joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5407a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x80], rcx
lea rcx, [rbp + 0x80]
call fcn.00410d40
nop
xor eax, eax
mov byte [rbp + 0x4f], al
mov rcx, qword [rbp + 0x80]
call fcn.004121c0
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x540898
mov rcx, rbx
lea rdx, [rbp + 0x58]
call sub.kernel32.dll_GetFileSizeEx
test eax, eax
jne 0x540825
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x540898
mov rcx, qword [rbp + 0x40]
mov rdx, qword [0x004481f0]
call fcn.00415bf0
mov rcx, qword [rbp + 0x40]
mov rdx, qword [0x004481f0]
mov r8d, 1
mov r9, qword [rbp + 0x58]
call fcn.00415a20
mov dword [rbp + 0x54], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
je 0x54088a
mov rcx, rbx
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax]
mov r8d, dword [rbp + 0x58]
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov al, 1
mov byte [rbp + 0x4f], al
nop
lea rcx, [rbp + 0x80]
call fcn.00410bd0
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret

Function at 0x5414b0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
jmp 0x5414d9
mov rcx, qword [0x00587fb0]
lea rdx, [0x00541508]
call fcn.0040cbd0
mov rcx, rax
call fcn.0040cd30
call fcn.00409580
mov ecx, 1
xor edx, edx
mov r8d, ebx
call sub.kernel32.dll_OpenProcess
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x5414b9
add rsp, 0x20
pop rbx
ret
Function at 0x542610
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
nop
mov rax, qword [0x00588040]
lea rcx, [rax + 0x70]
mov rdx, qword [0x004481f0]
call fcn.00415bf0
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5426a0
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x00542904]
mov rax, qword [0x00588040]
mov r9, qword [rax + 0xf0]
lea rax, [0x00542938]
mov qword [rsp + 0x20], rax
call fcn.00412570
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.00412880
mov rcx, qword [rbp + 0x50]
mov dl, 1
call fcn.00541b60
lea rcx, [rbp + 0x48]
mov rax, qword [0x00588040]
mov rdx, qword [rax + 0xf0]
lea r8, [0x00542938]
call fcn.00412270
mov rcx, qword [rbp + 0x48]
call fcn.004121c0
mov rcx, rax
mov edx, 0x80000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x54272a
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5428ac
lea rcx, [0x0054296c]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
jmp 0x5428ac
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x542748
lea rcx, [0x005429b4]
mov dl, 1
call fcn.00541b60
mov rcx, rbx
lea rdx, [rbp + 0x60]
call sub.kernel32.dll_GetFileSizeEx
test al, al
jne 0x54278a
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x54277d
lea rcx, [0x005429f0]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x5428ac
mov rax, qword [0x00588040]
lea rcx, [rax + 0x70]
mov rdx, qword [0x004481f0]
mov r8d, 1
mov r9, qword [rbp + 0x60]
call fcn.00415a20
mov dword [rbp + 0x6c], 0
jmp 0x542879
mov dword [rbp + 0x6c], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x5427fd
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x542879
lea rcx, [0x00542a40]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
jmp 0x542879
mov rcx, rbx
mov rax, qword [0x00588040]
mov rdx, qword [rax + 0x70]
mov r8d, dword [rbp + 0x60]
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x54284c
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x542879
lea rcx, [0x00542aac]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
jmp 0x542879
mov eax, dword [rbp + 0x6c]
cmp eax, dword [rbp + 0x60]
je 0x542879
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x542879
lea rcx, [0x00542b08]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
mov eax, dword [rbp + 0x6c]
cmp eax, dword [rbp + 0x60]
jne 0x5427b7
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5428ab
lea rcx, [0x00542b74]
mov dl, 1
call fcn.00541b60
nop
lea rcx, [rbp + 0x48]
call fcn.00410bd0
lea rcx, [rbp + 0x50]
call fcn.00410b30
lea rcx, [rbp + 0x58]
call fcn.00410bd0
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x5431b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x90], rcx
lea rcx, [rbp + 0x90]
call fcn.00410d40
nop
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x54323c
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x00543470]
mov rax, qword [0x00588040]
mov r9, qword [rax + 0xf0]
lea rax, [0x005434b8]
mov qword [rsp + 0x20], rax
call fcn.00412570
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.00412880
mov rcx, qword [rbp + 0x50]
mov dl, 1
call fcn.00541b60
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x90]
lea r8, [0x005434b8]
call fcn.00412270
mov rcx, qword [rbp + 0x48]
call fcn.004121c0
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x5432bf
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5433f8
lea rcx, [0x005434ec]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
jmp 0x5433f8
mov dword [rbp + 0x6c], 0
jmp 0x5433b4
mov dword [rbp + 0x6c], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x543314
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5433b4
lea rcx, [0x00543548]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
jmp 0x5433b4
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x70]
test rax, rax
je 0x543328
mov rax, qword [rax - 8]
mov rcx, rbx
mov rdx, qword [0x00588040]
mov rdx, qword [rdx + 0x70]
mov r8d, eax
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x543376
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5433b4
lea rcx, [0x005435b4]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
jmp 0x5433b4
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x70]
test rax, rax
je 0x54338a
mov rax, qword [rax - 8]
cmp dword [rbp + 0x6c], eax
je 0x5433b4
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5433b4
lea rcx, [0x0054360c]
mov dl, 1
call fcn.00541b60
xor ecx, ecx
call fcn.00541da0
mov rax, qword [0x00588040]
mov rax, qword [rax + 0x70]
test rax, rax
je 0x5433c8
mov rax, qword [rax - 8]
cmp dword [rbp + 0x6c], eax
jne 0x5432cb
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5433f7
lea rcx, [0x00543678]
mov dl, 1
call fcn.00541b60
nop
lea rcx, [rbp + 0x48]
call fcn.00410bd0
lea rcx, [rbp + 0x50]
call fcn.00410b30
lea rcx, [rbp + 0x58]
call fcn.00410bd0
lea rcx, [rbp + 0x90]
call fcn.00410bd0
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x549760
Capabilities:
Clear file content

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rdx
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0xa0], r8
lea rcx, [rbp + 0xa0]
call fcn.00410d40
nop
mov al, 1
mov byte [rbp + 0x5f], al
mov bl, 1
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0xffffffffffffffff
jne 0x549801
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0xa0]
call fcn.00448b50
mov rcx, qword [rbp + 0x68]
call fcn.004121c0
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
jmp 0x54988d
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x50]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x54982b
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_SetEndOfFile
test eax, eax
jne 0x5498a0
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0xa0]
call fcn.00448b50
mov rcx, qword [rbp + 0x60]
call fcn.004121c0
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
add bl, 1
cmp bl, 0xb
jne 0x54979c
nop
xor eax, eax
mov byte [rbp + 0x5f], al
nop
lea rcx, [rbp + 0x60]
mov edx, 2
call fcn.00410cb0
lea rcx, [rbp + 0xa0]
call fcn.00410bd0
movzx rax, byte [rbp + 0x5f]
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x5499b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x38], 0
nop
mov rax, qword [rbp + 0x28]
add dword [rax], 1
lea rcx, [rbp + 0x38]
mov rax, qword [rbp + 0x28]
mov edx, dword [rax]
call fcn.00449950
mov eax, 1
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movsxd rdx, eax
lea rcx, [rcx + rdx]
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
movzx rdx, byte [rdx]
xor byte [rcx], dl
add eax, 1
cmp eax, 0x10
jne 0x5499e4
nop
xor eax, eax
movsxd r9, eax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movzx rdx, byte [rcx + r9]
mov ecx, edx
shl ecx, 4
movzx rcx, cl
shr ecx, 4
movzx r8, cl
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movzx rcx, byte [rcx + r8]
mov r10, qword [rbp + 0x20]
mov r10, qword [r10]
mov byte [r10 + r8], dl
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
mov byte [rdx + r9], cl
add eax, 1
cmp eax, 0x10
jne 0x549a0a
nop
xor eax, eax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movsxd rdx, eax
lea rcx, [rcx + rdx]
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
movzx rdx, byte [rdx + 0xf]
xor byte [rcx], dl
add eax, 1
cmp eax, 0xf
jne 0x549a56
nop
mov rax, qword [rbp + 0x38]
movzx rcx, byte [rax + 3]
shl ecx, 6
movzx rcx, cl
shr ecx, 6
xor eax, eax
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
movsxd r8, eax
lea rdx, [rdx + r8]
mov r8, qword [rbp + 0x38]
movzx r9, cl
movzx r8, byte [r8 + r9]
xor byte [rdx], r8b
add eax, 1
cmp eax, 0x10
jne 0x549a90
nop
xor eax, eax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movsxd rdx, eax
lea rcx, [rcx + rdx]
mov rdx, qword [rbp + 0x38]
mov r8d, eax
and r8d, 0x80000003
jns 0x549ae3
sub r8d, 1
or r8d, 0xfffffffc
add r8d, 1
movsxd r8, r8d
movzx rdx, byte [rdx + r8]
xor byte [rcx], dl
add eax, 1
cmp eax, 0x10
jne 0x549ab9
nop
nop
lea rcx, [rbp + 0x38]
mov rdx, qword [0x004481f0]
call fcn.00415bf0
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x54a2d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rdx
mov dword [rbp + 0x5c], r8d
mov qword [rbp + 0x60], r9
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0xd0]
call fcn.00410d40
nop
mov al, 1
mov byte [rbp + 0x6f], al
mov bl, 1
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0xffffffffffffffff
jne 0x54a383
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xd0]
call fcn.00448b50
mov rcx, qword [rbp + 0x78]
call fcn.004121c0
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
jmp 0x54a43f
mov dword [rbp + 0x8c], 0
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x50]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x54a3dd
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rax, qword [rbp + 0x60]
mov rdx, qword [rax]
mov r8d, dword [rbp + 0x5c]
lea r9, [rbp + 0x8c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x54a3dd
mov eax, dword [rbp + 0x5c]
cmp dword [rbp + 0x8c], eax
je 0x54a452
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0xd0]
call fcn.00448b50
mov rcx, qword [rbp + 0x70]
call fcn.004121c0
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
add bl, 1
cmp bl, 0xb
jne 0x54a31e
nop
xor eax, eax
mov byte [rbp + 0x6f], al
nop
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.00410cb0
lea rcx, [rbp + 0xd0]
call fcn.00410bd0
movzx rax, byte [rbp + 0x6f]
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x54a670
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x98
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rdx
mov dword [rbp + 0x5c], r8d
mov qword [rbp + 0x60], r9
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0xd0]
call fcn.00410d40
nop
mov al, 1
mov byte [rbp + 0x6f], al
mov bl, 1
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0xffffffffffffffff
jne 0x54a723
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xd0]
call fcn.00448b50
mov rcx, qword [rbp + 0x78]
call fcn.004121c0
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
jmp 0x54a7df
mov dword [rbp + 0x8c], 0
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x50]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x54a77d
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rax, qword [rbp + 0x60]
mov rdx, qword [rax]
mov r8d, dword [rbp + 0x5c]
lea r9, [rbp + 0x8c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x54a77d
mov eax, dword [rbp + 0x5c]
cmp dword [rbp + 0x8c], eax
je 0x54a7f2
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0xd0]
call fcn.00448b50
mov rcx, qword [rbp + 0x70]
call fcn.004121c0
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
add bl, 1
cmp bl, 0xb
jne 0x54a6be
nop
xor eax, eax
mov byte [rbp + 0x6f], al
nop
lea rcx, [rbp + 0x70]
mov edx, 2
call fcn.00410cb0
lea rcx, [rbp + 0xd0]
call fcn.00410bd0
movzx rax, byte [rbp + 0x6f]
lea rsp, [rbp + 0x98]
pop rbx
pop rbp
ret
Function at 0x54ab70
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x40], rcx
mov dword [rbp + 0x48], r9d
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0xa8], rdx
mov qword [rbp + 0xb0], r8
lea rcx, [rbp + 0xa8]
call fcn.00410d40
lea rcx, [rbp + 0xb0]
call fcn.00410d40
nop
mov al, 1
mov byte [rbp + 0x4f], al
mov eax, dword [rbp + 0x48]
cmp eax, 0xffffffff
jne 0x54ac51
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb0]
call fcn.00412270
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x80]
call fcn.00448b50
mov rcx, qword [rbp + 0x88]
call fcn.004121c0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
cmp eax, 0xffffffff
jne 0x54ac51
mov eax, 0x80
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
and eax, 1
cmp eax, 1
jne 0x54ad1c
mov eax, dword [rbp + 0x48]
and eax, 0xfffffffe
mov dword [rbp + 0x48], eax
mov eax, dword [rbp + 0x48]
test eax, eax
jne 0x54ac78
mov eax, 0x80
mov dword [rbp + 0x48], eax
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb0]
call fcn.00412270
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x70]
call fcn.00448b50
mov rcx, qword [rbp + 0x78]
call fcn.004121c0
mov rcx, rax
mov edx, dword [rbp + 0x48]
call sub.kernel32.dll_SetFileAttributesW
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb0]
call fcn.00412270
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.00448b50
mov rcx, qword [rbp + 0x68]
call fcn.004121c0
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x40]
mov qword [rcx], rax
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0xffffffffffffffff
jne 0x54ad8c
jmp 0x54ad86
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb0]
call fcn.00412270
lea rcx, [rbp + 0x58]
mov rdx, qword [rbp + 0x50]
call fcn.00448b50
mov rcx, qword [rbp + 0x58]
call fcn.004121c0
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x40]
mov qword [rcx], rax
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0xffffffffffffffff
jne 0x54ad8c
xor eax, eax
mov byte [rbp + 0x4f], al
nop
lea rcx, [rbp + 0x50]
mov edx, 8
call fcn.00410cb0
lea rcx, [rbp + 0xa8]
mov edx, 2
call fcn.00410cb0
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x554580
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x28
mov cx, 0x101
mov rax, qword [0x00588040]
lea rdx, [rax + 0x120]
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x5545ad
mov rax, qword [0x00588040]
mov byte [rax + 0x104], 1
add rsp, 0x28
ret

Function at 0x5555f0
Capabilities:
Get disk size

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x70], rcx
lea rcx, [rbp + 0x70]
call fcn.00410d40
nop
or rax, 0xffffffffffffffff
mov qword [rbp + 0x20], rax
mov bl, 0xa
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x70]
call fcn.00555410
mov rcx, qword [rbp + 0x28]
call fcn.004121c0
mov rcx, rax
lea rdx, [rbp + 0x48]
lea r8, [rbp + 0x38]
lea r9, [rbp + 0x40]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x555651
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x20], rax
jmp 0x555664
mov ecx, 0x64
call sub.kernel32.dll_Sleep
sub bl, 1
test bl, bl
jne 0x555619
nop
nop
lea rcx, [rbp + 0x28]
call fcn.00410bd0
lea rcx, [rbp + 0x70]
call fcn.00410bd0
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret
Function at 0x555860
Capabilities:
Delete file
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbp, rsp
movdqa xmmword [rbp + 0x70], xmm6
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0xb0], rcx
lea rcx, [rbp + 0xb0]
call fcn.00410d40
nop
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x5558da
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0xb0]
call fcn.00412880
mov rcx, qword [rbp + 0x48]
xor edx, edx
call fcn.00541b60
mov rcx, qword [rbp + 0xb0]
call fcn.005555f0
mov rbx, rax
test rbx, rbx
jg 0x55591e
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x555ac4
lea rcx, [0x00555b78]
xor edx, edx
call fcn.00541b60
xor ecx, ecx
xor edx, edx
call fcn.00541b60
jmp 0x555ac4
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0xb0]
call fcn.005556c0
test al, al
jne 0x555962
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x555ac4
lea rcx, [0x00555c14]
xor edx, edx
call fcn.00541b60
xor ecx, ecx
xor edx, edx
call fcn.00541b60
jmp 0x555ac4
lea rcx, [rbp + 0x60]
mov rdx, qword [0x004481f0]
call fcn.00415bf0
lea rcx, [rbp + 0x60]
mov rdx, qword [0x004481f0]
mov r8d, 1
mov r9d, 0x100000
call fcn.00415a20
xor esi, esi
mov dil, 1
lea rcx, [0x00555cb0]
xor edx, edx
call fcn.00541940
jmp 0x555a5a
mov rcx, qword [rbp + 0x68]
mov rdx, rsi
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov r8d, 0x100000
lea r9, [rbp + 0x5c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
add rsi, 0x100000
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x555a5a
cmp rsi, rbx
jle 0x5559f7
mov rsi, rbx
cvtsi2sd xmm6, rsi
cvtsi2sd xmm0, rbx
divsd xmm6, xmm0
mulsd xmm6, qword [0x00555b10]
jmp 0x555a4c
movzx rax, dil
mov ecx, 0xa
xor edx, edx
div ecx
test edx, edx
jne 0x555a3a
lea rcx, [rbp + 0x40]
movzx rdx, dil
call fcn.00431670
mov rcx, qword [rbp + 0x40]
xor edx, edx
call fcn.00541940
jmp 0x555a48
lea rcx, [0x00555cc0]
xor edx, edx
call fcn.00541940
add dil, 1
movzx rax, dil
cvtsi2sd xmm0, eax
comisd xmm6, xmm0
jae 0x555a0f
cmp rsi, rbx
jl 0x5559a6
mov rcx, qword [rbp + 0x68]
call sub.kernel32.dll_CloseHandle
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0xb0]
lea r8, [0x00555cc8]
call fcn.00412270
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
call fcn.00448b50
mov rcx, qword [rbp + 0x38]
call fcn.004121c0
mov rcx, rax
call sub.kernel32.dll_DeleteFileW
mov rax, qword [0x00588040]
cmp byte [rax + 0x10c], 0
je 0x555ac3
xor ecx, ecx
xor edx, edx
call fcn.00541b60
xor ecx, ecx
xor edx, edx
call fcn.00541b60
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.00410cb0
lea rcx, [rbp + 0x40]
mov edx, 2
call fcn.00410c10
lea rcx, [rbp + 0x60]
mov rdx, qword [0x004481f0]
call fcn.00415bf0
lea rcx, [rbp + 0xb0]
call fcn.00410bd0
movdqa xmm6, xmmword [rbp + 0x70]
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop rbp
ret