov r9, rsi
mov r8d, eax
mov edx, 1
mov ebx, eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rbx
jne 0x140014f63
mov r9, rdi
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1000
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test eax, eax
jg 0x140014ed2
test eax, eax
jns 0x140014f2c
lea r8, str.Copy_failed_to_read_source_file___s__n
mov ecx, 0x401
mov r9, rbp
mov edx, 1
call fcn.140001480
mov r14d, eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, r14d
mov rsi, qword [rsp + 0x1030]
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
lea r8, str.Copy_failed_to_write_destination_file___s__n
mov ecx, 0x402
jmp 0x140014f1c

Function at 0x14001c380
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x1401b9edc], 0
jne 0x14001c3d2
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001c3bb
lea rdx, str.FALSE
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001c3c8
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14001c3c8
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1401b9edc], 1
movzx eax, byte [reloc.WS2_32.dll_accept]
add rsp, 0x28
ret
Function at 0x14001c3e0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1401b9edc], 0
mov rbx, rcx
jne 0x14001c437
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001c420
lea rdx, str.FALSE
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001c42d
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14001c42d
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1401b9edc], 1
cmp byte [reloc.WS2_32.dll_accept], 0
mov rcx, rbx
je 0x14001c466
mov r9d, 0x120
lea r8, [0x14017d8a0]
xor edx, edx
call fcn.14001fd30
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wchdir]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chdir]

Function at 0x14001c510
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x1401b9edc], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jne 0x14001c576
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001c55f
lea rdx, str.FALSE
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001c56c
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14001c56c
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1401b9edc], 1
cmp byte [reloc.WS2_32.dll_accept], 0
mov rcx, rbx
je 0x14001c59b
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_FindNextFileA]
Function at 0x14001c5c0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push rdi
push r15
sub rsp, 0x28
mov r15, rcx
mov rdi, rdx
lea rcx, str.PVIEW_DATA_BASE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14001c692
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor esi, esi
lea rdx, [rsp + 0x50]
mov rcx, rax
mov dword [rsp + 0x50], esi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [rsp + 0x50]
mov r14, rax
test ecx, ecx
jle 0x14001c685
mov qword [rsp + 0x40], rbx
sub r14, rdi
nop dword [rax + rax]
mov rcx, qword [r14 + rdi]
xor edx, edx
call fcn.14001eec0
mov rbx, rax
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x14001c635
inc rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi], rax
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x14001c651
inc r8
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x50]
inc esi
add rdi, 8
cmp esi, ecx
jl 0x14001c620
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
mov dword [r15], ecx
add rsp, 0x28
pop r15
pop rdi
ret

Function at 0x14001c6a0
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x820
cmp dword [0x1401b9edc], 0
mov rbx, rdx
mov edi, ecx
jne 0x14001c700
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001c6e9
lea rdx, str.FALSE
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001c6f6
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14001c6f6
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1401b9edc], 1
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14001c75f
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x840], 0xffffffff
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x840]
lea rcx, [rsp + 0x20]
call fcn.14001eff0
sub rbx, rax
nop dword [rax]
movzx ecx, byte [rax]
mov byte [rbx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x14001c740
mov rbx, qword [rsp + 0x830]
add rsp, 0x820
pop rdi
ret
mov rdx, rbx
mov ecx, edi
mov rbx, qword [rsp + 0x830]
add rsp, 0x820
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
Function at 0x14001c780
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x1401b9edc], 0
mov rbx, rdx
mov rdi, rcx
jne 0x14001c7de
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001c7c7
lea rdx, str.FALSE
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001c7d4
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14001c7d4
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1401b9edc], 1
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14001c804
lea rcx, [rdi + 0x2c]
xor edx, edx
call fcn.14001eff0
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140002810
lea rax, [rbx + 0x2c]
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140002810

Function at 0x14001c820
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1401b9edc], 0
mov rbx, rcx
jne 0x14001c877
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001c860
lea rdx, str.FALSE
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001c86d
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14001c86d
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1401b9edc], 1
cmp byte [reloc.WS2_32.dll_accept], 0
mov rcx, rbx
je 0x14001c951
mov r9d, 0xf3
mov qword [rsp + 0x30], rsi
lea r8, [0x14017d7c0]
xor edx, edx
call fcn.14001fd30
mov rcx, rax
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
mov rcx, rax
xor edx, edx
call fcn.14001eff0
mov rbx, rax
test rax, rax
je 0x14001c943
mov edx, 0x3f
mov rcx, rax
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x14001c943
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rbx, eax
test eax, eax
jne 0x14001c8f6
mov rsi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
mov qword [rsp + 0x38], rdi
mov edx, 2
call fcn.140001250
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor edx, edx
mov rcx, rdi
call fcn.14001eff0
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x38]
mov rax, rbx
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rsi, qword [rsp + 0x30]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
Function at 0x14001c980
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1401b9edc], 0
movsx ebx, cl
jne 0x14001c9d7
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001c9c0
lea rdx, str.FALSE
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001c9cd
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14001c9cd
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1401b9edc], 1
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14001ca00
cmp bl, 0x20
je 0x14001c9f5
sub bl, 9
cmp bl, 4
jbe 0x14001c9f5
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov ecx, ebx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]

Function at 0x14001ca90
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1401b9edc], 0
mov rbx, rcx
jne 0x14001cae7
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001cad0
lea rdx, str.FALSE
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001cadd
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14001cadd
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1401b9edc], 1
cmp byte [reloc.WS2_32.dll_accept], 0
mov rcx, rbx
je 0x14001cb16
mov r9d, 0xe5
lea r8, [0x14017d750]
xor edx, edx
call fcn.14001fd30
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]

Function at 0x14001cb30
Capabilities:
Move file
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x1401b9edc], 0
mov rbx, rdx
mov rdi, rcx
jne 0x14001cb8e
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001cb77
lea rdx, str.FALSE
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001cb84
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14001cb84
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1401b9edc], 1
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x14001cbdf
mov r9d, 0x17a
lea r8, [0x14017dae0]
xor edx, edx
mov rcx, rbx
call fcn.14001fd30
mov r9d, 0x17a
lea r8, [0x14017db50]
xor edx, edx
mov rcx, rdi
mov rbx, rax
call fcn.14001fd30
mov rcx, rax
mov rdx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
Function at 0x14001cc00
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14001cc4e
cmp byte [rcx], 0
je 0x14001cc4e
call fcn.14001c380
mov rcx, rbx
test al, al
je 0x14001cc42
mov r9d, 0xb9
lea r8, [0x14017d670]
xor edx, edx
call fcn.14001fd30
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14001cd60
Capabilities:
Create directory
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1401b9edc], 0
mov rbx, rcx
jne 0x14001cdb7
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001cda0
lea rdx, str.FALSE
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001cdad
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14001cdad
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1401b9edc], 1
xor edx, edx
mov rcx, rbx
cmp byte [reloc.WS2_32.dll_accept], dl
je 0x14001cdf0
mov r9d, 0x156
lea r8, [0x14017da60]
call fcn.14001fd30
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14001ce10
Capabilities:
Get file attributes
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1401b9edc], 0
mov rbx, rcx
jne 0x14001ce67
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001ce50
lea rdx, str.FALSE
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001ce5d
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14001ce5d
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1401b9edc], 1
cmp byte [reloc.WS2_32.dll_accept], 0
mov rcx, rbx
je 0x14001ce92
mov r9d, 0x14d
lea r8, [0x14017d9f0]
xor edx, edx
call fcn.14001fd30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x14001ce98
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
and eax, 0xf0000010
cmp eax, 0x10
sete cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x14001ceb0
Capabilities:
Get file attributes
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1401b9edc], 0
mov rbx, rcx
jne 0x14001cf07
lea rcx, str.PVIEW_UTF8_ENCODING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14001cef0
lea rdx, str.FALSE
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14001cefd
mov byte [reloc.WS2_32.dll_accept], al
jmp 0x14001cefd
lea rcx, str.PVIEW_UTF8_ENCODINGTRUE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov dword [0x1401b9edc], 1
cmp byte [reloc.WS2_32.dll_accept], 0
mov rcx, rbx
je 0x14001cf3f
mov r9d, 0x13b
lea r8, [0x14017d910]
xor edx, edx
call fcn.14001fd30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
test eax, eax
setns cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
test eax, eax
setns cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x14001e250
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x420
movsxd rax, ecx
lea rbp, [0x1401b9f10]
lea r14, [rax*8]
cmp qword [r14 + rbp], 0
jne 0x14001e4a1
call fcn.140012730
mov r8, rax
test rax, rax
jne 0x14001e296
lea eax, [r8 - 1]
jmp 0x14001e4a3
lea rdx, [rsp + 0x20]
mov rcx, r8
sub rdx, r8
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14001e2a1
mov rcx, r8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x20]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14001e2c0
lea r8, [0x14017e990]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14001e2e0
lea rcx, [rsp + 0x20]
dec rcx
lea r8, [0x14017e120]
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14001e300
mov r8, qword [r14 + r8]
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14001e310
lea rax, [rsp + 0x20]
dec rax
nop dword [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x14001e330
lea r8, str..m2u
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x14001e350
movsxd rax, dword [0x1401ba2c0]
imul rcx, rax, 0x38
mov rax, qword [0x140175020]
test byte [rcx + rax + 0x18], 0x40
je 0x14001e3a1
mov r8, qword [rcx + rax]
lea rcx, str._s_MONITOR:_s:
mov rdx, qword [section..data]
call fcn.140002310
lea rdx, [rsp + 0x20]
lea rcx, str.Loading_M2U_table___s__n
call fcn.140001fb0
lea rdx, [0x14017e804]
lea rcx, [rsp + 0x20]
call fcn.14001ccc0
mov rsi, rax
test rax, rax
je 0x14001e4a1
mov edx, 1
lea rcx, [rsp + 0x20]
mov r9, rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 0x10
jne 0x14001e489
mov rcx, qword [rsp + 0x20]
cmp rcx, qword [str.PV_M2U0100]
jne 0x14001e489
movzx eax, word [rsp + 0x28]
cmp ax, word [0x14017e9c8]
jne 0x14001e489
cmp byte [rsp + 0x2b], 2
jne 0x14001e489
movzx eax, byte [rsp + 0x2e]
mov qword [rsp + 0x430], rbx
mov qword [rsp + 0x438], rdi
movzx edi, byte [rsp + 0x2f]
shl edi, 8
add edi, eax
movzx eax, byte [rsp + 0x2d]
shl edi, 8
add edi, eax
movzx eax, byte [rsp + 0x2c]
shl edi, 8
add edi, eax
movsxd rbx, edi
mov rcx, rbx
call fcn.140001bb0
mov r9, rsi
mov qword [r14 + rbp], rax
mov r8, rbx
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rbx, qword [rsp + 0x430]
mov ecx, edi
mov rdi, qword [rsp + 0x438]
cmp rax, rcx
je 0x14001e489
mov rcx, qword [r14 + rbp]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14 + rbp], 0
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [r14 + rbp]
neg rax
sbb eax, eax
neg eax
dec eax
jmp 0x14001e4a3
xor eax, eax
lea r11, [rsp + 0x420]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14001ffb0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x38
cmp dword [0x1401ba2c0], 0
jne 0x14002011f
lea rcx, [0x14001ff50]
mov qword [rsp + 0x30], rbx
call fcn.1401567fc
lea rcx, [0x14017eca8]
call fcn.140001c50
xor ebx, ebx
mov dword [0x1401ba2c0], eax
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, [0x14017ed68]
mov ecx, eax
lea rdx, str.General_Utility_Library
call fcn.140001f70
mov dword [rsp + 0x40], ebx
mov byte [rsp + 0x40], 1
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x140020021
lea rcx, str.This_machine_is_defined_to_be_a_Little_endian_machine_but_doesnt_appear_to_be__n
call fcn.140001320
lea rcx, [0x14017ede8]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r10, rax
test rax, rax
je 0x140020102
mov r9, rbx
lea r11, [0x140000000]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [r9 + r11 + 0x17ec50]
mov rcx, r10
sub r8, r10
nop
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140020073
inc rcx
test eax, eax
jne 0x140020060
test edx, edx
je 0x1400200b3
mov r8, qword [r9 + r11 + 0x17ecb0]
mov rax, r10
sub r8, r10
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400200a3
inc rax
test ecx, ecx
jne 0x140020090
test edx, edx
je 0x1400200b3
inc ebx
add r9, 8
cmp r9, 0x58
jl 0x140020050
cmp ebx, 0xb
jne 0x1400200cc
mov r8, r10
lea rdx, str.Unknown_units___s__set_by_PVIEW_UNIT_n
lea ecx, [rbx - 0xa]
call fcn.140002870
jmp 0x140020102
movsxd rax, ebx
movss xmm0, dword [r11 + rax*4 + 0x17ed08]
movss dword [0x14017ec40], xmm0
movss xmm0, dword [r11 + rax*4 + 0x17ed38]
mov rax, qword [r11 + rax*8 + 0x17ecb0]
mov qword [0x14017ec48], rax
movss dword [0x14017ec44], xmm0
call fcn.140020e20
call fcn.140012970
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
jmp fcn.14001dcc0
add rsp, 0x38
ret
Function at 0x140022330
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x7b0
xor r12d, r12d
mov r13, rdx
mov qword [rdx], r12
mov rbx, rcx
mov r15d, r12d
lea edx, [r12 + 0x2f]
call fcn.1401570ce
test rax, rax
jne 0x1400223dc
mov qword [rsp + 0x7e0], r14
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, 1
mov esi, r12d
mov r14d, eax
mov edi, ebx
mov ebp, ebx
cmp ebx, 1
je 0x14002238e
test r14d, edi
je 0x1400223c6
movsxd rdx, ebp
mov rcx, r12
shl rdx, 3
call fcn.140002700
mov ecx, 4
mov r12, rax
call fcn.140001bb0
mov qword [rsi + r12], rax
lea ecx, [rbx + 0x60]
inc r15d
inc ebp
add rsi, 8
mov byte [rax], cl
mov word [rax + 1], 0x2f3a
mov byte [rax + 3], 0
inc ebx
add edi, edi
cmp ebx, 0x1a
jle 0x140022384
mov r14, qword [rsp + 0x7e0]
jmp 0x140022540
lea rcx, [rsp + 0x3b0]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400223f0
mov edx, 0x2f
lea rcx, [rsp + 0x3b0]
call fcn.1401570ce
mov ecx, dword [0x14017f280]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x160]
mov dword [rax + 1], ecx
lea rcx, [rsp + 0x3b0]
call fcn.14001c480
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140022441
jmp 0x140022547
mov rsi, r12
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x160]
call fcn.14001c780
mov rbx, rax
cmp byte [rax], 0x2e
jne 0x140022484
movzx eax, byte [rax + 1]
test al, al
je 0x140022511
cmp al, 0x2e
jne 0x140022484
cmp byte [rbx + 2], 0
je 0x140022511
test r15b, 0xf
jne 0x1400224a0
lea eax, [r15 + 0x10]
mov rcx, r12
movsxd rdx, eax
shl rdx, 3
call fcn.140002700
mov r12, rax
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400224a7
add rcx, 2
call fcn.140001bb0
mov rdi, rax
mov qword [rsi + r12], rax
mov rdx, rdi
inc r15d
add rsi, 8
mov rax, rbx
sub rdx, rbx
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x1400224d0
call fcn.14001c380
mov ecx, dword [rsp + 0x20]
test al, al
cmovne ecx, dword [rsp + 0x160]
test cl, 0x10
je 0x140022511
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp byte [rdi + rax + 1], 0
lea rax, [rax + 1]
jne 0x140022500
mov word [rdi + rax], gethostbyname
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r8, [rsp + 0x20]
mov rcx, rbp
lea rdx, [rsp + 0x160]
call fcn.14001c510
test al, al
jne 0x140022450
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [r13], r12
mov eax, r15d
lea r11, [rsp + 0x7b0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret