joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d2880
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x290
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x2a0], rcx
mov eax, dword [0x00693980]
add eax, dword [0x00694124]
mov ecx, dword [0x00694304]
add ecx, dword [0x00695884]
cmp eax, ecx
jle 0x5d28b7
call fcn.004096f0
mov eax, dword [0x006933e0]
add eax, 1
cmp dword [0x006933e0], eax
jne 0x5d28e0
mov ecx, dword [0x006931f8]
mov edx, dword [0x006933e8]
mov r8d, dword [0x006934d8]
call sub.kernel32.dll_GetDiskFreeSpaceExW
nop
mov rcx, qword [rbp + 0x2a0]
call fcn.00410050
mov rcx, rax
lea rdx, [rbp + 0x30]
call qword [0x006a8d00]
mov qword [rbp + 0x288], rax
cmp qword [rbp + 0x288], 0xffffffffffffffff
jne 0x5d2918
mov qword [rbp + 0x280], 0
jmp 0x5d2943
nop
mov eax, dword [rbp + 0x4c]
mov qword [rbp + 0x280], rax
shl qword [rbp + 0x280], 0x20
mov eax, dword [rbp + 0x50]
add qword [rbp + 0x280], rax
nop
mov rcx, qword [rbp + 0x288]
call qword [0x006a8d08]
mov eax, dword [0x00693980]
add eax, dword [0x00694124]
mov ecx, dword [0x00694304]
add ecx, dword [0x00695884]
cmp eax, ecx
jle 0x5d2964
call fcn.004096f0
mov eax, dword [0x00695834]
cmp eax, dword [0x006958e8]
je 0x5d297e
mov eax, dword [0x00695834]
mov dword [0x006958e8], eax
mov eax, dword [0x006932a4]
add eax, 1
cmp dword [0x006932a4], eax
jne 0x5d29b8
mov ecx, dword [0x006958e0]
mov edx, dword [0x00695c18]
mov r8d, dword [0x00693298]
mov r9d, dword [0x006933f4]
call sub.advapi32.dll_CryptDuplicateKey
jmp 0x5d29b8
mov rax, qword [rbp + 0x280]
lea rsp, [rbp + 0x290]
pop rbp
ret
Function at 0x5d9dd0
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov dword [rbp + 0x70], ecx
mov eax, dword [0x00694128]
add eax, dword [0x00695814]
mov ecx, dword [0x00695894]
add ecx, dword [0x00695ba8]
cmp eax, ecx
jle 0x5d9e01
call fcn.004096f0
call fcn.005cdc30
call fcn.005d11a0
mov byte [rbp + 0x4f], 0
mov eax, dword [0x00693424]
add eax, 1
cmp dword [0x00693424], eax
jne 0x5d9e49
mov ecx, dword [0x006958f0]
mov edx, dword [0x00696580]
mov r8d, dword [0x00693288]
mov r9d, dword [0x00693418]
mov eax, dword [0x006935ec]
mov dword [rsp + 0x20], eax
call sub.kernel32.dll_LockFile
mov eax, dword [0x006961a8]
mov dword [0x00695d74], eax
cmp dword [rbp + 0x70], 0
je 0x5da040
nop
call qword [0x006a8d20]
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x70]
cmp rax, 0xffffffffffffffff
je 0x5d9fe3
mov eax, dword [rbp + 0x48]
cmp eax, dword [rbp + 0x70]
je 0x5d9fe3
mov eax, dword [0x006961a8]
mov dword [0x00695d74], eax
mov eax, dword [0x0069594c]
cmp eax, dword [0x00695c04]
je 0x5d9ea8
mov eax, dword [0x0069594c]
mov dword [0x00695c04], eax
mov dword [0x006931b0], 0x2ef
mov eax, dword [0x006931b0]
sub eax, 0x19a
mov dword [0x006932d0], eax
mov eax, dword [0x006942a0]
add eax, dword [0x00695808]
mov ecx, dword [0x006958e4]
add ecx, dword [0x00695bdc]
cmp eax, ecx
jle 0x5d9ee5
call fcn.004096f0
mov dword [0x006931fc], 0x315
mov eax, dword [0x006931fc]
sub eax, 0x19d
mov dword [0x006933ac], eax
mov eax, dword [0x006962e0]
mov dword [0x00695d98], eax
mov dword [0x00693208], 0x2fa
mov eax, dword [0x00693208]
sub eax, 0x19f
mov dword [0x006932e4], eax
mov eax, dword [0x006965c4]
add eax, dword [0x0069328c]
mov ecx, dword [0x006933dc]
add ecx, dword [0x006934f4]
cmp eax, ecx
jle 0x5d9f4f
mov dword [0x006965c4], 0xfe
mov eax, dword [0x006962fc]
mov dword [0x00696168], eax
mov ecx, 1
xor edx, edx
mov r8d, dword [rbp + 0x70]
call qword [0x006a8bd0]
mov dword [rbp + 0x44], eax
mov ebx, dword [rbp + 0x44]
mov rcx, rbx
xor edx, edx
call qword [0x006a8d28]
mov rcx, rbx
or edx, 0xffffffff
call qword [0x006a8b98]
mov rcx, rbx
call qword [0x006a8bc0]
mov byte [rbp + 0x4f], 1
jmp 0x5d9fe3
mov eax, dword [0x006965bc]
mov dword [0x006961a0], eax
mov eax, dword [0x00695814]
add eax, dword [0x006958f0]
mov ecx, dword [0x00695be8]
add ecx, dword [0x00696124]
cmp eax, ecx
jle 0x5da017
mov eax, dword [0x00696124]
mov dword [0x00695814], eax
mov eax, dword [0x00693210]
add eax, 1
cmp dword [0x00693210], eax
jne 0x5da040
mov ecx, dword [0x006965a4]
mov edx, dword [0x006933fc]
mov r8d, dword [0x00693554]
call sub.kernel32.dll_GetDiskFreeSpaceExW
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret
Function at 0x5e35b0
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x4c0
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], rbp
mov dword [rbp + 0x4d0], ecx
nop
mov dword [0x00693200], 0x2f4
mov eax, dword [0x00693200]
sub eax, 0x19c
mov dword [0x00693400], eax
mov eax, dword [0x006931bc]
add eax, dword [0x006932ec]
mov ecx, dword [0x00693448]
add ecx, dword [0x006935f0]
cmp eax, ecx
jle 0x5e3618
mov dword [0x006931bc], 0x182
mov eax, dword [0x006958ec]
mov dword [0x00695804], eax
mov eax, dword [0x006931c8]
mov dword [0x006965e8], eax
mov eax, dword [0x0069584c]
add eax, dword [0x00695934]
mov ecx, dword [0x00695d84]
add ecx, dword [0x006962d8]
cmp eax, ecx
jle 0x5e3651
call fcn.004096f0
call fcn.005d3730
mov byte [rbp + 0x4b7], 0
nop
mov eax, dword [0x006934d4]
add eax, dword [0x00693918]
mov ecx, dword [0x006931f0]
add ecx, dword [0x006933ac]
cmp ecx, eax
jle 0x5e3684
mov dword [0x006931f0], 0x35
mov ecx, dword [0x006931f0]
add ecx, dword [0x006933ac]
cmp ecx, eax
jle 0x5e369e
mov dword [0x006931f0], 0x35
mov eax, dword [0x00696144]
cmp eax, dword [0x00696324]
je 0x5e36b8
mov eax, dword [0x00696144]
mov dword [0x00696324], eax
call fcn.005cdc30
mov eax, dword [0x00695934]
add eax, dword [0x00695bf4]
mov ecx, dword [0x00696180]
add ecx, dword [0x006965a8]
cmp eax, ecx
jle 0x5e36e5
mov eax, dword [0x006965a8]
mov dword [0x00695934], eax
mov eax, dword [0x006933e0]
add eax, 1
cmp dword [0x006933e0], eax
jne 0x5e370e
mov ecx, dword [0x00695c10]
mov edx, dword [0x006965c4]
mov r8d, dword [0x00696ac4]
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x0069586c]
mov dword [0x006942b4], eax
lea rcx, [rbp + 0x28]
lea rdx, [0x0069268d]
mov r8d, 0xa
mov r9d, 0x2d
call fcn.00597b20
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
xor r8, r8
call fcn.005a8ac0
mov rcx, qword [rbp + 0x30]
call fcn.005a2dd0
mov qword [rbp + 0x4b8], rax
nop
mov rcx, qword [0x006a8a80]
mov rax, qword [0x006a8a80]
mov rax, qword [rax]
call qword [rax]
mov qword [rbp + 0x4a8], rax
mov qword [rbp + 0x4a0], 0
jmp 0x5e381c
mov rcx, qword [0x006a8a80]
mov rdx, qword [rbp + 0x4a0]
xor r8, r8
mov rax, qword [0x006a8a80]
mov rax, qword [rax]
call qword [rax + 0x50]
mov rcx, qword [0x006a8a80]
lea rdx, [rbp + 0x40]
mov r8d, 0x460
call fcn.004fab00
mov eax, dword [rbp + 0x4d0]
cmp eax, dword [rbp + 0x40]
jne 0x5e3806
mov dword [rbp + 0x40], 0xffffffff
mov rcx, qword [0x006a8a80]
mov rdx, qword [rbp + 0x4a0]
xor r8, r8
mov rax, qword [0x006a8a80]
mov rax, qword [rax]
call qword [rax + 0x50]
mov rcx, qword [0x006a8a80]
lea rdx, [rbp + 0x40]
mov r8d, 0x460
call fcn.004fbd70
mov byte [rbp + 0x4b7], 1
sub qword [rbp + 0x4a8], 0x460
add qword [rbp + 0x4a0], 0x460
cmp qword [rbp + 0x4a8], 0
jg 0x5e3783
nop
mov rcx, qword [rbp + 0x4b8]
call fcn.005a2ff0
mov eax, dword [0x0069586c]
mov dword [0x006942b4], eax
mov eax, dword [0x006961a4]
cmp eax, dword [0x006965cc]
je 0x5e38c1
mov eax, dword [0x006961a4]
mov dword [0x006965cc], eax
jmp 0x5e38c1
nop
lea rcx, [rbp + 0x28]
call fcn.0040e970
lea rcx, [rbp + 0x30]
call fcn.0040e9c0
movzx rax, byte [rbp + 0x4b7]
lea rsp, [rbp + 0x4c0]
pop rbp
ret
Function at 0x5e7d80
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x78], rdx
mov qword [rbp + 0x80], r8
lea rcx, [rbp + 0x78]
call fcn.0040eaf0
mov rcx, qword [rbp + 0x80]
call fcn.0040eab0
nop
mov eax, dword [0x006931bc]
mov dword [0x006968b4], eax
mov eax, dword [0x00693400]
add eax, 1
cmp dword [0x00693400], eax
jne 0x5e7e32
mov eax, dword [0x006932e4]
test eax, eax
jge 0x5e7dea
call fcn.0040afc0
mov ecx, dword [0x006942ec]
test ecx, ecx
jge 0x5e7df9
call fcn.0040afc0
mov edx, dword [0x00695b8c]
test edx, edx
jge 0x5e7e08
call fcn.0040afc0
mov r8d, dword [0x00696164]
test r8d, r8d
jge 0x5e7e19
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
call fcn.005a6160
cmp eax, dword [0x00693410]
jle 0x5e7e49
mov dword [0x00693410], 0xb6
mov dword [0x0069355c], 0x360
mov eax, dword [0x0069355c]
sub eax, 0x1e0
mov dword [0x006940fc], eax
mov eax, dword [0x00693420]
add eax, 1
cmp dword [0x00693420], eax
jne 0x5e7eb6
mov eax, dword [0x00696114]
test eax, eax
jge 0x5e7e85
call fcn.0040afc0
mov ecx, dword [0x006965d4]
test ecx, ecx
jge 0x5e7e94
call fcn.0040afc0
mov edx, dword [0x006931b0]
test edx, edx
jge 0x5e7ea3
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00696ca4]
add eax, dword [0x006932a0]
mov ecx, dword [0x00693408]
add ecx, dword [0x00693534]
cmp eax, ecx
jle 0x5e7edc
mov dword [0x00696ca4], 8
xor ebx, ebx
mov rax, qword [rbp + 0x80]
test rax, rax
je 0x5e7eed
mov ebx, dword [rax - 4]
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x78]
call fcn.004108b0
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x80]
lea r8, [0x005e8004]
call fcn.00410b70
mov eax, ebx
add eax, eax
add eax, 1
test eax, eax
jge 0x5e7f21
call fcn.0040afc0
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x48]
mov r8d, 1
mov r9, qword [rbp + 0x40]
mov dword [rsp + 0x20], eax
call fcn.005e55d0
mov byte [rbp + 0x3f], al
call fcn.005e7100
cmp eax, dword [0x00693280]
jle 0x5e7f57
mov dword [0x00693280], 0x53
mov eax, dword [0x00696578]
mov dword [0x0069618c], eax
mov dword [0x006932c8], 0x320
mov eax, dword [0x006932c8]
sub eax, 0x1b1
mov dword [0x0069342c], eax
mov eax, dword [0x006931c8]
mov dword [0x00696aac], eax
nop
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.0040ea00
lea rcx, [rbp + 0x78]
call fcn.0040e9c0
lea rcx, [rbp + 0x80]
call fcn.0040e920
movzx rax, byte [rbp + 0x3f]
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret
Function at 0x5f6740
Capabilities:
Get disk size

Disassembly:
push rbx
sub rsp, 0x30
call fcn.005dea10
mov eax, dword [0x0069580c]
mov dword [0x006940f0], eax
mov eax, dword [0x006962cc]
cmp eax, dword [0x00696600]
je 0x5f6770
mov eax, dword [0x006962cc]
mov dword [0x00696600], eax
cmp byte [0x006931a0], 0
je 0x5f679b
mov rcx, qword [0x00693198]
call qword [0x006a8e08]
mov rcx, qword [0x006931a8]
call fcn.00410050
mov rcx, rax
call qword [0x006a8e58]
mov eax, dword [0x00694304]
add eax, dword [0x0069588c]
mov ecx, dword [0x00695bcc]
add ecx, dword [0x00696128]
cmp eax, ecx
jle 0x5f67bc
call fcn.004096f0
mov eax, dword [0x00693300]
add eax, 1
cmp dword [0x00693300], eax
jne 0x5f67e3
mov eax, dword [0x0069746c]
test eax, eax
jge 0x5f67dc
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x00693540]
sub eax, dword [0x0069344c]
mov dword [0x0069344c], eax
mov eax, dword [0x006933f8]
add eax, 1
cmp dword [0x006933f8], eax
jne 0x5f6846
mov eax, dword [0x00697448]
test eax, eax
jge 0x5f6815
call fcn.0040afc0
mov ecx, dword [0x00693304]
test ecx, ecx
jge 0x5f6824
call fcn.0040afc0
mov edx, dword [0x00693528]
test edx, edx
jge 0x5f6833
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006932a8]
add eax, 1
cmp dword [0x006932a8], eax
jne 0x5f68ae
mov eax, dword [0x00695be8]
test eax, eax
jge 0x5f6866
call fcn.0040afc0
mov ecx, dword [0x0069658c]
test ecx, ecx
jge 0x5f6875
call fcn.0040afc0
mov edx, dword [0x00696aa8]
test edx, edx
jge 0x5f6884
call fcn.0040afc0
mov r8d, dword [0x0069745c]
test r8d, r8d
jge 0x5f6895
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006933a0]
add eax, 1
cmp dword [0x006933a0], eax
jne 0x5f692c
mov eax, dword [0x006962e4]
test eax, eax
jge 0x5f68ce
call fcn.0040afc0
mov ecx, dword [0x00696e60]
test ecx, ecx
jge 0x5f68dd
call fcn.0040afc0
mov edx, dword [0x006931b4]
test edx, edx
jge 0x5f68ec
call fcn.0040afc0
mov r8d, dword [0x006933e4]
test r8d, r8d
jge 0x5f68fd
call fcn.0040afc0
mov r9d, dword [0x006935f8]
test r9d, r9d
jge 0x5f690e
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
add rsp, 0x30
pop rbx
ret
Function at 0x5ff840
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov dword [rbp + 0x58], edx
mov qword [rbp + 0x60], r8
nop
mov eax, dword [0x006934c0]
add eax, 1
cmp dword [0x006934c0], eax
jne 0x5ff8c0
mov eax, dword [0x00696e88]
test eax, eax
jge 0x5ff878
call fcn.0040afc0
mov ecx, dword [0x00693918]
test ecx, ecx
jge 0x5ff887
call fcn.0040afc0
mov edx, dword [0x006942b4]
test edx, edx
jge 0x5ff896
call fcn.0040afc0
mov r8d, dword [0x00695904]
test r8d, r8d
jge 0x5ff8a7
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
mov eax, dword [0x006932dc]
mov dword [0x00697c8c], eax
mov eax, dword [0x006965cc]
cmp eax, dword [0x00696cb8]
je 0x5ff8e6
mov eax, dword [0x006965cc]
mov dword [0x00696cb8], eax
mov eax, dword [0x006974b4]
mov dword [0x00696aa4], eax
mov eax, dword [0x006961a8]
add eax, dword [0x006965fc]
mov ecx, dword [0x00696e54]
add ecx, dword [0x006978c4]
cmp eax, ecx
jle 0x5ff91a
mov eax, dword [0x006978c4]
mov dword [0x006961a8], eax
mov eax, dword [0x00693450]
add eax, 1
cmp dword [0x00693450], eax
jne 0x5ff941
mov eax, dword [0x006942c4]
test eax, eax
jge 0x5ff93a
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x00697478]
mov dword [0x00696abc], eax
mov eax, dword [0x006958f0]
add eax, dword [0x00695c20]
mov ecx, dword [0x006962e8]
add ecx, dword [0x006968b0]
cmp eax, ecx
jle 0x5ff96e
call fcn.004096f0
mov eax, dword [0x00693530]
add eax, 1
cmp dword [0x00693530], eax
jne 0x5ff9bf
mov eax, dword [0x00693958]
test eax, eax
jge 0x5ff98e
call fcn.0040afc0
mov ecx, dword [0x00695880]
test ecx, ecx
jge 0x5ff99d
call fcn.0040afc0
mov edx, dword [0x00695c20]
test edx, edx
jge 0x5ff9ac
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov rax, qword [rbp + 0x60]
mov ecx, dword [rbp + 0x58]
not ecx
and ecx, 0x1e
mov dword [rax + 0x18], ecx
mov rcx, qword [rbp + 0x50]
call fcn.00410050
mov rcx, rax
mov rax, qword [rbp + 0x60]
lea rdx, [rax + 0x28]
call qword [0x006a8d00]
mov rcx, qword [rbp + 0x60]
mov qword [rcx + 0x20], rax
mov rax, qword [rbp + 0x60]
cmp qword [rax + 0x20], 0xffffffffffffffff
je 0x5ffa1b
mov rcx, qword [rbp + 0x60]
call fcn.005ff620
mov dword [rbp + 0x3c], eax
cmp dword [rbp + 0x3c], 0
je 0x5ffa1b
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax + 0x20]
call qword [0x006a8d08]
mov eax, dword [0x006958f0]
add eax, dword [0x00695c20]
mov ecx, dword [0x006962e8]
add ecx, dword [0x006968b0]
cmp eax, ecx
jle 0x5ffa3c
call fcn.004096f0
mov eax, dword [0x00696310]
cmp eax, dword [0x00696c94]
je 0x5ffa60
mov eax, dword [0x00696310]
mov dword [0x00696c94], eax
jmp 0x5ffa60
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x5ffa80
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
nop
mov dword [0x006932ac], 0x30a
mov eax, dword [0x006932ac]
sub eax, 0x1a7
mov dword [0x00693434], eax
mov dword [0x006932ac], 0x30a
mov eax, dword [0x006932ac]
sub eax, 0x1a7
mov dword [0x00693434], eax
mov eax, dword [0x006965a4]
cmp eax, dword [0x00696c94]
je 0x5ffae3
mov eax, dword [0x006965a4]
mov dword [0x00696c94], eax
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 0x20]
mov rax, qword [rbp + 0x50]
lea rdx, [rax + 0x28]
call qword [0x006a8d70]
test eax, eax
je 0x5ffb0b
mov rcx, qword [rbp + 0x50]
call fcn.005ff620
mov dword [rbp + 0x3c], eax
jmp 0x5ffb1d
call qword [0x006a9208]
test eax, eax
jge 0x5ffb1a
call fcn.0040afc0
mov dword [rbp + 0x3c], eax
mov eax, dword [0x00695d80]
add eax, dword [0x00696300]
mov ecx, dword [0x00696a74]
add ecx, dword [0x00697480]
cmp eax, ecx
jle 0x5ffb45
mov eax, dword [0x00697480]
mov dword [0x00695d80], eax
mov eax, dword [0x00693300]
mov dword [0x00697e8c], eax
mov eax, dword [0x006958d0]
mov dword [0x006942d4], eax
mov eax, dword [0x00693500]
add eax, 1
cmp dword [0x00693500], eax
jne 0x5ffbb8
mov eax, dword [0x006942a8]
test eax, eax
jge 0x5ffb7d
call fcn.0040afc0
mov ecx, dword [0x006968b8]
test ecx, ecx
jge 0x5ffb8c
call fcn.0040afc0
mov edx, dword [0x00697470]
test edx, edx
jge 0x5ffb9b
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
jmp 0x5ffbb8
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x615380
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x840
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x850], rcx
mov eax, dword [0x006931d8]
add eax, dword [0x006933d8]
mov ecx, dword [0x0069353c]
add ecx, dword [0x00693968]
cmp eax, ecx
jle 0x6153bc
mov dword [0x006931d8], 0x12
mov eax, dword [0x00696a8c]
cmp eax, dword [0x00697460]
je 0x6153d6
mov eax, dword [0x00696a8c]
mov dword [0x00697460], eax
call fcn.005fbf20
cmp eax, dword [0x006989a0]
jle 0x6153ed
mov dword [0x006989a0], 0x3d
mov eax, dword [0x00693400]
add eax, 1
cmp dword [0x00693400], eax
jne 0x615414
mov eax, dword [0x006932e4]
test eax, eax
jge 0x61540d
call fcn.0040afc0
mov ecx, eax
call sub.kernel32.dll_SetConsoleKeyShortcuts
mov eax, dword [0x006931c4]
mov dword [0x00697e78], eax
call fcn.005fbf20
cmp eax, dword [0x006989ac]
jle 0x615437
mov dword [0x006989ac], 0x2a
mov eax, dword [0x00693400]
add eax, 1
cmp dword [0x00693400], eax
jne 0x615488
mov eax, dword [0x006980d4]
test eax, eax
jge 0x615457
call fcn.0040afc0
mov ecx, dword [0x006933d8]
test ecx, ecx
jge 0x615466
call fcn.0040afc0
mov edx, dword [0x00693968]
test edx, edx
jge 0x615475
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov dword [0x0069339c], 0x327
mov eax, dword [0x0069339c]
sub eax, 0x1a5
mov dword [0x00693450], eax
nop
mov rcx, qword [rbp + 0x850]
mov edx, 1
call qword [0x006a92d0]
mov rcx, qword [rbp + 0x850]
lea rdx, [rbp + 0x3e]
mov r8d, 0x400
xor r9, r9
call qword [0x006a92b8]
test eax, eax
jg 0x6154b8
mov rcx, qword [rbp + 0x850]
call qword [0x006a92c0]
call fcn.005fc010
mov eax, dword [0x00698990]
add eax, dword [0x006932f0]
mov ecx, dword [0x006934e8]
add ecx, dword [0x0069396c]
cmp eax, ecx
jle 0x61550f
mov dword [0x00698990], 0x111
mov eax, dword [0x00698118]
mov dword [0x00697488], eax
mov eax, dword [0x0069342c]
add eax, 1
cmp dword [0x0069342c], eax
jne 0x61556c
mov eax, dword [0x0069342c]
test eax, eax
jge 0x61553b
call fcn.0040afc0
mov ecx, dword [0x006940cc]
test ecx, ecx
jge 0x61554a
call fcn.0040afc0
mov edx, dword [0x0069585c]
test edx, edx
jge 0x615559
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x00695928]
add eax, dword [0x0069612c]
mov ecx, dword [0x006965ec]
add ecx, dword [0x00696e58]
cmp eax, ecx
jle 0x61558d
call fcn.004096f0
mov eax, dword [0x00693404]
add eax, 1
cmp dword [0x00693404], eax
jne 0x6155ff
mov eax, dword [0x00696ab8]
test eax, eax
jge 0x6155ad
call fcn.0040afc0
mov ecx, dword [0x00697e78]
test ecx, ecx
jge 0x6155bc
call fcn.0040afc0
mov edx, dword [0x0069327c]
test edx, edx
jge 0x6155cb
call fcn.0040afc0
mov r8d, dword [0x006934cc]
test r8d, r8d
jge 0x6155dc
call fcn.0040afc0
mov r9d, ecx
mov r10d, edx
mov r11d, r8d
mov ecx, eax
mov edx, r9d
mov r8d, r10d
mov r9d, r11d
call sub.advapi32.dll_CryptDuplicateKey
jmp 0x6155ff
lea rsp, [rbp + 0x840]
pop rbp
ret
Function at 0x616670
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x78], rdx
mov eax, dword [0x00696118]
add eax, dword [0x00696580]
mov ecx, dword [0x00696ac0]
add ecx, dword [0x00697490]
cmp eax, ecx
jle 0x6166ad
mov eax, dword [0x00697490]
mov dword [0x00696118], eax
mov eax, dword [0x00696aac]
cmp eax, dword [0x0069747c]
je 0x6166c7
mov eax, dword [0x00696aac]
mov dword [0x0069747c], eax
call fcn.005e8520
mov dword [0x006931b8], 0x2f2
mov eax, dword [0x006931b8]
sub eax, 0x18c
mov dword [0x006933b8], eax
nop
mov eax, dword [0x006962e0]
add eax, dword [0x006968bc]
mov ecx, dword [0x00697438]
add ecx, dword [0x00697e80]
cmp eax, ecx
jle 0x616711
mov eax, dword [0x00697e80]
mov dword [0x006962e0], eax
mov eax, dword [0x00693454]
add eax, 1
cmp dword [0x00693454], eax
jne 0x616762
mov eax, dword [0x0069327c]
test eax, eax
jge 0x616731
call fcn.0040afc0
mov ecx, dword [0x006937fc]
test ecx, ecx
jge 0x616740
call fcn.0040afc0
mov edx, dword [0x006957f4]
test edx, edx
jge 0x61674f
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
mov eax, dword [0x006931ec]
mov dword [0x006980e8], eax
mov eax, dword [0x006931ec]
mov dword [0x006980e8], eax
mov eax, dword [0x006965b8]
cmp eax, dword [0x00696cbc]
je 0x616794
mov eax, dword [0x006965b8]
mov dword [0x00696cbc], eax
mov eax, dword [0x00695c1c]
add eax, dword [0x006962fc]
mov ecx, dword [0x00696a80]
add ecx, dword [0x00696e60]
cmp eax, ecx
jle 0x6167bc
mov eax, dword [0x00696e60]
mov dword [0x00695c1c], eax
mov eax, dword [0x00693458]
add eax, dword [0x00693934]
mov ecx, dword [0x006989b0]
add ecx, dword [0x006932b8]
cmp ecx, eax
jle 0x6167e2
mov dword [0x006989b0], 0x125
mov ecx, dword [0x006989b0]
add ecx, dword [0x006932b8]
cmp ecx, eax
jle 0x6167fc
mov dword [0x006989b0], 0x125
mov eax, dword [0x006965a0]
cmp eax, dword [0x00696ca0]
je 0x616816
mov eax, dword [0x006965a0]
mov dword [0x00696ca0], eax
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x78]
call qword [0x006a92f0]
test eax, eax
setne al
mov byte [rbp + 0x4f], al
jmp 0x616836
mov eax, dword [0x006934e4]
add eax, 1
cmp dword [0x006934e4], eax
jne 0x6168b4
mov eax, dword [0x00694298]
test eax, eax
jge 0x616856
call fcn.0040afc0
mov ecx, dword [0x006962cc]
test ecx, ecx
jge 0x616865
call fcn.0040afc0
mov edx, dword [0x00696aac]
test edx, edx
jge 0x616874
call fcn.0040afc0
mov r8d, dword [0x006974d8]
test r8d, r8d
jge 0x616885
call fcn.0040afc0
mov r9d, dword [0x0069896c]
test r9d, r9d
jge 0x616896
call fcn.0040afc0
mov r10d, ecx
mov r11d, edx
mov ebx, r8d
mov dword [rsp + 0x20], r9d
mov ecx, eax
mov edx, r10d
mov r8d, r11d
mov r9d, ebx
call sub.kernel32.dll_LockFile
mov eax, dword [0x006980f0]
mov dword [0x00697464], eax
mov eax, dword [0x006980f0]
mov dword [0x00697464], eax
mov eax, dword [0x00696898]
cmp eax, dword [0x00696e78]
je 0x6168e6
mov eax, dword [0x00696898]
mov dword [0x00696e78], eax
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret
Function at 0x617a30
Capabilities:
Get disk size

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
mov word [rbp + 0x58], dx
nop
call fcn.00615620
cmp eax, dword [0x00693274]
jle 0x617a5c
mov dword [0x00693274], 0x60
mov rcx, qword [rbp + 0x50]
lea rdx, [rbp + 0x3a]
mov r8d, 2
xor r9, r9
call qword [0x006a92b8]
mov dword [rbp + 0x3c], eax
cmp dword [rbp + 0x3c], 0xffffffff
je 0x617a8e
cmp dword [rbp + 0x3c], 0
je 0x617a8e
movzx rax, word [rbp + 0x3a]
cmp ax, word [rbp + 0x58]
jne 0x617a5c
mov eax, dword [0x006933b8]
add eax, 1
cmp dword [0x006933b8], eax
jne 0x617ae9
mov eax, dword [0x006940a4]
test eax, eax
jge 0x617aae
call fcn.0040afc0
mov ecx, dword [0x00696184]
test ecx, ecx
jge 0x617abd
call fcn.0040afc0
mov edx, dword [0x00696a84]
test edx, edx
jge 0x617acc
call fcn.0040afc0
mov r8d, ecx
mov r9d, edx
mov ecx, eax
mov edx, r8d
mov r8d, r9d
call sub.kernel32.dll_GetDiskFreeSpaceExW
jmp 0x617ae9
lea rsp, [rbp + 0x40]
pop rbp
ret