joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14020e0d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
mov rdi, rdx
push rsi
mov rsi, rcx
push rbx
sub rsp, 0x18
mov eax, dword [rcx]
mov ecx, dword [rdi]
mov r15, qword [rsp + 0xa0]
mov r13d, dword [rsp + 0x88]
mov r10d, dword [rsp + 0x90]
mov edx, dword [rsp + 0x80]
imul r13d, eax
imul r10d, ecx
imul eax, dword [rsp + 0x98]
imul ecx, r15d
add r13d, r10d
imul r13d, edx
lea r12d, [rax + rcx]
lea rax, [r9*4 - 4]
imul r12d, edx
lea rbx, [rsi + rax]
add rax, rdi
mov qword [rsp], rbx
and r13d, 0x7fffffff
mov qword [rsp + 8], rax
and r12d, 0x7fffffff
test r9, r9
je 0x14020e338
xor edx, edx
xor r11d, r11d
xor r10d, r10d
nop dword [rax + rax]
mov eax, dword [rsi + r10*4]
mov ebp, dword [rdi + r10*4]
mov rcx, qword [rsp + 0x88]
mov r14, qword [rsp + 0x90]
mov ebx, dword [r8 + r10*4]
imul rcx, rax
imul r14, rbp
imul rax, qword [rsp + 0x98]
imul rbp, r15
add rcx, r14
add rcx, r11
mov r11, rbx
imul r11, r13
add rax, rbp
imul rbx, r12
add rdx, rax
add r11, rcx
add rdx, rbx
test r10, r10
je 0x14020e318
mov eax, r11d
sar r11, 0x1f
and eax, 0x7fffffff
mov dword [rsi + r10*4 - 4], eax
mov eax, edx
sar rdx, 0x1f
and eax, 0x7fffffff
mov dword [rdi + r10*4 - 4], eax
add r10, 1
cmp r9, r10
jne 0x14020e168
mov rax, qword [rsp]
xor ebp, ebp
mov dword [rax], r11d
mov rax, qword [rsp + 8]
shr r11, 0x3f
mov r12, r11
mov r10d, r11d
mov dword [rax], edx
xor eax, eax
mov ecx, eax
nop dword [rax + rax]
mov eax, dword [rsi + rbp*4]
mov rbx, rbp
sub eax, ecx
sub eax, dword [r8 + rbp*4]
lea rbp, [rbp + 1]
shr eax, 0x1f
mov ecx, eax
cmp r9, rbp
jne 0x14020e210
mov r11d, 1
mov ebp, r12d
xor ecx, ecx
sub r11d, eax
neg ebp
mov eax, r10d
or r11d, r12d
shr ebp, 1
neg r11d
nop dword [rax]
mov r10d, dword [rsi + rcx*4]
mov r9, rcx
sub r10d, eax
mov eax, dword [r8 + rcx*4]
xor eax, ebp
and eax, r11d
sub r10d, eax
mov eax, r10d
and eax, 0x7fffffff
mov dword [rsi + rcx*4], eax
mov eax, r10d
add rcx, 1
shr eax, 0x1f
cmp rbx, r9
jne 0x14020e248
mov rax, rdx
xor ecx, ecx
xor r11d, r11d
shr rax, 0x3f
mov edx, ecx
mov r10d, eax
nop dword [rax]
mov ecx, dword [rdi + r11*4]
sub ecx, edx
sub ecx, dword [r8 + r11*4]
mov edx, ecx
mov rcx, r11
add r11, 1
shr edx, 0x1f
cmp rcx, rbx
jne 0x14020e290
mov ecx, edx
mov edx, 1
mov r11d, eax
sub edx, ecx
neg r11d
xor ecx, ecx
or edx, eax
shr r11d, 1
mov eax, r10d
neg edx
nop word cs:[rax + rax]
mov r10d, dword [rdi + rcx*4]
mov r9, rcx
sub r10d, eax
mov eax, dword [r8 + rcx*4]
xor eax, r11d
and eax, edx
sub r10d, eax
mov eax, r10d
and eax, 0x7fffffff
mov dword [rdi + rcx*4], eax
mov eax, r10d
add rcx, 1
shr eax, 0x1f
cmp r9, rbx
jne 0x14020e2d0
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
sar r11, 0x1f
sar rdx, 0x1f
cmp r9, 1
je 0x14020e1ed
mov r10d, 1
jmp 0x14020e168
mov rax, qword [rsp + 8]
mov dword [rbx], 0
mov dword [rax], 0
jmp 0x14020e300
Function at 0x14021bb80
Capabilities:
Write file on windows

Disassembly:
push r14
mov r14, rcx
push r13
mov r13, rdx
push r12
push rbp
push rdi
push rsi
mov rsi, r9
push rbx
mov rbx, r8
sub rsp, 0x60
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFile]
lea r12, [rsp + 0x3c]
lea rbp, [rsp + 0x40]
mov r8d, 0x1000000
mov r9, r12
mov rdx, r13
mov rcx, r14
cmp rbx, r8
mov qword [rsp + 0x50], rsi
cmovbe r8, rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x58], 0
call rdi
test eax, eax
jne 0x14021bbe2
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14021bbf8
mov eax, dword [rsp + 0x3c]
cmp rax, rbx
je 0x14021bbf6
sub rbx, rax
add rsi, rax
add r13, rax
jmp 0x14021bbab
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x14021bcb0
Capabilities:
Suspend thread

Disassembly:
push r13
push r12
mov r12, rcx
push rbp
push rdi
push rsi
push rbx
mov ebx, edx
sub rsp, 0x38
mov rcx, qword [rcx]
mov r13d, dword [rcx]
cmp dword [rcx + 4], r13d
jne 0x14021bd0f
lea eax, [r13 + r13]
mov rbp, rax
lea rdx, [rax*8 + 8]
xor eax, eax
cmp r13d, 0x1f
cmovbe rcx, rax
call sub.msvcrt.dll_realloc
test rax, rax
je 0x14021bd95
cmp r13d, 0x1f
jne 0x14021bd09
mov rsi, qword [r12]
mov ecx, 0x40
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
mov qword [r12], rax
mov dword [rax], ebp
mov r8d, ebx
xor edx, edx
mov ecx, 0x42
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r13, rax
test rax, rax
jne 0x14021bd39
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
inc eax
jne 0x14021bd7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
cmp eax, 5
je 0x14021bd70
lea rdx, [rsp + 0x2c]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14021bd70
cmp dword [rsp + 0x2c], 0x103
je 0x14021bd73
xor r12d, r12d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14021bd9b
mov rdx, qword [r12]
xor r12d, r12d
mov eax, dword [rdx + 4]
lea ecx, [rax + 1]
mov dword [rdx + 4], ecx
mov qword [rdx + rax*8 + 8], r13
jmp 0x14021bd9b
mov r12d, 0xe
add rsp, 0x38
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14021bdb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
xor r11d, r11d
xor eax, eax
mov rbp, rsp
push r15
push r14
mov r14d, edx
push r13
add r14, 1
push r12
shl r14, 4
mov r12, rcx
push rdi
lea r13, [rcx + r14]
sub r14, 0x10
push rsi
lea r8, [rcx + r14]
push rbx
lea rbx, [r13 + r14]
and rsp, 0xfffffffffffffff0
sub rsp, 0x820
lea rsi, [rsp + 0x20]
lea r10, [rsp + 0x420]
mov edx, dword [r12 + 8]
mov ecx, 0x100
mov rdi, rsi
mov r9, r12
rep stosq qword [rdi], rax
mov ecx, r11d
xor edi, edi
shr edx, cl
nop dword [rax]
mov r15d, edx
mov edx, dword [r9 + 8]
mov ecx, r11d
add r9, 0x10
shr edx, cl
movzx ecx, dl
xor r15d, edx
add dword [rsp + rcx*4 + 0x20], 1
movzx ecx, dh
or edi, r15d
mov ecx, ecx
add dword [rsp + rcx*4 + 0x420], 1
cmp r8, r9
jne 0x14021be18
mov rdx, rsi
xor r9d, r9d
xor ecx, ecx
mov r15d, dword [rdx]
mov dword [rdx], ecx
add rdx, 4
add ecx, r15d
mov r15d, dword [rdx + 0x3fc]
mov dword [rdx + 0x3fc], r9d
add r9d, r15d
cmp r10, rdx
jne 0x14021be50
mov r9, r12
nop dword [rax]
mov edx, dword [r9 + 8]
mov ecx, r11d
movdqu xmm0, xmmword [r9]
add r9, 0x10
shr edx, cl
movzx ecx, dl
mov edx, dword [rsp + rcx*4 + 0x20]
lea r15d, [rdx + 1]
shl rdx, 4
mov dword [rsp + rcx*4 + 0x20], r15d
movups xmmword [r13 + rdx], xmm0
cmp r8, r9
jne 0x14021be78
cmp edi, 0xff
jbe 0x14021bf14
mov r9, r13
nop dword [rax]
mov edx, dword [r9 + 8]
mov ecx, r11d
movdqu xmm1, xmmword [r9]
add r9, 0x10
shr edx, cl
movzx edx, dh
mov edx, edx
add rdx, 0x100
mov ecx, dword [rsp + rdx*4 + 0x20]
lea r15d, [rcx + 1]
shl rcx, 4
mov dword [rsp + rdx*4 + 0x20], r15d
movups xmmword [r12 + rcx], xmm1
cmp rbx, r9
jne 0x14021beb8
add r11d, 0x10
shr edi, 0x10
jne 0x14021bdfb
lea rsp, [rbp - 0x38]
mov eax, 1
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r8, r14
mov rdx, r13
mov rcx, r12
call sub.msvcrt.dll_memcpy
jmp 0x14021befe
Function at 0x14021bf30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
xor r8d, r8d
xor eax, eax
mov rbp, rsp
push r15
push r14
mov r14d, edx
push r13
shl r14, 2
mov r13, rcx
push r12
lea r12, [rcx + r14]
push rdi
push rsi
push rbx
lea rbx, [r12 + r14]
and rsp, 0xfffffffffffffff0
sub rsp, 0x820
lea rsi, [rsp + 0x20]
lea r11, [rsp + 0x420]
mov edx, dword [r13]
mov ecx, 0x100
mov rdi, rsi
mov r9, r13
rep stosq qword [rdi], rax
mov ecx, r8d
xor edi, edi
not edx
shr edx, cl
nop dword [rax]
mov r10d, edx
mov edx, dword [r9]
mov ecx, r8d
add r9, 4
not edx
shr edx, cl
movzx ecx, dl
xor r10d, edx
add dword [rsp + rcx*4 + 0x20], 1
movzx ecx, dh
or edi, r10d
mov ecx, ecx
add dword [rsp + rcx*4 + 0x420], 1
cmp r12, r9
jne 0x14021bf90
mov rdx, rsi
xor r9d, r9d
xor ecx, ecx
nop dword [rax]
mov r10d, dword [rdx]
mov dword [rdx], ecx
add rdx, 4
add ecx, r10d
mov r10d, dword [rdx + 0x3fc]
mov dword [rdx + 0x3fc], r9d
add r9d, r10d
cmp r11, rdx
jne 0x14021bfd0
mov r9, r13
nop dword [rax]
mov r10d, dword [r9]
mov ecx, r8d
add r9, 4
mov edx, r10d
not edx
shr edx, cl
movzx edx, dl
mov ecx, dword [rsp + rdx*4 + 0x20]
lea r15d, [rcx + 1]
mov dword [r12 + rcx*4], r10d
mov dword [rsp + rdx*4 + 0x20], r15d
cmp r12, r9
jne 0x14021bff8
cmp edi, 0xff
jbe 0x14021c087
mov r9, r12
nop dword [rax]
mov r10d, dword [r9]
mov ecx, r8d
add r9, 4
mov edx, r10d
not edx
shr edx, cl
movzx edx, dh
mov edx, edx
add rdx, 0x100
mov ecx, dword [rsp + rdx*4 + 0x20]
lea r15d, [rcx + 1]
mov dword [r13 + rcx*4], r10d
mov dword [rsp + rdx*4 + 0x20], r15d
cmp rbx, r9
jne 0x14021c030
add r8d, 0x10
shr edi, 0x10
jne 0x14021bf6e
lea rsp, [rbp - 0x38]
mov eax, 1
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r8, r14
mov rdx, r12
mov rcx, r13
call sub.msvcrt.dll_memcpy
jmp 0x14021c071

Function at 0x14021c1c0
Capabilities:
Resume thread

Disassembly:
push r13
push r12
xor r12d, r12d
push rdi
push rsi
mov rsi, rcx
push rbx
xor ebx, ebx
sub rsp, 0x30
cmp dword [rsi + 4], ebx
jbe 0x14021c224
mov eax, ebx
mov r13, qword [rsi + rax*8 + 8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
inc eax
jne 0x14021c217
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
je 0x14021c217
lea rdx, [rsp + 0x2c]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14021c217
cmp dword [rsp + 0x2c], 0x103
cmove r12d, edi
mov rcx, r13
inc ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14021c1d3
add rsp, 0x30
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x14021c2c0
Capabilities:
Enumerate threads

Disassembly:
push r14
push r13
push r12
push rbp
mov rbp, rcx
push rdi
push rsi
mov rsi, rdx
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x14021c38a
mov r14d, dword [rax + 0xc0]
lea rbx, [rax + 0x100]
xor r13d, r13d
shl r14, 5
mov rax, qword [rbp + 0xb0]
add r14, rbx
test rax, rax
je 0x14021c322
mov r13, qword [rax + 0x70]
jmp 0x14021c322
mov eax, dword [rbx + 0x10]
cmp eax, dword [rbp + 0x94]
je 0x14021c329
add rbx, 0x20
cmp rbx, r14
jb 0x14021c313
jmp 0x14021c364
mov rax, qword [rbx + 8]
test rax, rax
je 0x14021c31e
mov rax, qword [rbx + 8]
cmp rax, rdi
je 0x14021c31e
mov rax, qword [rbx + 8]
cmp rax, r13
je 0x14021c31e
mov rdx, qword [rbx + 8]
mov rcx, rsi
call fcn.14021bcb0
mov r12d, eax
test eax, eax
je 0x14021c31e
mov rcx, qword [rsi]
call fcn.14021c1c0
jmp 0x14021c43b
test r13, r13
je 0x14021c36e
cmp r13, rdi
jne 0x14021c376
xor r12d, r12d
jmp 0x14021c43b
mov edx, r13d
mov rcx, rsi
call fcn.14021bcb0
mov r12d, eax
test eax, eax
je 0x14021c36e
jmp 0x14021c357
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x14021c3b3
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, [rsp + 0x24]
mov rcx, rax
mov dword [rsp + 0x24], 0x1c
mov rdx, r14
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x14021c407
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, r13
mov r12d, ebx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi]
call fcn.14021c1c0
jmp 0x14021c43b
mov edx, dword [rsp + 0x2c]
cmp edi, edx
jne 0x14021c415
mov rdx, r14
mov rcx, r13
call sub.KERNEL32.dll_Thread32Next
mov r12d, eax
test eax, eax
je 0x14021c425
mov eax, dword [rbp + 0x94]
cmp dword [rsp + 0x30], eax
je 0x14021c3ed
jmp 0x14021c3f5
mov rcx, rsi
call fcn.14021bcb0
mov ebx, eax
test eax, eax
je 0x14021c3f5
jmp 0x14021c3d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x12
jne 0x14021c3d7
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x14021c5d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
xor eax, eax
mov rbp, rsp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbx, rcx
mov ecx, 8
mov rdi, rbx
sub rsp, 0x30
rep stosd dword [rdi], eax
mov eax, 0x57
test rdx, rdx
je 0x14021c7c4
mov rsi, r8
mov r8d, 0x7fffffff
mov r12, rdx
mov r13d, r9d
call sub.msvcrt.dll_mbstowcs
mov rdi, rax
lea rax, [rax - 1]
cmp rax, 0x7ffe
jbe 0x14021c62b
mov eax, 0x7b
jmp 0x14021c7c4
lea r8, [rdi + 1]
lea rax, [r8 + r8]
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140035990
sub rsp, rax
mov rdx, r12
lea r14, [rsp + 0x30]
mov rcx, r14
call sub.msvcrt.dll_mbstowcs
cmp rax, rdi
jne 0x14021c621
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14021c6b6
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 2
jne 0x14021c7c4
test r13w, r13w
je 0x14021c7c4
mov edx, dword [rsi]
bt edx, 0x11
jb 0x14021c7c4
bt edx, 0xe
jb 0x14021c6c8
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14021c6c8
call rdi
cmp eax, 0xb7
jne 0x14021c7c4
jmp 0x14021c6c8
mov edx, dword [rsi]
or dh, 0x40
test al, 0x10
lea ecx, [rdx - 0x4000]
cmovne edx, ecx
mov dword [rsi], edx
mov rcx, r12
call sub.msvcrt.dll_strlen
mov edi, dword [rsi]
mov qword [rbx + 0x18], rax
bt edi, 0xe
jae 0x14021c70c
cmp rax, 8
jbe 0x14021c70c
lea r13, [rax - 9]
mov r8d, 9
lea rcx, str._mdbx.dat
lea rdx, [r12 + r13]
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14021c70c
sub edi, 0x4000
mov dword [rsi], edi
mov qword [rbx + 0x18], r13
mov esi, dword [rsi]
mov r13, qword [rbx + 0x18]
and esi, 0x4000
lea rdx, [r13 + r13]
cmp esi, 1
sbb rax, rax
and eax, 0xe
lea rcx, [rax + rdx + 6]
call sub.msvcrt.dll_malloc
mov rcx, rax
mov qword [rbx], rax
mov eax, 0xe
test rcx, rcx
je 0x14021c7c4
mov qword [rbx + 8], rcx
test esi, esi
je 0x14021c779
lea rax, [rcx + r13 + 5]
lea r9, str._lck
mov r8, r12
mov qword [rbx + 0x10], rax
lea rdx, [0x1402b224c]
call fcn.14021c5a0
mov rcx, qword [rbx + 0x10]
mov rdx, r12
call sub.msvcrt.dll_strcpy
jmp 0x14021c7c2
lea rax, [rcx + r13 + 0xa]
mov r8d, r13d
lea r13, [0x1402b2251]
mov r9, r12
mov qword [rbx + 0x10], rax
lea rax, str._mdbx.lck
mov rdx, r13
mov qword [rsp + 0x20], rax
call fcn.14021c5a0
mov rcx, qword [rbx + 0x10]
mov r8d, dword [rbx + 0x18]
mov r9, r12
lea rax, str._mdbx.dat
mov rdx, r13
mov qword [rsp + 0x20], rax
call fcn.14021c5a0
xor eax, eax
lea rsp, [rbp - 0x30]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
Function at 0x14021c7e0
Capabilities:
Set file attributes

Disassembly:
push rbp
mov rbp, rsp
push r15
mov r15, r8
mov r8d, 0x7fffffff
push r14
push r13
push r12
push rdi
mov rdi, rdx
mov rdx, r15
push rsi
mov rsi, r9
push rbx
mov ebx, ecx
xor ecx, ecx
sub rsp, 0x88
mov r12d, dword [rbp + 0x30]
mov qword [r9], 0xffffffffffffffff
call sub.msvcrt.dll_mbstowcs
mov r13, rax
dec rax
cmp rax, 0x7ffe
jbe 0x14021c835
mov r12d, 0x7b
jmp 0x14021c98e
lea r8, [r13 + 1]
lea rax, [r8 + r8]
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140035990
sub rsp, rax
mov rdx, r15
lea r14, [rsp + 0x40]
mov rcx, r14
call sub.msvcrt.dll_mbstowcs
cmp rax, r13
jne 0x14021c82a
mov edx, dword [rdi + 4]
cmp r12w, 1
sbb eax, eax
and edx, 0x400000
add eax, 4
cmp edx, 1
sbb r8d, r8d
dec ebx
and r8d, 3
cmp ebx, 4
ja case.default.0x14021c898
lea rcx, [0x1402b2258]
movsxd rdx, dword [rcx + rbx*4]
add rdx, rcx
jmp rdx
mov edx, 0xc0000080
mov ebx, 0x1002000
jmp 0x14021c916
or r8d, 1
mov edx, 0x80000080
mov ebx, 0x1002000
mov eax, 3
jmp 0x14021c916
mov edx, 0x40000080
mov ebx, 0x81002000
mov eax, 3
jmp 0x14021c916
mov eax, dword [rdi + 0x88]
xor ebx, ebx
cmp dword [rdi + 0x78], eax
mov edx, 0x40000080
setae bl
mov eax, 1
xor r8d, r8d
shl ebx, 0x1d
or ebx, 0x1002000
jmp 0x14021c916
or r8d, 4
mov edx, 0x110180
mov ebx, 0x1002000
mov eax, 3
jmp 0x14021c916
mov edx, 0xc0000080
mov ebx, 0x1002102
mov eax, 4
mov rcx, r14
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x14021c94a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14021c98e
lea rdx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x14021c973
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsi]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], 0xffffffffffffffff
jmp 0x14021c98e
mov edx, dword [rbp - 0x74]
xor r12d, r12d
xor ebx, edx
and ebx, 0x2902
je 0x14021c98e
xor edx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rsp, [rbp - 0x38]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14021c9b0
Capabilities:
Get disk information

Disassembly:
push r14
mov r14, rcx
push r13
push r12
push rsi
push rbx
mov ebx, edx
sub rsp, 0x1e0
cmp qword [0x1403ec468], 0
jne 0x14021c9de
bt edx, 0x16
mov r12d, 0x307
jae 0x14021cc5e
mov rcx, r14
mov r12d, 0x10fe
call qword [sym.imp.KERNEL32.dll_GetFileType]
dec eax
jne 0x14021cc5e
mov rax, qword [0x1403ec4a0]
test rax, rax
je 0x14021ca45
mov r9d, 0x74
lea r8, [rsp + 0x60]
mov edx, 0xd
mov rcx, r14
call rax
test eax, eax
je 0x14021ca45
mov eax, dword [rsp + 0x70]
test al, 2
je 0x14021ca2c
bt ebx, 0x11
jae 0x14021cc5e
mov edx, ebx
and eax, 1
mov r12d, 0x1100
and edx, 0x400000
or edx, eax
je 0x14021cc5e
mov rax, qword [0x1403ec480]
test rax, rax
je 0x14021cad7
lea rdx, [rsp + 0x60]
mov rcx, r14
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rsp + 0x48], 0x180
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x90310
call rax
mov ecx, eax
test eax, eax
js 0x14021caae
bt ebx, 0x16
mov r12d, 0x1100
jb 0x14021cad7
jmp 0x14021cc5e
cmp eax, 0xc000046d
setne dl
cmp eax, 0xc0000010
setne al
test dl, al
je 0x14021cad7
cmp ecx, 0xc00000bb
je 0x14021cad7
call fcn.14021c100
mov r12d, eax
jmp 0x14021cc5e
mov rsi, qword [0x1403ec498]
xor r12d, r12d
test rsi, rsi
je 0x14021cc5e
cmp qword [0x1403ec490], 0
je 0x14021cc5e
mov ecx, 0xfffe
mov r12d, 0xe
call sub.msvcrt.dll_malloc
mov r13, rax
test rax, rax
je 0x14021cc5e
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov rdx, r13
mov rcx, r14
mov dword [rsp + 0x38], 0
mov r8d, 0x7fff
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call rsi
test eax, eax
je 0x14021cb7f
mov esi, ebx
and esi, 0x20000
jne 0x14021cb63
test dword [rsp + 0x60], 0x188000
jne 0x14021cbb5
mov r9d, 2
mov r8d, 0x7fff
mov rdx, r13
mov rcx, r14
call qword [0x1403ec490]
test eax, eax
jne 0x14021cb8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14021cc56
mov r12, qword [sym.imp.msvcrt.dll__wcsnicmp]
mov r8d, 0xc
lea rdx, str.DeviceMup_
mov rcx, r13
call r12
test eax, eax
jne 0x14021cbc0
bt ebx, 0x16
jb 0x14021cc3b
mov r12d, 0x1100
jmp 0x14021cc56
xor r9d, r9d
mov r8d, 0x7fff
mov rdx, r13
mov rcx, r14
call qword [0x1403ec490]
test eax, eax
je 0x14021cc3b
mov r14, qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, r13
call r14
cmp eax, 1
jne 0x14021cc28
mov r8d, 4
lea rdx, [0x1402b2286]
mov rcx, r13
call r12
test eax, eax
jne 0x14021cbab
lea rcx, [r13 + 0xa]
mov r8d, 2
lea rdx, [0x1402b2290]
call r12
test eax, eax
jne 0x14021cbab
mov word [r13 + 0xe], 0
lea rcx, [r13 + 8]
call r14
cmp eax, 5
je 0x14021cc4d
ja 0x14021cc40
sub eax, 2
cmp eax, 1
ja 0x14021cbab
xor r12d, r12d
jmp 0x14021cc56
xor r12d, r12d
cmp eax, 6
je 0x14021cc56
jmp 0x14021cbab
test esi, esi
jne 0x14021cc3b
jmp 0x14021cbab
mov rcx, r13
call sub.msvcrt.dll_free
add rsp, 0x1e0
mov eax, r12d
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
Function at 0x14021cec0
Capabilities:
Clear file content

Disassembly:
push r12
mov r12, rcx
sub rsp, 0x30
mov rax, qword [0x1403ec488]
test rax, rax
je 0x14021cefe
mov qword [rsp + 0x28], rdx
lea r8, [rsp + 0x28]
mov r9d, 8
mov edx, 6
call rax
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x14021cf29
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14021cf29
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14021cf1a
add rsp, 0x30
pop r12
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14021cf0e
xor eax, eax
add rsp, 0x30
pop r12
ret
Function at 0x14021d440
Capabilities:
Map section object

Disassembly:
push rbp
xorps xmm0, xmm0
mov rbp, rsp
push r14
mov r14, r9
push r13
push r12
push rdi
mov rdi, r8
push rsi
mov esi, ecx
push rbx
mov rbx, rdx
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
mov qword [rdx], 0
mov rcx, qword [rdx + 8]
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x28], 0
movups xmmword [rdx + 0x10], xmm0
mov edx, esi
call fcn.14021c9b0
mov r12d, eax
test eax, eax
jne 0x14021d5d7
mov r13d, esi
mov rcx, qword [rbx + 8]
and r13d, 0x20000
jne 0x14021d4c0
test byte [rbp + 0x30], 1
je 0x14021d4c0
mov rdx, rdi
call fcn.14021cec0
test eax, eax
jne 0x14021d5d4
mov qword [rbx + 0x20], rdi
jmp 0x14021d4d1
lea rdx, [rbx + 0x20]
call fcn.14021c150
test eax, eax
jne 0x14021d5d4
cmp r13d, 1
mov r8, qword [rbx + 8]
lea rcx, [rbx + 0x28]
mov dword [rsp + 0x28], 0x4000000
sbb eax, eax
and esi, 0x80000
lea r9, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
and eax, 2
mov qword [rsp + 0x30], r8
add eax, 2
cmp esi, 1
sbb edx, edx
mov dword [rsp + 0x20], eax
xor r8d, r8d
and edx, 0xfffffffe
add edx, 0x17
call sub.ntdll.dll_NtCreateSection
mov ecx, eax
test eax, eax
js 0x14021d5b9
test r13d, r13d
jne 0x14021d536
cmp qword [0x1403ec468], 0
cmovne rdi, r14
jmp 0x14021d538
xor edi, edi
cmp esi, 1
mov qword [rsp + 0x58], rdi
sbb esi, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and esi, 0xfffffffe
mov rcx, qword [rbx + 0x28]
mov r8, rbx
add esi, 4
mov rdx, rax
xor eax, eax
test r13d, r13d
sete al
mov dword [rsp + 0x48], esi
xor r9d, r9d
shl eax, 0xd
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call sub.ntdll.dll_NtMapViewOfSection
mov r13d, eax
test eax, eax
jns 0x14021d5c3
mov rcx, qword [rbx + 0x28]
call sub.ntdll.dll_NtClose
mov qword [rbx + 0x28], 0
mov ecx, r13d
mov qword [rbx], 0
call fcn.14021c100
mov r12d, eax
jmp 0x14021d5d7
movq xmm0, qword [rsp + 0x58]
movhps xmm0, qword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm0
jmp 0x14021d5d7
mov r12d, eax
lea rsp, [rbp - 0x30]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret

Function at 0x14021d700
Capabilities:
Read file on windows

Disassembly:
push rbx
mov rbx, r8
sub rsp, 0x60
lea rax, [rsp + 0x40]
mov dword [rsp + 0x50], r9d
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x3c], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14021d750
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14021d764
mov eax, 0x1e
jmp 0x14021d764
mov eax, dword [rsp + 0x3c]
mov edx, 0x26
cmp rax, rbx
mov eax, 0
cmovne eax, edx
add rsp, 0x60
pop rbx
ret
Function at 0x14021d770
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
mov r14, rdx
push r13
mov r13, rcx
push r12
push rsi
mov rsi, r9
push rbx
mov rbx, r8
sub rsp, 0x50
mov rax, qword [0x1403ec460]
test rax, rax
jne 0x14021d7e5
mov rdx, rcx
lea r8, [rsp + 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov r12d, eax
test eax, eax
jne 0x14021d878
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x48]
mov r12d, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14021d878
mov qword [rsp + 0x30], r9
mov r9d, 0xffff
mov qword [rsp + 0x28], r8
mov r8, rdx
mov rdx, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call rax
mov r12d, eax
cmp eax, 2
jne 0x14021d878
mov qword [rsp + 0x30], rsi
mov r9d, 0x1ffff
mov r8, r14
mov rdx, r13
mov qword [rsp + 0x28], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call qword [0x1403ec460]
mov r12d, eax
cmp eax, 2
jne 0x14021d878
mov qword [rsp + 0x30], rsi
mov r9d, 0x2ffff
mov r8, r14
mov rdx, r13
mov qword [rsp + 0x28], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], 0
call qword [0x1403ec460]
mov r12d, eax
add rsp, 0x50
mov eax, r12d
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret