joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ab60
Capabilities:
Create directory

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rsi
movzx esi, dl
lea rdx, [rbp + 0x28]
call fcn.140027be0
mov rax, qword [rbp + 0x28]
cmp dword [rax + 4], 0
jne 0x14002ab8e
lea rdx, str.Empty_filename_passed_to_function
jmp 0x14002abaf
xor ebx, ebx
lea rcx, [rbp + 0x28]
xor r8d, r8d
movzx edx, bx
lea r9d, [rbx + 1]
call fcn.140007460
cmp eax, 0xffffffff
je 0x14002abe6
lea rdx, str.Broken_filename_passed_to_function
xorps xmm0, xmm0
mov qword [rbp - 0x30], 2
lea rax, str.default
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x18], rax
movdqu xmmword [rbp - 0x28], xmm0
call fcn.140012e50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor bl, bl
mov dword [rax], 0x16
jmp 0x14002acef
lea rdx, [rbp + 0x28]
mov qword [rsp + 0x50], rdi
lea rcx, [rbp - 0x38]
call fcn.14000fa20
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.1400103a0
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rax]
mov qword [rbp + 0x28], rcx
mov qword [rax], rdx
mov rcx, qword [rbp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14002ac2c
cmp eax, 0xffffffff
je 0x14002ac3a
sub eax, 1
mov dword [rcx], eax
jne 0x14002ac3a
mov rcx, qword [rbp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
mov rcx, qword [rbp - 0x38]
mov eax, dword [rcx]
test eax, eax
je 0x14002ac54
cmp eax, 0xffffffff
je 0x14002ac62
sub eax, 1
mov dword [rcx], eax
jne 0x14002ac62
mov rcx, qword [rbp - 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x30]
call fcn.140031c70
lea rcx, [rbp + 0x30]
call fcn.14000a850
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne dil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x30]
mov ebx, eax
mov edx, dword [rcx]
test edx, edx
je 0x14002acab
cmp edx, 0xffffffff
je 0x14002acb9
sub edx, 1
mov dword [rcx], edx
jne 0x14002acb9
mov rcx, qword [rbp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
test dil, dil
mov rdi, qword [rsp + 0x50]
je 0x14002acc7
mov bl, 1
jmp 0x14002acef
test sil, sil
jne 0x14002acd0
xor bl, bl
jmp 0x14002acef
lea rcx, [rbp + 0x28]
cmp ebx, 0xb7
jne 0x14002ace5
xor edx, edx
call fcn.14002c7e0
jmp 0x14002acec
xor edx, edx
call fcn.14002ad30
movzx ebx, al
mov rcx, qword [rbp + 0x28]
mov rsi, qword [rsp + 0x70]
mov edx, dword [rcx]
test edx, edx
je 0x14002ad0e
cmp edx, 0xffffffff
je 0x14002ad1c
sub edx, 1
mov dword [rcx], edx
jne 0x14002ad1c
mov rcx, qword [rbp + 0x28]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
movzx eax, bl
add rsp, 0x58
pop rbx
pop rbp
ret
Function at 0x14002ad30
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov dword [rsp + 0x20], 2
lea rax, [0x1400730a4]
mov qword [rsp + 0x28], rax
movzx edi, dl
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x20]
mov r8d, 1
movdqa xmmword [rsp + 0x20], xmm0
mov rbx, rcx
call fcn.140009a10
test al, al
je 0x14002ad97
lea rcx, [rsp + 0x50]
call fcn.140010390
mov r8d, 1
mov rcx, rbx
movzx edx, word [rax]
call fcn.140006800
cmp eax, 3
jle 0x14002af1c
mov rcx, qword [rbx]
cmp dword [rcx + 4], 2
jne 0x14002adb0
mov rax, qword [rcx + 0x10]
cmp word [rax + rcx + 2], 0x3a
je 0x14002af1c
test dil, dil
je 0x14002ae19
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140031c70
lea rcx, [rsp + 0x50]
call fcn.14000a850
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x50]
test eax, eax
setne dil
mov eax, dword [rcx]
test eax, eax
je 0x14002adf9
cmp eax, 0xffffffff
je 0x14002ae07
sub eax, 1
mov dword [rcx], eax
jne 0x14002ae07
mov rcx, qword [rsp + 0x50]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
test dil, dil
je 0x14002ae19
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea rcx, [rsp + 0x50]
call fcn.140010390
mov r9d, 1
mov rcx, rbx
movzx edx, word [rax]
lea r8d, [r9 - 2]
call fcn.140007870
cmp eax, 1
jl 0x14002af1c
mov r8d, eax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1400078b0
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.14002ad30
test al, al
je 0x14002aedd
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140031c70
lea rcx, [rsp + 0x50]
call fcn.14000a850
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x50]
test eax, eax
setne dil
mov eax, dword [rcx]
test eax, eax
je 0x14002aea5
cmp eax, 0xffffffff
je 0x14002aeb3
sub eax, 1
mov dword [rcx], eax
jne 0x14002aeb3
mov rcx, qword [rsp + 0x50]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
test dil, dil
je 0x14002aebc
mov bl, 1
jmp 0x14002aedf
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x50], 0
mov rcx, rbx
call fcn.14002c7e0
test al, al
je 0x14002aedd
cmp byte [rsp + 0x50], 0
je 0x14002aedd
mov bl, 1
jmp 0x14002aedf
xor bl, bl
mov rcx, qword [rsp + 0x58]
mov r9d, dword [rcx]
test r9d, r9d
je 0x14002af00
cmp r9d, 0xffffffff
je 0x14002af0e
sub r9d, 1
mov dword [rcx], r9d
jne 0x14002af0e
mov rcx, qword [rsp + 0x58]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x14002c7e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1400c6158]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rax, qword [rcx]
mov rdi, rdx
mov qword [rsp + 0x20], rax
mov r8d, dword [rax]
lea ecx, [r8 + 1]
cmp ecx, 1
jbe 0x14002c821
lea ecx, [r8 + 1]
mov dword [rax], ecx
mov rax, qword [rsp + 0x20]
cmp dword [rax + 4], 2
jne 0x14002c891
mov rcx, qword [rax + 0x10]
cmp word [rcx + rax + 2], 0x3a
jne 0x14002c891
cmp dword [rax], 1
ja 0x14002c844
mov ecx, dword [rax + 8]
btr ecx, 0x1f
cmp ecx, 4
jae 0x14002c85b
mov r8b, 1
lea rcx, [rsp + 0x20]
mov edx, 4
call fcn.140008720
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
movsxd rdx, dword [rax + 4]
lea r8, [rcx + rdx*2]
mov ecx, 0x5c
mov word [r8 + rax], cx
mov rax, qword [rsp + 0x20]
inc dword [rax + 4]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
movsxd rdx, dword [rax + 4]
lea r8, [rcx + rdx*2]
xor ecx, ecx
mov word [r8 + rax], cx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140031c70
lea rcx, [rsp + 0x28]
call fcn.14000a850
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14002c8f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x14002c8ca
cmp eax, 0x20
jne 0x14002c8f9
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x30], rcx
mov edx, dword [rcx]
lea eax, [rdx + 1]
cmp eax, 1
jbe 0x14002c8e3
lea eax, [rdx + 1]
mov dword [rcx], eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14002be50
test al, al
cmovne ebx, dword [rsp + 0x40]
test rdi, rdi
je 0x14002c906
cmp ebx, 0xffffffff
setne al
mov byte [rdi], al
cmp ebx, 0xffffffff
jne 0x14002c90f
xor bl, bl
jmp 0x14002c915
shr ebx, 4
and bl, 1
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx]
test eax, eax
je 0x14002c931
cmp eax, 0xffffffff
je 0x14002c93f
sub eax, 1
mov dword [rcx], eax
jne 0x14002c93f
mov rcx, qword [rsp + 0x28]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14002c95b
cmp eax, 0xffffffff
je 0x14002c969
sub eax, 1
mov dword [rcx], eax
jne 0x14002c969
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
movzx eax, bl
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400382e0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x2a0
pop rdi
ret
Function at 0x14002d2c0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
call fcn.14002c990
test al, al
je 0x14002d32b
lea rdx, str.Empty_filename_passed_to_function
lea rax, str.default
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x28], xmm0
call fcn.140012e50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
xor al, al
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x50], rbp
mov rcx, rdi
call fcn.140028000
xor ebx, ebx
xor r8d, r8d
movzx edx, bx
mov rcx, rax
lea r9d, [rbx + 1]
call fcn.140007460
mov rcx, qword [rsp + 0x60]
cmp eax, 0xffffffff
setne bpl
mov eax, dword [rcx]
test eax, eax
je 0x14002d374
cmp eax, 0xffffffff
je 0x14002d382
sub eax, 1
mov dword [rcx], eax
jne 0x14002d382
mov rcx, qword [rsp + 0x60]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
test bpl, bpl
mov rbp, qword [rsp + 0x50]
je 0x14002d398
lea rdx, str.Broken_filename_passed_to_function
jmp 0x14002d2e5
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140028000
mov rcx, rax
call fcn.14000a850
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x60]
test eax, eax
setne bl
mov eax, dword [rcx]
test eax, eax
je 0x14002d3d7
cmp eax, 0xffffffff
je 0x14002d3e5
sub eax, 1
mov dword [rcx], eax
jne 0x14002d3e5
mov rcx, qword [rsp + 0x60]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
test bl, bl
jne 0x14002d403
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], 2
mov rcx, qword [rsp + 0x60]
mov qword [rsi], rcx
mov rsi, qword [rsp + 0x68]
movzx eax, bl
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14002d420
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, r8
mov rdi, rdx
mov rsi, rcx
call fcn.14002c990
test al, al
je 0x14002d485
xorps xmm0, xmm0
mov qword [rbp - 0x28], 2
lea rax, str.default
lea rdx, str.Empty_filename_passed_to_function
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x28]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.140012e50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
xor al, al
jmp 0x14002d634
lea rdx, [rbp + 0x38]
mov qword [rsp + 0x70], r14
mov rcx, rsi
call fcn.140028000
xor ebx, ebx
xor r8d, r8d
movzx edx, bx
mov rcx, rax
lea r9d, [rbx + 1]
call fcn.140007460
mov rcx, qword [rbp + 0x38]
cmp eax, 0xffffffff
setne r14b
mov eax, dword [rcx]
test eax, eax
je 0x14002d4cb
cmp eax, 0xffffffff
je 0x14002d4d9
sub eax, 1
mov dword [rcx], eax
jne 0x14002d4d9
mov rcx, qword [rbp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
test r14b, r14b
jne 0x14002d547
mov rcx, rdi
call fcn.14002c990
test al, al
je 0x14002d4f3
lea rdx, str.Empty_filename_passed_to_function
jmp 0x14002d54e
lea rdx, [rbp + 0x38]
mov rcx, rdi
call fcn.140028000
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.140007460
mov rcx, qword [rbp + 0x38]
cmp eax, 0xffffffff
setne r14b
mov eax, dword [rcx]
test eax, eax
je 0x14002d534
cmp eax, 0xffffffff
je 0x14002d542
sub eax, 1
mov dword [rcx], eax
jne 0x14002d542
mov rcx, qword [rbp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
test r14b, r14b
je 0x14002d585
lea rdx, str.Broken_filename_passed_to_function
lea rax, str.default
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x28]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.140012e50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
xor al, al
jmp 0x14002d62f
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.140028000
mov rcx, rax
call fcn.14000a850
lea rdx, [rbp + 0x38]
mov rcx, rsi
mov rbx, rax
call fcn.140028000
mov rcx, rax
call fcn.14000a850
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rcx, qword [rbp + 0x38]
test eax, eax
setne bl
mov eax, dword [rcx]
test eax, eax
je 0x14002d5db
cmp eax, 0xffffffff
je 0x14002d5e9
sub eax, 1
mov dword [rcx], eax
jne 0x14002d5e9
mov rcx, qword [rbp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
mov rcx, qword [rbp - 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14002d603
cmp eax, 0xffffffff
je 0x14002d611
sub eax, 1
mov dword [rcx], eax
jne 0x14002d611
mov rcx, qword [rbp - 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
test bl, bl
jne 0x14002d62c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x38], eax
mov dword [rbp + 0x3c], 2
mov rcx, qword [rbp + 0x38]
mov qword [r15], rcx
movzx eax, bl
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret
Function at 0x14002d650
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x50
mov r15, r8
mov rdi, rdx
mov rsi, rcx
call fcn.14002c990
test al, al
je 0x14002d6b5
xorps xmm0, xmm0
mov qword [rbp - 0x28], 2
lea rax, str.default
lea rdx, str.Empty_filename_passed_to_function
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x28]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.140012e50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
xor al, al
jmp 0x14002d86a
lea rdx, [rbp + 0x38]
mov qword [rsp + 0x70], r14
mov rcx, rsi
call fcn.140028000
xor ebx, ebx
xor r8d, r8d
movzx edx, bx
mov rcx, rax
lea r9d, [rbx + 1]
call fcn.140007460
mov rcx, qword [rbp + 0x38]
cmp eax, 0xffffffff
setne r14b
mov eax, dword [rcx]
test eax, eax
je 0x14002d6fb
cmp eax, 0xffffffff
je 0x14002d709
sub eax, 1
mov dword [rcx], eax
jne 0x14002d709
mov rcx, qword [rbp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
test r14b, r14b
jne 0x14002d777
mov rcx, rdi
call fcn.14002c990
test al, al
je 0x14002d723
lea rdx, str.Empty_filename_passed_to_function
jmp 0x14002d77e
lea rdx, [rbp + 0x38]
mov rcx, rdi
call fcn.140028000
mov r9d, 1
xor r8d, r8d
movzx edx, bx
mov rcx, rax
call fcn.140007460
mov rcx, qword [rbp + 0x38]
cmp eax, 0xffffffff
setne r14b
mov eax, dword [rcx]
test eax, eax
je 0x14002d764
cmp eax, 0xffffffff
je 0x14002d772
sub eax, 1
mov dword [rcx], eax
jne 0x14002d772
mov rcx, qword [rbp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
test r14b, r14b
je 0x14002d7b5
lea rdx, str.Broken_filename_passed_to_function
lea rax, str.default
mov qword [rbp - 0x28], 2
xorps xmm0, xmm0
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x28]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.140012e50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
xor al, al
jmp 0x14002d865
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.140028000
mov rcx, rax
call fcn.14000a850
lea rdx, [rbp + 0x38]
mov rcx, rsi
mov rbx, rax
call fcn.140028000
mov rcx, rax
call fcn.14000a850
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, qword [rbp + 0x38]
test eax, eax
setne bl
mov eax, dword [rcx]
test eax, eax
je 0x14002d811
cmp eax, 0xffffffff
je 0x14002d81f
sub eax, 1
mov dword [rcx], eax
jne 0x14002d81f
mov rcx, qword [rbp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
mov rcx, qword [rbp - 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14002d839
cmp eax, 0xffffffff
je 0x14002d847
sub eax, 1
mov dword [rcx], eax
jne 0x14002d847
mov rcx, qword [rbp - 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
test bl, bl
jne 0x14002d862
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x38], eax
mov dword [rbp + 0x3c], 2
mov rcx, qword [rbp + 0x38]
mov qword [r15], rcx
movzx eax, bl
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret
Function at 0x14002d880
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.140031c70
mov rcx, rax
call fcn.14000a850
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rsp + 0x38]
test eax, eax
setne bl
mov eax, dword [rcx]
test eax, eax
je 0x14002d8c5
cmp eax, 0xffffffff
je 0x14002d8d3
sub eax, 1
mov dword [rcx], eax
jne 0x14002d8d3
mov rcx, qword [rsp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
movzx eax, bl
add rsp, 0x20
pop rbx
ret

Function at 0x14002dd10
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x50], rbx
mov rbp, rdx
mov qword [rsp + 0x58], r14
xor sil, sil
mov r14, rcx
xor edi, edi
call fcn.140027d50
test al, al
je 0x14002ddba
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, ebx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140027be0
mov rdx, qword [rax]
mov rcx, qword [rdx + 0x10]
movzx ecx, word [rcx + rdx]
call fcn.140009c80
mov ebx, 1
lea ecx, [rax - 0x41]
shl ebx, cl
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx]
test eax, eax
je 0x14002dd9a
cmp eax, 0xffffffff
je 0x14002dda8
sub eax, 1
mov dword [rcx], eax
jne 0x14002dda8
mov rcx, qword [rsp + 0x60]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
and ebx, edi
setne sil
neg ebx
sbb edi, edi
and edi, 0x14
jmp 0x14002de94
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140028000
mov dword [rsp + 0x20], 7
lea rax, str._UNC
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x60]
mov ebx, 1
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, ebx
call fcn.140009a10
test al, al
je 0x14002de6b
mov rax, qword [rsp + 0x60]
lea r8d, [rbx + 6]
mov r9d, ebx
mov rcx, qword [rax + 0x10]
movzx edx, word [rax + rcx]
lea rcx, [rsp + 0x60]
call fcn.140007460
mov r8d, eax
test eax, eax
jle 0x14002de55
mov rax, qword [rsp + 0x60]
inc r8d
mov r9d, ebx
mov rcx, qword [rax + 0x10]
movzx edx, word [rax + rcx]
lea rcx, [rsp + 0x60]
call fcn.140007460
test eax, eax
jle 0x14002de55
mov rcx, qword [rsp + 0x60]
mov edx, dword [rcx + 4]
dec edx
cmp eax, edx
jne 0x14002de70
lea rcx, [rsp + 0x60]
call fcn.14002e0e0
test al, al
je 0x14002de6b
mov edi, 0x10
movzx esi, bl
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx]
test eax, eax
je 0x14002de86
cmp eax, 0xffffffff
je 0x14002de94
sub eax, ebx
mov dword [rcx], eax
jne 0x14002de94
mov rcx, qword [rsp + 0x60]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
test sil, sil
je 0x14002dec8
mov dword [rbp + 0x10], edi
test dil, 0x10
mov ecx, 0x20000
mov eax, 0x40000
cmovne ecx, eax
or ecx, dword [rbp + 4]
bts ecx, 0x16
mov dword [rbp + 4], ecx
or dword [rbp], 0x560000
movzx eax, sil
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002dee0
Capabilities:
Enumerate network shares

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r14, qword [rsp + 0x58]
xor edi, edi
mov dword [rsp + 0xc0], edi
mov r15, rdx
mov dword [rax + 0x18], edi
mov r13, rcx
mov dword [rax - 0x68], edi
mov dword [rax + 0x20], edi
mov rcx, r13
call fcn.14000a850
mov rcx, rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0xc8]
mov r9d, 0xffffffff
mov qword [rsp + 0x30], rax
mov edx, 1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
call sub.NETAPI32.dll_NetShareEnum
mov r12d, eax
test eax, eax
je 0x14002df6d
cmp eax, 0xea
jne 0x14002e0a2
mov rsi, qword [rsp + 0x50]
mov ebp, 1
cmp dword [rsp + 0xc0], ebp
jb 0x14002e0a2
lea r13, [0x14003b290]
nop dword [rax + rax]
test r15, r15
je 0x14002e087
cmp dword [rsi + 8], 0
jne 0x14002e087
mov rdx, qword [rsi]
lea rcx, [rsp + 0x48]
mov r8d, 0xffffffff
or edi, 1
call fcn.140007370
mov rbx, qword [rax]
mov qword [rax], r13
test dil, 2
je 0x14002dfeb
mov eax, dword [r14]
and edi, 0xfffffffd
test eax, eax
je 0x14002dfda
cmp eax, 0xffffffff
je 0x14002dfeb
sub dword [r14], 1
jne 0x14002dfeb
mov edx, 2
mov rcx, r14
lea r8d, [rdx + 6]
call fcn.140003e30
mov rcx, qword [rsp + 0x48]
and edi, 0xfffffffe
mov eax, dword [rcx]
test eax, eax
je 0x14002e00a
cmp eax, 0xffffffff
je 0x14002e018
sub eax, 1
mov dword [rcx], eax
jne 0x14002e018
mov rcx, qword [rsp + 0x48]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
mov rax, qword [r15]
cmp dword [rax], 1
jbe 0x14002e04a
mov edx, 0x7fffffff
mov r8d, 1
mov rcx, r15
call fcn.1400068b0
mov qword [rax], rbx
mov ecx, dword [rbx]
mov eax, ecx
test ecx, ecx
je 0x14002e066
cmp ecx, 0xffffffff
je 0x14002e066
lea eax, [rcx + 1]
mov dword [rbx], eax
jmp 0x14002e066
mov ecx, dword [rbx]
lea eax, [rcx + 1]
cmp eax, 1
jbe 0x14002e059
lea eax, [rcx + 1]
mov dword [rbx], eax
mov rcx, r15
call fcn.140013ff0
mov qword [rax], rbx
mov eax, dword [rbx]
test eax, eax
je 0x14002e076
cmp eax, 0xffffffff
je 0x14002e087
sub eax, 1
mov dword [rbx], eax
jne 0x14002e087
mov edx, 2
mov rcx, rbx
lea r8d, [rdx + 6]
call fcn.140003e30
add rsi, 0x18
inc ebp
cmp ebp, dword [rsp + 0xc0]
jbe 0x14002df90
mov r13, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
call sub.NETAPI32.dll_NetApiBufferFree
cmp r12d, 0xea
je 0x14002df17
mov rbx, qword [rsp + 0xb8]
test r12d, r12d
sete al
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140031e20
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x60
mov eax, dword [rcx + 0x38]
mov r13, r8
mov rsi, qword [rcx + 0x18]
mov rbx, rdx
mov rdi, rcx
test eax, eax
jne 0x140031e52
lea edx, [rax + 5]
jmp 0x140031f0e
test rbx, rbx
jne 0x140031e74
test r13, r13
jne 0x140031e74
lea edx, [rbx + 0x57]
lea rcx, [rsp + 0x90]
call fcn.140029ec0
lea edx, [rbx + 8]
jmp 0x140031f20
xor r14d, r14d
lea r15d, [r14 + 4]
test r9b, 1
je 0x140031e87
lea ebp, [r14 + 1]
jmp 0x140031e9b
test al, 2
je 0x140031e92
mov ebp, 2
jmp 0x140031e9b
test al, 1
mov ebp, r14d
cmovne ebp, r15d
cmp qword [rcx + 0x88], r14
jne 0x140031f69
mov rax, qword [rcx + 0x80]
cmp rax, 0xffffffffffffffff
jne 0x140031ed9
mov rcx, qword [rcx + 0x78]
test rcx, rcx
je 0x140031ed2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
cmp rax, 0xffffffffffffffff
jne 0x140031ed9
mov edx, 5
jmp 0x140031f0e
test byte [rdi + 0x38], 2
mov r8d, 2
mov qword [rsp + 0x28], r14
mov rcx, rax
cmovne r8d, r15d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rdi + 0x88], rax
test rax, rax
jne 0x140031f69
lea edx, [rax - 1]
lea rcx, [rsp + 0x90]
call fcn.140029ec0
mov edx, 0xd
mov r8, rax
mov rcx, rsi
call fcn.140027a30
mov rcx, qword [rsp + 0x90]
mov eax, dword [rcx]
test eax, eax
je 0x140031f55
cmp eax, 0xffffffff
je 0x14003206d
sub eax, 1
mov dword [rcx], eax
jne 0x14003206d
mov rcx, qword [rsp + 0x90]
mov r8d, 8
lea edx, [r8 - 6]
call fcn.140003e30
jmp 0x14003206d
mov qword [rsp + 0x98], r12
lea rcx, [rsp + 0x30]
mov r12, rbx
sar r12, 0x20
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x58]
mov r14d, ebx
dec eax
and r14d, eax
je 0x140031f95
not eax
and ebx, eax
mov rcx, qword [rdi + 0x88]
lea rax, [r14 + r13]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8d, r12d
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, qword [rsp + 0x98]
test rax, rax
je 0x140031feb
lea rbx, [r14 + rax]
lea rcx, [rdi + 0x90]
mov qword [rsp + 0x90], rbx
lea rdx, [rsp + 0x90]
call fcn.140030b60
mov dword [rax], r14d
mov rax, rbx
jmp 0x14003206f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0xffffffff
lea rcx, [rsp + 0x90]
cmp eax, 5
je 0x14003200f
call fcn.140029ec0
mov edx, 8
jmp 0x140032019
call fcn.140029ec0
mov edx, 0xd
mov r8, rax
mov rcx, rsi
call fcn.140027a30
mov rcx, qword [rsp + 0x90]
mov eax, dword [rcx]
test eax, eax
je 0x140032046
cmp eax, 0xffffffff
je 0x140032055
sub eax, 1
mov dword [rcx], eax
jne 0x140032055
mov rcx, qword [rsp + 0x90]
mov r8d, 8
lea edx, [r8 - 6]
call fcn.140003e30
mov rcx, qword [rdi + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x88], 0
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret