joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ee00
Capabilities:
Create thread

Disassembly:
sub rsp, 0xb8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], r8
call fcn.14002f030
mov rdx, qword [rsp + 0x40]
mov rcx, rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov r9, qword [rsp + 0x68]
xor edx, edx
mov r8d, edx
xor edx, edx
mov rdx, r8
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call sub.KERNEL32.dll_CreateRemoteThread
mov rcx, rax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x88], rcx
call fcn.140046690
test al, 1
jne 0x14002eecf
mov rcx, qword [rsp + 0x50]
call fcn.14001c8a0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
jmp 0x14002eee2
call fcn.14001cea0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 1
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
add rsp, 0xb8
ret

Function at 0x14002ef00
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rcx
mov byte [rbp - 0x2d], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
xor eax, eax
mov ecx, eax
xor edx, edx
call sub.KERNEL32.dll_GetSystemWow64DirectoryA
mov dword [rbp - 0x2c], eax
cmp eax, 0
jne 0x14002ef5f
mov byte [rbp - 0x2d], 1
call fcn.14001cea0
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x38]
call fcn.14001ce00
mov dword [rbp - 0x50], edx
mov dword [rbp - 0x4c], eax
jmp 0x14002ef6c
mov rax, qword [rbp - 0x48]
mov byte [rax + 1], 0
mov byte [rax], 0
jmp 0x14002efd3
mov eax, dword [rbp - 0x50]
mov ecx, dword [rbp - 0x4c]
mov dword [rbp - 0x14], ecx
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x14]
cmp rax, 0
jne 0x14002ef91
lea rcx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001fdll_syringe_0.15.2_srcprocessprocess.rs
call fcn.140137e10
jmp 0x14002ef8f
ud2
mov eax, dword [rbp - 0x10]
mov dword [rbp - 0xc], eax
cmp eax, 0x78
je 0x14002efb1
mov rax, qword [rbp - 0x48]
mov byte [rbp - 0x2d], 0
mov rcx, qword [rbp - 0x38]
mov qword [rax + 8], rcx
mov byte [rax], 1
jmp 0x14002efbc
mov rax, qword [rbp - 0x48]
mov byte [rax + 1], 1
mov byte [rax], 0
test byte [rbp - 0x2d], 1
jne 0x14002efc8
mov byte [rbp - 0x2d], 0
jmp 0x14002efd3
lea rcx, [rbp - 0x38]
call fcn.140034fc0
jmp 0x14002efc2
mov rax, qword [rbp - 0x40]
add rsp, 0x70
pop rbp
ret
Function at 0x140043650
Capabilities:
List groups for user account

Disassembly:
push rbp
sub rsp, 0x140
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov qword [rbp], rdx
mov qword [rbp + 8], rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x88], rdx
mov byte [rbp + 0x87], 0
call fcn.1400433b0
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], 0
mov dword [rbp + 0x2c], 0
lea rax, [0x140141cb8]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], 1
lea rcx, [rbp + 0x20]
call fcn.1400434d0
mov qword [rbp + 0x18], rax
jmp 0x1400436c4
mov rdx, qword [rbp]
mov rcx, qword [rbp + 0x18]
mov rax, rsp
lea r8, [rbp + 0x2c]
mov qword [rax + 0x38], r8
lea r8, [rbp + 0x28]
mov qword [rax + 0x30], r8
mov qword [rax + 0x20], rcx
mov dword [rax + 0x28], 0xffffffff
lea rcx, [0x140141cb8]
xor r8d, r8d
mov r9d, 1
call sub.NETAPI32.dll_NetUserGetLocalGroups
mov dword [rbp - 4], eax
jmp 0x140043704
mov eax, dword [rbp - 4]
mov dword [rbp + 0x94], eax
cmp eax, 0
je 0x14004371d
lea rcx, [rbp + 0x68]
call fcn.14005b0c0
jmp 0x14004372d
mov eax, dword [rbp + 0x28]
mov edx, eax
lea rcx, [rbp + 0x50]
call fcn.14005ad00
jmp 0x14004378b
mov byte [rbp + 0x87], 1
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 8]
mov byte [rbp + 0x87], 0
mov rcx, qword [rbp + 0x30]
mov qword [rax], rcx
mov rcx, qword [rbp + 0x38]
mov qword [rax + 8], rcx
mov rcx, qword [rbp + 0x40]
mov qword [rax + 0x10], rcx
mov byte [rbp + 0x87], 0
lea rcx, [rbp + 0x20]
call fcn.14003f7c0
mov rax, qword [rbp + 0x10]
add rsp, 0x140
pop rbp
ret
mov byte [rbp + 0x87], 1
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x40], rax
movups xmm0, xmmword [rbp + 0x50]
movaps xmmword [rbp + 0x30], xmm0
mov rcx, qword [rbp + 0x20]
call fcn.140070260
mov byte [rbp - 5], al
jmp 0x1400437b0
mov al, byte [rbp - 5]
test al, 1
jne 0x14004374c
jmp 0x1400437b9
mov rcx, qword [rbp + 0x20]
mov eax, dword [rbp + 0x28]
mov edx, eax
call fcn.140055b40
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rax
jmp 0x1400437d1
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov qword [rbp + 0x98], rcx
mov qword [rbp + 0xa0], rdx
call fcn.140070be0
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rax
jmp 0x1400437f6
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
call fcn.14006da60
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rax
jmp 0x14004380d
mov r8, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp + 0x30]
call fcn.14005df50
jmp 0x140043820
jmp 0x14004374c
Function at 0x140049a00
Capabilities:
Reference wmi statements

Disassembly:
push rbp
sub rsp, 0x140
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x20], rcx
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp - 0x18], 0
cmp qword [rdx + 0x10], 1
je 0x140049a4e
jmp 0x140049a8e
mov rax, qword [rbp - 0x30]
add rax, 0x18
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x38], rax
lea rcx, [0x14014220a]
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x48], 4
mov qword [rbp + 0xa8], rcx
mov qword [rbp + 0xb0], 4
call sub.OLEAUT32.dll_SysReAllocString
mov qword [rbp - 0x38], rax
jmp 0x140049a9e
mov rax, qword [rbp - 0x28]
mov qword [rax], 2
jmp 0x140049bbe
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0x50], rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x60], 0x2c
mov qword [rbp + 0x98], rcx
mov qword [rbp + 0xa0], 0x2c
call sub.OLEAUT32.dll_SysReAllocString
mov qword [rbp - 0x48], rax
jmp 0x140049ad6
mov r8, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0x68], r8
mov rcx, qword [rax]
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov rax, rsp
lea r9, [rbp - 0x18]
mov qword [rax + 0x28], r9
mov qword [rax + 0x20], 0
mov r9d, 0x30
call fcn.140059ad0
mov dword [rbp - 0x4c], eax
jmp 0x140049b1f
mov rcx, qword [rbp - 0x38]
mov eax, dword [rbp - 0x4c]
mov dword [rbp + 0x74], eax
call sub.OLEAUT32.dll_SysStringLen
jmp 0x140049b30
mov rcx, qword [rbp - 0x48]
call sub.OLEAUT32.dll_SysStringLen
jmp 0x140049b3b
mov ecx, dword [rbp - 0x4c]
call fcn.140045f10
mov byte [rbp - 0x4d], al
jmp 0x140049b48
mov al, byte [rbp - 0x4d]
test al, 1
jne 0x140049b70
jmp 0x140049b51
mov rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x18]
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], 1
add rcx, 0x20
call fcn.140041c80
jmp 0x140049b7d
mov rax, qword [rbp - 0x28]
mov qword [rax], 2
jmp 0x140049bbe
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rdx + 0x20], rcx
mov qword [rdx + 0x28], rax
mov rcx, rbp
mov r8d, 0x38
call fcn.140136190
mov rcx, qword [rbp - 0x28]
mov rdx, rbp
mov r8d, 0x38
call fcn.140136190
mov rax, qword [rbp - 0x20]
add rsp, 0x140
pop rbp
ret
mov rcx, qword [rbp - 0x30]
call fcn.140040d30
jmp 0x140049bb1
Function at 0x14004c7f0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x378
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0xd8], rcx
mov byte [rsp + 0x25f], 0
mov qword [rsp + 0x260], 1
mov byte [rsp + 0x26f], 0
mov qword [rsp + 0x270], 1
lea rax, [rsp + 0x2b8]
mov qword [rsp + 0x338], rax
lea rax, [rsp + 0x2b8]
mov qword [rsp + 0x340], rax
lea rcx, [rsp + 0x2b8]
mov edx, 8
call fcn.14003ea40
lea rcx, [rsp + 0x2b8]
xor edx, edx
mov r8d, 0x40
call fcn.140136830
lea rcx, [rsp + 0x278]
lea rdx, [rsp + 0x2b8]
mov r8d, 0x40
call fcn.140136190
lea rcx, [rsp + 0x2f8]
lea rdx, [rsp + 0x278]
mov r8d, 0x40
call fcn.140136190
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x2f8]
mov r8d, 0x40
call fcn.140136190
mov eax, 0x40
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x30]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0x138], rax
mov rax, qword [rsp + 0x40]
mov qword [rcx + 0x140], rax
mov byte [rsp + 0xf7], 0
mov qword [rsp + 0xf8], 1
mov byte [rsp + 0x107], 0
mov qword [rsp + 0x108], 1
lea rax, [rsp + 0x178]
mov qword [rsp + 0x248], rax
lea rax, [rsp + 0x178]
mov qword [rsp + 0x250], rax
lea rcx, [rsp + 0x178]
mov edx, 8
call fcn.14003ea40
lea rcx, [rsp + 0x178]
xor edx, edx
mov r8d, 0x68
call fcn.140136830
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x178]
mov r8d, 0x68
call fcn.140136190
lea rcx, [rsp + 0x1e0]
lea rdx, [rsp + 0x110]
mov r8d, 0x68
call fcn.140136190
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x1e0]
mov r8d, 0x68
call fcn.140136190
mov eax, 0x68
mov edx, eax
lea rcx, [rsp + 0x70]
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
je 0x14004c9cc
add rsp, 0x378
ret
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x80]
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x368], r8
xor edx, edx
sub rax, r8
cmovb rax, rdx
mov qword [rsp + 0x370], rax
mov rdx, qword [rsp + 0x370]
call fcn.14003cdf0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x78]
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0x348], rax
mov qword [rsp + 0x350], r8
xor edx, edx
sub rax, r8
cmovb rax, rdx
mov qword [rsp + 0x358], rax
mov rdx, qword [rsp + 0x358]
call fcn.14003cdf0
mov rdx, qword [rsp + 0x20]
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xe8], rcx
mov qword [rax + 0x148], rdx
mov qword [rax + 0x150], rcx
jmp 0x14004c9c4
Function at 0x14004ee10
Capabilities:
Check os version

Disassembly:
sub rsp, 0x388
mov qword [rsp + 0x260], rcx
lea rcx, [rsp + 0x144]
call fcn.140057eb0
lea rcx, [rsp + 0x26c]
lea rdx, [rsp + 0x144]
mov r8d, 0x11c
call fcn.140136190
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x26c]
mov r8d, 0x11c
call fcn.140136190
mov eax, 0x11c
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
mov ecx, eax
call fcn.14004ab50
test al, 1
jne 0x14004ee85
mov byte [rsp + 0x27], 1
jmp 0x14004ee8e
cmp dword [rsp + 0x2c], 6
ja 0x14004eea8
jmp 0x14004ee9f
mov al, byte [rsp + 0x27]
and al, 1
movzx eax, al
add rsp, 0x388
ret
cmp dword [rsp + 0x2c], 6
je 0x14004eeaf
jmp 0x14004eebf
mov byte [rsp + 0x27], 1
jmp 0x14004ee8e
cmp dword [rsp + 0x30], 3
setae al
and al, 1
mov byte [rsp + 0x27], al
jmp 0x14004ee8e
mov byte [rsp + 0x27], 0
jmp 0x14004ee8e
Function at 0x1400503c0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
sub rsp, 0x140
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov qword [rbp - 0x18], rdx
mov rax, rcx
mov rcx, qword [rbp - 0x18]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp + 0x58], rcx
mov eax, dword [rbp + 0xb4]
mov dword [rbp + 0xc], eax
lea rax, [rbp + 0xc]
mov qword [rbp + 0xa0], rax
lea rdx, [rbp + 0xc]
call sub.SHELL32.dll_CommandLineToArgvW
mov rcx, rax
mov qword [rbp], rcx
mov qword [rbp + 0x60], rcx
call fcn.14004a400
test al, 1
jne 0x140050471
mov rcx, qword [rbp]
movsxd rdx, dword [rbp + 0xc]
mov eax, edx
mov dword [rbp + 0xac], eax
mov dword [rbp + 0xb0], eax
mov dword [rbp + 0x6c], eax
call fcn.140055b00
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rdx
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rdx
lea rcx, [rbp + 0x10]
call fcn.14005b0c0
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
call fcn.14006dbc0
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rax
jmp 0x14005047c
mov rcx, qword [rbp - 0x10]
call fcn.14005b0c0
jmp 0x1400504f7
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x20]
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x28]
call fcn.14006e620
mov qword [rbp - 0x40], rax
jmp 0x14005049b
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
cmp rax, 0
sete al
test al, 1
jne 0x1400504b4
jmp 0x1400504bf
mov rcx, qword [rbp]
call sub.KERNEL32.dll_LocalFree
jmp 0x1400504dc
mov rax, qword [rbp + 0x38]
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x80], rax
mov rcx, qword [rax]
call fcn.14012b6bc
mov qword [rbp - 0x48], rax
jmp 0x140050504
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov rcx, qword [rbp + 0x18]
mov qword [rax + 8], rcx
mov rcx, qword [rbp + 0x20]
mov qword [rax + 0x10], rcx
mov rax, qword [rbp - 8]
add rsp, 0x140
pop rbp
ret
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x88], rdx
mov rcx, qword [rax]
call fcn.140055ac0
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x58], rax
jmp 0x140050525
mov r8, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov qword [rbp + 0x90], rdx
mov qword [rbp + 0x98], r8
lea rcx, [rbp + 0x40]
call fcn.1400563b0
jmp 0x140050546
lea rcx, [rbp + 0x10]
lea rdx, [rbp + 0x40]
call fcn.14005c7a0
jmp 0x140050555
jmp 0x14005048c
Function at 0x14006ca30
Capabilities:
Get disk size

Disassembly:
sub rsp, 0xb8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rcx
cmp qword [rcx + 0x78], 0
jne 0x14006ca52
mov byte [rsp + 0x2f], 0
jmp 0x14006cb5e
mov byte [rsp + 0x4f], 0
mov qword [rsp + 0x50], 1
mov byte [rsp + 0x5f], 0
mov qword [rsp + 0x60], 1
lea rax, [rsp + 0x78]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x78]
mov edx, 8
call fcn.14003ea40
lea rcx, [rsp + 0x78]
xor edx, edx
mov r8d, 8
call fcn.140136830
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
add rcx, 0x48
call fcn.14005c890
mov rcx, rax
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
xor eax, eax
mov r8d, eax
lea r9, [rsp + 0x30]
mov rdx, r8
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
cmp eax, 0
je 0x14006ca48
lea rcx, [rsp + 0x30]
call fcn.14004ab70
mov rcx, rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rcx]
mov qword [rax + 0x80], rcx
mov byte [rsp + 0x2f], 1
mov al, byte [rsp + 0x2f]
and al, 1
movzx eax, al
add rsp, 0xb8
ret
Function at 0x14006cc70
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x138
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov byte [rsp + 0xcf], 0
mov qword [rsp + 0xd0], 1
mov byte [rsp + 0xdf], 0
mov qword [rsp + 0xe0], 1
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x110], rax
lea rcx, [rsp + 0xf8]
mov edx, 8
call fcn.14003ea40
lea rcx, [rsp + 0xf8]
xor edx, edx
mov r8d, 8
call fcn.140136830
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x7f], 0
mov qword [rsp + 0x80], 1
mov byte [rsp + 0x8f], 0
mov qword [rsp + 0x90], 1
lea rax, [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0xa8]
mov edx, 8
call fcn.14003ea40
lea rcx, [rsp + 0xa8]
xor edx, edx
mov r8d, 8
call fcn.140136830
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x128], rcx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
xor eax, eax
mov edx, eax
lea r8, [rsp + 0x48]
lea r9, [rsp + 0x50]
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
cmp eax, 0
jne 0x14006ce56
mov rax, qword [rsp + 0x28]
mov qword [rax], 0
jmp 0x14006ce91
lea rcx, [rsp + 0x48]
call fcn.14004ab70
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x50]
call fcn.14004ab70
mov rdx, qword [rsp + 0x20]
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rcx]
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rcx
mov qword [rax], 1
mov rax, qword [rsp + 0x30]
add rsp, 0x138
ret

Function at 0x14006cea0
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14006ceca
mov rcx, qword [rsp + 0x30]
call fcn.14005b080
jmp 0x14006ceff
xor ecx, ecx
mov edx, 0x20
call fcn.140059e20
mov dword [rsp + 0x2c], eax
mov r8d, edx
mov edx, dword [rsp + 0x2c]
lea rcx, [rsp + 0x48]
lea r9, [rsp + 0x44]
call fcn.140070850
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x48]
call fcn.14004e1b0
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret
Function at 0x140103e40
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140103ee0
jmp 0x140103ecf
jae 0x140103f9f
cmp r8, 0x201
jae 0x140103ee0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140103f37
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x140103f0f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.140136f30
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140103f60
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14010400b
mov r8d, r13d
cmp r12, r8
jne 0x140103ec0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14010403f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140103ecf
jmp 0x140103ee0
cmp r14, r8
jb 0x140104059
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140106e30
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140103ff4
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140017d50
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x140103fdf
jmp 0x140103ff4
lea rcx, str.internal_error:_entered_unreachable_codeXj
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.140137f50
jmp 0x14010406e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140138400
ud2
Function at 0x14010adb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10b8
call fcn.140127430
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1020], xmm6
mov qword [rbp + 0x1018], 0xfffffffffffffffe
mov qword [rbp + 0x1008], rdx
mov r15, rcx
lea r12, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, r12
xor edx, edx
call fcn.140136830
xorps xmm6, xmm6
lea r13, [rbp + 0xffc]
lea rbx, [0x140110e30]
lea r14, [rbp + 0xfb0]
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov rdi, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1010], r15
mov r8d, 0x1000
mov rcx, r15
mov rdx, r12
call fcn.140110c00
mov r15, rdx
mov qword [rbp + 0xfd8], rax
mov qword [rbp + 0xfe0], rdx
test rax, rax
jne 0x14010afa0
test r15, r15
je 0x14010af6c
cmp r15, 0x1000
ja 0x14010afc2
xor r12d, r12d
nop word cs:[rax + rax]
mov r8d, r15d
sub r8d, r12d
lea rdx, [r12 + rbp]
add rdx, 0xffffffffffffffb0
mov dword [rbp + 0xffc], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r13
mov qword [rsp + 0x20], rbx
mov rcx, qword [rbp + 0x1008]
mov r9, r14
call rsi
test eax, eax
je 0x14010af40
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call rdi
cmp dword [rbp + 0xffc], 0
je 0x14010aed0
mov ecx, dword [rbp + 0x1000]
mov eax, dword [rbp + 0x1004]
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
xor r8d, r8d
test ecx, ecx
setne r8b
cmove rdx, rax
mov qword [rbp + 0xfe8], r8
mov qword [rbp + 0xff0], rdx
jne 0x14010af60
add r12, rax
cmp r12, r15
je 0x14010af30
jbe 0x14010ae80
jmp 0x14010afae
mov r15, qword [rbp + 0x1010]
lea r12, [rbp - 0x50]
jmp 0x14010ae2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0xfe8], 1
mov qword [rbp + 0xff0], rax
lea rcx, [rbp + 0xff0]
call fcn.1400fe2b0
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1010]
call rsi
mov rcx, qword [rbp + 0x1008]
call rsi
movaps xmm6, xmmword [rbp + 0x1020]
add rsp, 0x10b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0xfe0]
call fcn.1400fe2b0
jmp 0x14010af6c
lea r8, str.library_std_src_syspalwindowspipe.rs
mov rcx, r12
mov rdx, r15
call fcn.140138470
jmp 0x14010afd6
lea r8, str.library_std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r15
call fcn.140138400
ud2