joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400027c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004410]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400027df
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400027e8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002800
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140004410]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002820
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002828
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002820
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002820
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002874
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002880
add rdx, 0x28
cmp r9, rdx
jne 0x140002860
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002890
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140004410]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400028b2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x1400028c0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400028b2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400028b2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x1400028b2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140002915
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002928
add rdx, 0x28
cmp rdx, r10
jne 0x140002900
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002937
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002947
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14000291e
test ecx, ecx
jg 0x140002930
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret

Function at 0x140002b60
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call dbg.__main
call dbg.__p__acmdln
mov rbx, qword [rax]
test rbx, rbx
jne 0x140002bab
jmp 0x140002c21
test cl, cl
je 0x140002bd8
and esi, 1
je 0x140002bc0
mov esi, 1
call sym._ismbblead
test eax, eax
je 0x140002ba7
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x140002b88
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x140002b96
test cl, cl
je 0x140002bd8
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x140002bd8
cmp al, 0x20
jle 0x140002bc8
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x140002c06
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x140004410]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp sym.WinMain
lea rbx, [0x140004060]
jmp 0x140002bd8
Function at 0x2fc4d58c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d69a0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d62c2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d635a
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d633e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d6332
cmp qword [rbp - 0x10], 0
je 0x2fc4d6332
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d62f8
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d635b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d6460
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d6488
mov eax, 0
jmp 0x2fc4d64d6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d64b1
mov eax, 0
jmp 0x2fc4d64d6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d64d1
mov eax, 0
jmp 0x2fc4d64d6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d64dc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d655a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d6551
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d6551
mov rax, qword [rbp - 8]
jmp 0x2fc4d656f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d6524
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x180001000
Capabilities:
Create process on windows

Disassembly:
xor edx, edx
lea rcx, str.calc
jmp qword [sym.imp.KERNEL32.dll_WinExec]

Function at 0x180001010
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x28
cmp edx, 1
jne 0x180001028
xor edx, edx
lea rcx, str.calc
call qword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
add rsp, 0x28
ret
Function at 0x2fc4d33d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d44b0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d3dd2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f6108]
test eax, eax
je 0x2fc4d3e6a
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f6110]
mov qword [rbp - 8], rax
jmp 0x2fc4d3e4e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d3e42
cmp qword [rbp - 0x10], 0
je 0x2fc4d3e42
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d3e08
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d3e6b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d3f70
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d3f98
mov eax, 0
jmp 0x2fc4d3fe6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d3fc1
mov eax, 0
jmp 0x2fc4d3fe6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d3fe1
mov eax, 0
jmp 0x2fc4d3fe6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d3fec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d406a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d4061
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d4061
mov rax, qword [rbp - 8]
jmp 0x2fc4d407f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d4034
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140006780
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2050
call fcn.14000adc0
sub rsp, rax
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rsp + 0x2040], rax
xor edi, edi
mov rbp, rdx
mov r15, rcx
mov esi, edi
test rdx, rdx
je 0x14000680d
lea rcx, [0x14002dc94]
call fcn.140006990
mov rcx, rbp
mov rsi, rax
call fcn.140006480
mov r14, rax
test rax, rax
je 0x1400068df
mov rdx, rax
lea rcx, [0x14002dc98]
call fcn.140016b64
mov rcx, r14
mov ebx, eax
call fcn.14001454c
test ebx, ebx
je 0x14000680d
lea rcx, str.LOADER:_Failed_to_set_the_TMP_environment_variable._n
call fcn.140002750
xor eax, eax
jmp 0x140006968
lea rdx, [rsp + 0x40]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.KERNEL32.dll_GetCurrentProcessId
mov r9d, eax
lea r8, str._MEI_d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002450
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14001781c
mov rcx, rax
mov rbx, rax
call fcn.1400078b0
test eax, eax
je 0x1400068e6
mov rcx, rbx
call fcn.14001454c
inc edi
cmp edi, 5
jl 0x140006840
test rbp, rbp
je 0x1400068df
xor r8d, r8d
lea rdx, [0x14002dc94]
xor ecx, ecx
call fcn.140007a40
test rsi, rsi
je 0x1400068c9
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.140007a40
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140016b64
mov rcx, rdi
call fcn.14001454c
mov rcx, rbx
call fcn.14001454c
mov rcx, rsi
call fcn.14001454c
xor eax, eax
jmp 0x140006968
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.14001454c
xor eax, eax
jmp 0x140006968
mov r8d, 0x1000
mov rdx, rbx
mov rcx, r15
call fcn.140007b50
mov rcx, rbx
call fcn.14001454c
test rbp, rbp
je 0x140006963
xor r8d, r8d
lea rdx, [0x14002dc94]
xor ecx, ecx
call fcn.140007a40
test rsi, rsi
je 0x14000694d
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.140007a40
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140016b64
mov rcx, rdi
call fcn.14001454c
mov rcx, rbx
call fcn.14001454c
mov rcx, rsi
jmp 0x14000695e
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.14001454c
mov eax, 1
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.14000ad90
mov rbx, qword [rsp + 0x2090]
add rsp, 0x2050
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x2fc56c010
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc56d0f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc56ca12
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc58f108]
test eax, eax
je 0x2fc56caaa
lea rax, [0x2fc58f0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc58f110]
mov qword [rbp - 8], rax
jmp 0x2fc56ca8e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc56ca82
cmp qword [rbp - 0x10], 0
je 0x2fc56ca82
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc56ca48
lea rax, [0x2fc58f0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc56caab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc56cbb0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc56cbd8
mov eax, 0
jmp 0x2fc56cc26
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc56cc01
mov eax, 0
jmp 0x2fc56cc26
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc56cc21
mov eax, 0
jmp 0x2fc56cc26
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc56cc2c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc56ccaa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc56cca1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc56cca1
mov rax, qword [rbp - 8]
jmp 0x2fc56ccbf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc56cc74
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140036ca8
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x140071020]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x14005c990]
mov rbp, rcx
call fcn.1400472f4
xor edi, edi
test rax, rax
je 0x140036d8e
mov ebx, edi
call fcn.1400398c0
mov r14d, dword [rax]
call fcn.1400398c0
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.140047240
mov rsi, rax
test rax, rax
je 0x140036d1f
call fcn.1400398c0
mov dword [rax], r14d
jmp 0x140036d49
call fcn.1400398c0
cmp dword [rax], 0x22
jne 0x140036d86
call fcn.1400398c0
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140047240
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x140036d86
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x140036d4d
cmp rax, 3
je 0x140036d68
mov rcx, rsi
call fcn.140036c04
test al, al
je 0x140036d79
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140036d79
mov dil, 1
mov rcx, rbx
call fcn.1400397d0
mov al, dil
jmp 0x140036d90
mov rcx, rbx
call fcn.1400397d0
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140030210
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140043c3c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140043a2c
Function at 0x14018d053
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sar cx, 0x2d
bswap edx
jns 0x1402f19bc
mov ebp, dword [r10]
xor ebp, r8d
call fcn.14029ee53
lea rcx, [rdi + rdi*8 + 0x24b008bb]
mov cl, byte [r10 + rdi - 0x79890e79]
jmp fcn.1401a624d
movsxd rdi, edi
add r9, rdi
call fcn.140248071
xor edx, esi
sal bp, 0xee
neg edx
movzx ecx, bx
lea r10, [rbp - 0x274ed274]
movsx r9d, bl
dec edx
xadd r9, r10
ror edx, 1
add r9d, ebx
ja 0x140159810
movsx ebp, sil
dec word [rsp + rsi*4 - 0x67e]
bswap ebx
ror r8b, 0xc1
call fcn.14017a92e
setae bpl
not r10b
not edx
bswap rcx
setbe bpl
call fcn.140134bad
xor esi, 0xf21b6f07
push r8
xor dword [rsp + r10 - 0x3f87], ecx
pop r8
inc rbx
dec rdx
neg r10
movsxd rcx, ecx
add rbp, rcx
shl r10, 0x58
sal eax, 0x5e
inc rdx
mov r10, qword [rdx + r11 - 0x58dac086]
adc ax, word [r11 + rdx - 0x58dac07e]
xadd ebx, esi
lea r11, [r11 + rsi*4 - 0x288394be]
shr rsi, 0xff
inc si
mov word [r10 + rdi*8 - 0x72988], ax
jmp rbp

Function at 0x1401a0539
Capabilities:
Encode data using base64

Disassembly:
xor dword [rsp + rsi*2 - 2], eax
ror rdx, 0xd4
pop r8
movsxd rax, eax
adc rdi, rax
call fcn.14018b1a7
xor ebx, r8d
inc rdx
xor ebx, 0xd20d7fbd
movsx ebp, cl
jmp fcn.14022ac25
sal r9b, 0xa3
ror eax, 2
mov qword [rsp + rsi - 1], r9
jmp 0x140263682
add r10b, 0xbc
lea eax, [rax + rbx + 0x604b9195]
sub byte [rsp + r9 - 0x481bb400], r9b
mov qword [rsp + rsi - 1], r8
jbe 0x1401512c2
mov r8, qword [rsp + rsi*4 - 0x114]
or rdi, 0xffffffffb2110083
movzx ebx, si
jb 0x1401adc64
movsxd rbp, ebp
adc r9, rbp
mov qword [rsp + rsi*8 - 0x230], rdi
mov qword [rsp + rsi - 0x47], r9
ret 8

Function at 0x1401d347a
Capabilities:
Encode data using base64

Disassembly:
lea rbp, [rbp + r10*2 - 0x137d23d8]
sar qword [rsp + r10 - 0x9be91f0], cl
or byte [rsp + r10*2 - 0x137d23d3], al
movsx esi, cl
and rdx, rbx
call fcn.140156eae
mov ebx, dword [rcx + r11 - 0x2739f308]
add si, dx
xor ebx, r8d
add sil, 0x94
neg byte [rsp + rsi - 0x2739f3a2]
call fcn.1402fbb91
shr word [rsp + r10*8 - 0x4df48f73], cl
mov rbx, qword [rbp + r10*8 - 0x4df48f78]
jbe 0x140142078
xor ebx, 0x773220b0
pop r10
add r10, 0xffffffffffff9924
jmp r10
mov r13d, r15d
mov rbp, qword [rsp + r14*2 - 0x10]
push rsi
mov r9, qword [rsp + r14 + 0xc]
mov r10, qword [rsp + r14*8 - 0x40]
push qword [rsp + 0x28]
popfq
mov rsi, qword [rsp + r14 + 0x24]
call fcn.1402cee9f
mov ebx, 0x972c3210
xor esi, r8d
mov ecx, ebx
mov ebp, ecx
push rbx
dec esi
xadd dword [rsp + 4], ecx
pop rbp
movzx edx, bp
neg esi
and dx, 0xe73a
movsx eax, bl
call fcn.140199554
mov rax, qword [rbp + riz]
mov ecx, 0x2739f307
lea rdx, [rcx*8 - 0x7de27a00]
inc ecx
mov edx, dword [rcx + rbp - 0x2739f300]
lea rbp, [rcx + rbp - 0x2739f2fc]
mov esi, ecx
movsx r9d, cx
push rsi
mov dword ss:[rcx + rax - 0x2739f308], edx
lea r11, [r11 + rcx*2 - 0x4e73e614]
movsx edx, r9b
jns 0x140197577
xor dword [rsp + rdx - 0x50ff8380], r9d
movzx ecx, ax
pop rsi
neg cx
call fcn.1402ef8a1
Function at 0x1401f84ad
Capabilities:
Parse pe header

Disassembly:
not ebx
inc ebx
mov qword [rsp + rdx - 0x96ed], rbp
lea rdi, [rdi - 0x196f6ec1]
xor dword [rsp + rdx*8 - 0x4b768], ebx
dec rcx
pop rbp
movsxd rbx, ebx
je 0x1401e4638
ror rdi, 0xd7
add rdx, 0xffffffffc9190d9b
adc r8, rbx
call fcn.140163116

Function at 0x1401f852a
Capabilities:
Parse pe header

Disassembly:
xor edi, ebp
xor rsi, qword [rsp + 8]
add rsi, 0x69745
jmp rsi
jb 0x1402ba4b3
mov edi, dword [rsi + r9]
neg ecx
jne 0x1401b9f29
mov word [rsp + rax*4 - 0x30000000], ax
movzx ecx, word [rax + r10 - 0xc000000]
xor cx, r8w
push r9
not cx
ror ebx, 0x8c
inc bp
call fcn.1401e0ad1
mov ebx, 0x5493d42e
lea rdx, [rbx*8 - 0xa6e554e]
mov ecx, dword [rbx + r10 - 0x5493d42e]
lea r10, [rbx + r10 - 0x5493d42a]
xor ecx, r9d
jmp 0x1402fdcad
lea rdi, [rdx + r11*2 - 0x69f391ce]
add dl, byte [r11 + rbp]
lea rbx, [rbx + r11*4 + 6]
mov word [rbx + r11*2], dx
call fcn.1402e469e
pop r8
sar r9w, 0x4c
ror ax, 0x29
movsxd rcx, ecx
adc r11, rcx
mov di, word [rax + rsi - 0xc000000]
lea rbx, [rbp + rdx*2 - 0x2164d3d1]
push rdx
xor qword [rsp + rax - 0xc000000], 0x24031cab
lea rsi, [rsi + rax - 0xbfffffe]
lea r10, [r10 + rax*4 - 0x30000002]
ja 0x1402b7ab5
mov edi, 0x19091b14
call fcn.140272925

Function at 0x140203151
Capabilities:
Parse pe header

Disassembly:
movsx eax, bpl
lea ecx, [rcx + r8 - 0x51a198a6]
call fcn.1402ff326

Function at 0x1402332a5
Capabilities:
Parse pe header

Disassembly:
xadd ax, dx
and al, 0x81
xor ebp, esi
or rcx, rax
rol ebp, 2
lea r9, [rcx*4 + 0x5bccd20]
sal dl, 0xa5
lea rdx, [r9*4 + 0x3f9aef8d]
not ebp
movzx r10d, dx
dec ebp
neg ebp
neg r9b
bswap ebp
ror ebp, 1
movsx ebx, dl
call fcn.140255a89
xor ecx, ebp
mov r10d, edi
dec ecx
neg ecx
lea ecx, [rbx + rcx - 0x6e89bce0]
call fcn.1401bad10
lea rdi, [r10*2 - 0x52594a66]
call fcn.140186ed5
mov edx, 0x8f8d380c
lea rax, [rdx + rdx*2 + 0x3ea4ab3d]
dec al
sub r8, 4
mov r9d, 0xb2a54a86
inc al
lea rcx, [r9*2 - 0x19e3d66f]
mov ebp, dword [r8]
jge 0x140157a07
xor esi, 0xce128a94
mov qword [rsp], r10
movzx ebp, r10w
pop r10
push r11
xor dword [rsp + rbp*8 - 0x4d8e0], esi
movzx ecx, bpl
movzx r11d, cl
movzx eax, bp
pop r11
jmp 0x1401fd8db

Function at 0x1402570e0
Capabilities:
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
movzx ebx, byte [rsp + 8]
rol r11b, 1
mov qword [rsp + rbx - 0x15], 0xffffffffbd390410
call fcn.14023f5b5
push 0xffffffffbc16e60b
dec word [rsp]
jge 0x1402d1770
mov rax, qword [rdi]
mov esi, 0xfbb4f59f
lea rbp, [rsi*8 - 0x13c386dc]
mov ebx, dword [rsp + 1]
mov bpl, byte [rdi + 8]
lea r8, [rbx*4 + 0x4403f436]
mov byte [rsp + 4], sil
add rdi, 0xa
inc bl
mov byte ss:[rax], bpl
mov edx, dword [r10]
xadd byte [rsp + 4], r8b
add r10, 4
dec si
pop rbx
xor edx, r9d
movzx ecx, bl
jmp 0x1401e54ff

Function at 0x14026365a
Capabilities:
Encode data using base64

Disassembly:
push rax
mov qword [rsp + rax*2 - 0x54], rbp
movsxd rbx, ebx
inc byte [rsp + rbp - 0x5f3cfe11]
call fcn.1402f0cd5
not eax
movzx esi, dl
sal rdx, 0xdd
adc r9, r9
sbb eax, esi
call fcn.1401a0539