joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140123830
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, rdx
mov rdx, r8
mov rbp, r9
mov rsi, rcx
call fcn.1401234f0
test eax, eax
jne 0x14012393a
call fcn.140049470
lea rbx, [0x14043e030]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea rcx, str.....IncludeDiskIO.h
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x1401238a3
xor ebx, ebx
jmp 0x140123920
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x48]
lea r8d, [rax + 0x72]
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x49], rax
mov word [rsp + 0x51], ax
mov byte [rsp + 0x53], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x1401238e0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x48]
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x140123910
mov rax, qword [rsi]
lea rdx, [0x1402e4750]
mov r8, rbx
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x1401239ba
lea rax, [rsp + 0x44]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x70000
mov rcx, rsi
mov dword [rsp + 0x28], 0x18
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [rsp + 0x5c]
mov ecx, reloc.MFC80U.DLL_Ordinal_512
test eax, eax
lea r9, [rsp + 0x40]
mov rdx, r12
cmove edi, ecx
mov rcx, rsi
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rbx
imul ebp, edi
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1401239b8
mov eax, dword [rsp + 0x40]
xor edx, edx
div edi
test edx, edx
jne 0x1401239b8
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140161080
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140127f20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rsi
push rdi
sub rsp, reloc.MFC80U.DLL_Ordinal_576
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, qword [rdx + 8]
mov rsi, rdx
mov rdi, rcx
test rbx, rbx
je 0x140127f8c
mov rdx, rbx
call fcn.140127f20
test eax, eax
je 0x1401280ed
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x140127f8c
nop
nop
nop
mov rbx, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140127f20
test eax, eax
je 0x1401280ed
test rbx, rbx
mov rdx, rbx
jne 0x140127f70
cmp byte [rsi + 0x1c], 1
jne 0x1401280f1
cmp byte [rsi + 0x1d], 1
je 0x1401280f1
add dword [rdi + 0x220], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rdi + reloc.MFC80U.DLL_Ordinal_512]
cmp eax, 0x3e8
jb 0x1401280b2
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, Ordinal_512
mov qword [rsp + 0x270], rbp
mov word [rsp + 0x30], 0
call sub.ntdll.dll_memset
mov r11d, dword [rdi + 0x220]
mov eax, dword [rdi + 0x21c]
mov ebp, 0x64
lea rdx, str.File_Items_Updating___u__u___d___...
lea rcx, [rsp + 0x30]
mov r9d, eax
cvtsi2sd xmm1, r11
cvtsi2sd xmm0, rax
mov r8d, r11d
divsd xmm1, xmm0
mulsd xmm1, qword [0x1403b85a8]
cvttsd2si rbx, xmm1
cmp ebx, ebp
cmova ebx, ebp
mov dword [rsp + 0x20], ebx
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [rdi + 0x78]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x70]
lea rdx, str.Status:_d
lea rcx, [rsp + 0x30]
mov r8d, ebx
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [rdi + 0x78]
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x78]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cvtsi2sd xmm0, dword [rdi + 0x1f0]
mov rcx, qword [rdi + 0x78]
cmp ebx, ebp
mov dword [rdi + reloc.MFC80U.DLL_Ordinal_512], eax
mov rax, qword [rcx]
cmovg ebx, ebp
cvtsi2sd xmm1, ebx
mulsd xmm1, qword [rdi + 0x1e8]
addsd xmm1, xmm0
cvttsd2si ebx, xmm1
call qword [rax + 0xa0]
mov rbp, qword [rsp + 0x270]
cmp eax, ebx
jge 0x1401280b2
mov rcx, qword [rdi + 0x78]
mov edx, ebx
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdx, rsi
mov rcx, rdi
call fcn.1401276a0
test eax, eax
jne 0x1401280f1
call fcn.140049470
lea rcx, str..._fatresize.cpp
mov edx, 0x6fa
mov rdi, qword [rax]
mov rbx, rax
call fcn.140123400
lea rdx, str._s:_Failed_to_Write1stClusNumber.
mov rcx, rbx
mov r8, rax
call qword [rdi + 0x10]
xor eax, eax
jmp 0x1401280f6
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140161080
add rsp, reloc.MFC80U.DLL_Ordinal_576
pop rdi
pop rsi
pop rbx
ret
Function at 0x14012cfd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbx, qword [rdx + 8]
mov rsi, rdx
mov rdi, rcx
test rbx, rbx
je 0x14012d038
mov rdx, rbx
call fcn.14012cfd0
test eax, eax
je 0x14012d0a2
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x14012d038
nop
nop
nop
mov rbx, qword [rdx + 0x10]
mov rcx, rdi
call fcn.14012cfd0
test eax, eax
je 0x14012d0a2
test rbx, rbx
mov rdx, rbx
jne 0x14012d020
add dword [rdi + 0x218], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rdi + reloc.MFC80U.DLL_Ordinal_512]
cmp eax, 0x3e8
jb 0x14012d196
mov rcx, qword [rdi + 0x78]
mov rax, qword [rcx]
call qword [rax + 0xf0]
test eax, eax
je 0x14012d0a9
mov rcx, qword [rdi + 0x78]
mov edx, 0x17
mov rax, qword [rcx]
call qword [rax + 0x40]
call fcn.140049470
lea rcx, str..._fatresize.cpp
mov rdi, qword [rax]
mov edx, 0x34f
mov rbx, rax
call fcn.140123400
lea rdx, str._s:_User_cancel_operations.
mov rcx, rbx
mov r8, rax
call qword [rdi + 0x10]
xor eax, eax
jmp 0x14012d1c8
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, Ordinal_512
mov qword [rsp + 0x260], rbp
mov word [rsp + 0x20], 0
call sub.ntdll.dll_memset
mov r11d, dword [rdi + 0x218]
mov eax, dword [rdi + 0x214]
mov ebp, 0x64
lea rdx, str.Filesystem_Analysing___d___...
lea rcx, [rsp + 0x20]
cvtsi2sd xmm1, r11
cvtsi2sd xmm0, rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x1403b85a8]
cvttsd2si rbx, xmm1
cmp ebx, ebp
cmova ebx, ebp
mov r8d, ebx
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [rdi + 0x78]
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x70]
lea rdx, str.Status:_d
lea rcx, [rsp + 0x20]
mov r8d, ebx
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [rdi + 0x78]
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x78]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cvtsi2sd xmm0, dword [rdi + 0x1f0]
mov rcx, qword [rdi + 0x78]
cmp ebx, ebp
mov dword [rdi + reloc.MFC80U.DLL_Ordinal_512], eax
mov rax, qword [rcx]
cmovg ebx, ebp
cvtsi2sd xmm1, ebx
mulsd xmm1, qword [rdi + 0x1e8]
addsd xmm1, xmm0
cvttsd2si ebx, xmm1
call qword [rax + 0xa0]
mov rbp, qword [rsp + 0x260]
cmp eax, ebx
jge 0x14012d196
mov rcx, qword [rdi + 0x78]
mov edx, ebx
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp dword [rdi + 0x84], 0
je 0x14012d1b0
mov rdx, rsi
mov rcx, rdi
call fcn.14012be50
test eax, eax
jne 0x14012d1c3
jmp 0x14012d1c8
mov rdx, rsi
mov rcx, rdi
call fcn.1401293c0
test eax, eax
je 0x14012d0a2
mov eax, 1
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140161080
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret
Function at 0x14012efc0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, rdx
mov rdx, r8
mov rbp, r9
mov rsi, rcx
call fcn.14012ee30
test eax, eax
jne 0x14012f0ca
call fcn.140049470
lea rbx, [0x14043e0b0]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea rcx, str.....IncludeDiskIO.h
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x14012f033
xor ebx, ebx
jmp 0x14012f0b0
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x48]
lea r8d, [rax + 0x5d]
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x49], rax
mov word [rsp + 0x51], ax
mov byte [rsp + 0x53], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x14012f070
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x48]
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x14012f0a0
mov rax, qword [rsi]
lea rdx, [0x1402e1048]
mov r8, rbx
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x14012f14a
lea rax, [rsp + 0x44]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x70000
mov rcx, rsi
mov dword [rsp + 0x28], 0x18
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [rsp + 0x5c]
mov ecx, reloc.MFC80U.DLL_Ordinal_512
test eax, eax
lea r9, [rsp + 0x40]
mov rdx, r12
cmove edi, ecx
mov rcx, rsi
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rbx
imul ebp, edi
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14012f148
mov eax, dword [rsp + 0x40]
xor edx, edx
div edi
test edx, edx
jne 0x14012f148
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140161080
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14012f170
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, rdx
mov rdx, r8
mov rbp, r9
mov rsi, rcx
call fcn.14012ee30
test eax, eax
jne 0x14012f27a
call fcn.140049470
lea rbx, [0x14043e0b0]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea rcx, str.....IncludeDiskIO.h
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x14012f1e3
xor ebx, ebx
jmp 0x14012f260
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x48]
lea r8d, [rax + 0x72]
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x49], rax
mov word [rsp + 0x51], ax
mov byte [rsp + 0x53], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x14012f220
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x48]
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x14012f250
mov rax, qword [rsi]
lea rdx, [0x1402e4750]
mov r8, rbx
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x14012f2fa
lea rax, [rsp + 0x44]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x70000
mov rcx, rsi
mov dword [rsp + 0x28], 0x18
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [rsp + 0x5c]
mov ecx, reloc.MFC80U.DLL_Ordinal_512
test eax, eax
lea r9, [rsp + 0x40]
mov rdx, r12
cmove edi, ecx
mov rcx, rsi
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rbx
imul ebp, edi
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14012f2f8
mov eax, dword [rsp + 0x40]
xor edx, edx
div edi
test edx, edx
jne 0x14012f2f8
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140161080
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140135330
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, reloc.MFC80U.DLL_Ordinal_576
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, qword [rdx + 8]
mov rsi, rdx
mov rdi, rcx
test rbx, rbx
je 0x140135398
mov rdx, rbx
call fcn.140135330
test eax, eax
je 0x1401353f8
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x140135398
nop
mov rbx, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140135330
test eax, eax
je 0x1401353f8
test rbx, rbx
mov rdx, rbx
jne 0x140135380
cmp byte [rsi + 0x1c], 1
jne 0x14013550c
cmp byte [rsi + 0x1d], 1
je 0x14013550c
mov rcx, qword [rdi + 0x78]
mov rax, qword [rcx]
call qword [rax + 0xf0]
test eax, eax
je 0x1401353ff
mov rcx, qword [rdi + 0x78]
mov edx, 0x17
mov rax, qword [rcx]
call qword [rax + 0x40]
call fcn.140049470
lea rcx, str..._fatcpyex.cpp
mov rdi, qword [rax]
mov edx, 0x701
mov rbx, rax
call fcn.14012ed40
lea rdx, str._s:_User_cancel_operations.
mov rcx, rbx
mov r8, rax
call qword [rdi + 0x10]
xor eax, eax
jmp 0x140135511
add dword [rdi + 0x210], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rdi + 0x1f4]
cmp eax, 0x3e8
jb 0x1401354cd
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, Ordinal_512
mov word [rsp + 0x30], 0
call sub.ntdll.dll_memset
mov r11d, dword [rdi + 0x210]
mov eax, dword [rdi + 0x20c]
cvtsi2sd xmm1, r11
mov ecx, 0x64
lea rdx, str.File_Items_Updating___u__u___d___...
mov r8d, r11d
mov r9d, eax
cvtsi2sd xmm0, rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x1403b85a8]
cvttsd2si rbx, xmm1
cmp ebx, ecx
cmova ebx, ecx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [rdi + 0x78]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x70]
lea rdx, str.Status:_d
lea rcx, [rsp + 0x30]
mov r8d, ebx
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [rdi + 0x78]
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x78]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, ebx
mov rcx, rdi
mov dword [rdi + 0x1f4], eax
call fcn.14012f830
mov rdx, rsi
mov rcx, rdi
call fcn.140134580
test eax, eax
jne 0x14013550c
call fcn.140049470
lea rcx, str..._fatcpyex.cpp
mov edx, 0x71a
mov rdi, qword [rax]
mov rbx, rax
call fcn.14012ed40
lea rdx, str._s:_Failed_to_Write1stClusNumber.
mov rcx, rbx
mov r8, rax
call qword [rdi + 0x10]
xor eax, eax
jmp 0x140135511
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140161080
lea r11, [rsp + reloc.MFC80U.DLL_Ordinal_576]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140139bb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbx, qword [rdx + 8]
mov rsi, rdx
mov rdi, rcx
test rbx, rbx
je 0x140139c18
mov rdx, rbx
call fcn.140139bb0
test eax, eax
je 0x140139c82
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x140139c18
nop
nop
nop
mov rbx, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140139bb0
test eax, eax
je 0x140139c82
test rbx, rbx
mov rdx, rbx
jne 0x140139c00
add dword [rdi + 0x208], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rdi + 0x1f4]
cmp eax, 0x3e8
jb 0x140139d76
mov rcx, qword [rdi + 0x78]
mov rax, qword [rcx]
call qword [rax + 0xf0]
test eax, eax
je 0x140139c89
mov rcx, qword [rdi + 0x78]
mov edx, 0x17
mov rax, qword [rcx]
call qword [rax + 0x40]
call fcn.140049470
lea rcx, str..._fatcpyex.cpp
mov rdi, qword [rax]
mov edx, reloc.MFC80U.DLL_Ordinal_744
mov rbx, rax
call fcn.14012ed40
lea rdx, str._s:_User_cancel_operations.
mov rcx, rbx
mov r8, rax
call qword [rdi + 0x10]
xor eax, eax
jmp 0x140139da8
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, Ordinal_512
mov qword [rsp + 0x260], rbp
mov word [rsp + 0x20], 0
call sub.ntdll.dll_memset
mov r11d, dword [rdi + 0x208]
mov eax, dword [rdi + 0x204]
mov ebp, 0x64
lea rdx, str.Filesystem_Analysing___d___...
lea rcx, [rsp + 0x20]
cvtsi2sd xmm1, r11
cvtsi2sd xmm0, rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x1403b85a8]
cvttsd2si rbx, xmm1
cmp ebx, ebp
cmova ebx, ebp
mov r8d, ebx
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [rdi + 0x78]
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x70]
lea rdx, str.Status:_d
lea rcx, [rsp + 0x20]
mov r8d, ebx
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [rdi + 0x78]
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x78]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cvtsi2sd xmm0, dword [rdi + 0x1f0]
mov rcx, qword [rdi + 0x78]
cmp ebx, ebp
mov dword [rdi + 0x1f4], eax
mov rax, qword [rcx]
cmovg ebx, ebp
cvtsi2sd xmm1, ebx
mulsd xmm1, qword [rdi + 0x1e8]
addsd xmm1, xmm0
cvttsd2si ebx, xmm1
call qword [rax + 0xa0]
mov rbp, qword [rsp + 0x260]
cmp eax, ebx
jge 0x140139d76
mov rcx, qword [rdi + 0x78]
mov edx, ebx
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp dword [rdi + 0x84], 0
je 0x140139d90
mov rdx, rsi
mov rcx, rdi
call fcn.140138730
test eax, eax
jne 0x140139da3
jmp 0x140139da8
mov rdx, rsi
mov rcx, rdi
call fcn.140136cd0
test eax, eax
je 0x140139c82
mov eax, 1
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140161080
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret
Function at 0x14013bc60
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, rdx
mov rdx, r8
mov rbp, r9
mov rsi, rcx
call fcn.14013bad0
test eax, eax
jne 0x14013bd6a
call fcn.140049470
lea rbx, [0x14043e130]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea rcx, str.....IncludeDiskIO.h
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x14013bcd3
xor ebx, ebx
jmp 0x14013bd50
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x48]
lea r8d, [rax + 0x5d]
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x49], rax
mov word [rsp + 0x51], ax
mov byte [rsp + 0x53], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x14013bd10
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x48]
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x14013bd40
mov rax, qword [rsi]
lea rdx, [0x1402e1048]
mov r8, rbx
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x14013bdea
lea rax, [rsp + 0x44]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x70000
mov rcx, rsi
mov dword [rsp + 0x28], 0x18
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [rsp + 0x5c]
mov ecx, reloc.MFC80U.DLL_Ordinal_512
test eax, eax
lea r9, [rsp + 0x40]
mov rdx, r12
cmove edi, ecx
mov rcx, rsi
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rbx
imul ebp, edi
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14013bde8
mov eax, dword [rsp + 0x40]
xor edx, edx
div edi
test edx, edx
jne 0x14013bde8
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140161080
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14013be10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, rdx
mov rdx, r8
mov rbp, r9
mov rsi, rcx
call fcn.14013bad0
test eax, eax
jne 0x14013bf1a
call fcn.140049470
lea rbx, [0x14043e130]
xor edx, edx
mov rcx, rbx
mov r8d, 0x80
mov rsi, rax
call sub.ntdll.dll_memset
lea rcx, str.....IncludeDiskIO.h
mov edx, 0x5c
call qword [sym.imp.ntdll.dll_strrchr]
test rax, rax
mov rdi, rax
jne 0x14013be83
xor ebx, ebx
jmp 0x14013bf00
xor eax, eax
lea rdx, [0x1402dfd08]
lea rcx, [rsp + 0x48]
lea r8d, [rax + 0x72]
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x49], rax
mov word [rsp + 0x51], ax
mov byte [rsp + 0x53], al
call qword [sym.imp.ntdll.dll_sprintf]
lea rdx, [rdi + 1]
mov rcx, rbx
sub rcx, rdx
nop
nop
movzx eax, byte [rdx]
add rdx, 1
test al, al
mov byte [rcx + rdx - 1], al
jne 0x14013bec0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x48]
nop
nop
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x14013bef0
mov rax, qword [rsi]
lea rdx, [0x1402e4750]
mov r8, rbx
mov rcx, rsi
call qword [rax + 0x10]
xor eax, eax
jmp 0x14013bf9a
lea rax, [rsp + 0x44]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x70000
mov rcx, rsi
mov dword [rsp + 0x28], 0x18
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [rsp + 0x5c]
mov ecx, reloc.MFC80U.DLL_Ordinal_512
test eax, eax
lea r9, [rsp + 0x40]
mov rdx, r12
cmove edi, ecx
mov rcx, rsi
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], rbx
imul ebp, edi
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14013bf98
mov eax, dword [rsp + 0x40]
xor edx, edx
div edi
test edx, edx
jne 0x14013bf98
mov ebx, 1
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140161080
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14013f6c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rsi
push rdi
sub rsp, reloc.MFC80U.DLL_Ordinal_576
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, qword [rdx + 8]
mov rsi, rdx
mov rdi, rcx
test rbx, rbx
je 0x14013f72c
mov rdx, rbx
call fcn.14013f6c0
test eax, eax
je 0x14013f88d
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x14013f72c
nop
nop
nop
mov rbx, qword [rdx + 0x10]
mov rcx, rdi
call fcn.14013f6c0
test eax, eax
je 0x14013f88d
test rbx, rbx
mov rdx, rbx
jne 0x14013f710
cmp byte [rsi + 0x1c], 1
jne 0x14013f891
cmp byte [rsi + 0x1d], 1
je 0x14013f891
add dword [rdi + 0x1c8], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rdi + reloc.MFC80U.DLL_Ordinal_424]
cmp eax, 0x3e8
jb 0x14013f852
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, Ordinal_512
mov qword [rsp + 0x270], rbp
mov word [rsp + 0x30], 0
call sub.ntdll.dll_memset
mov r11d, dword [rdi + 0x1c8]
mov eax, dword [rdi + reloc.MFC80U.DLL_Ordinal_452]
mov ebp, 0x64
lea rdx, str.File_Items_Updating___u__u___d___...
lea rcx, [rsp + 0x30]
mov r9d, eax
cvtsi2sd xmm1, r11
cvtsi2sd xmm0, rax
mov r8d, r11d
divsd xmm1, xmm0
mulsd xmm1, qword [0x1403b85a8]
cvttsd2si rbx, xmm1
cmp ebx, ebp
cmova ebx, ebp
mov dword [rsp + 0x20], ebx
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [rdi + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x70]
lea rdx, str.Status:_d
lea rcx, [rsp + 0x30]
mov r8d, ebx
call qword [sym.imp.MSVCR80.dll__swprintf]
mov rcx, qword [rdi + 0x60]
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x78]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cvtsi2sd xmm0, dword [rdi + 0x198]
mov rcx, qword [rdi + 0x60]
cmp ebx, ebp
mov dword [rdi + reloc.MFC80U.DLL_Ordinal_424], eax
mov rax, qword [rcx]
cmovg ebx, ebp
cvtsi2sd xmm1, ebx
mulsd xmm1, qword [rdi + 0x190]
addsd xmm1, xmm0
cvttsd2si ebx, xmm1
call qword [rax + 0xa0]
mov rbp, qword [rsp + 0x270]
cmp eax, ebx
jge 0x14013f852
mov rcx, qword [rdi + 0x60]
mov edx, ebx
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdx, rsi
mov rcx, rdi
call fcn.14013ef40
test eax, eax
jne 0x14013f891
call fcn.140049470
lea rcx, str...quickmovefat.cpp
mov edx, 0x4b2
mov rdi, qword [rax]
mov rbx, rax
call fcn.14013b9e0
lea rdx, str._s:_Failed_to_Write1stClusNumber.
mov rcx, rbx
mov r8, rax
call qword [rdi + 0x10]
xor eax, eax
jmp 0x14013f896
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140161080
add rsp, reloc.MFC80U.DLL_Ordinal_576
pop rdi
pop rsi
pop rbx
ret