joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004360
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edx, 0x67
mov rbx, r8
mov rdi, rcx
lea r8d, [rdx - 0x62]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
jne 0x140004391
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140004384
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140004384
mov r8d, 0xffff
cmp word [rax + 2], r8w
jne 0x140004384
movzx ecx, word [rax + 0x1a]
add rax, 0x1a
test cx, cx
jne 0x1400043d0
add rax, 2
jmp 0x1400043ec
cmp cx, r8w
jne 0x1400043e0
add rax, 4
jmp 0x1400043ec
movzx ecx, word [rax]
add rax, 2
test cx, cx
jne 0x1400043e0
movzx ecx, word [rax]
test cx, cx
jne 0x1400043fa
add rax, 2
jmp 0x14000441c
cmp cx, r8w
jne 0x140004410
add rax, 4
jmp 0x14000441c
movzx ecx, word [rax]
add rax, 2
test cx, cx
jne 0x140004410
cmp word [rax], 0
je 0x14000442c
add rax, 2
cmp word [rax], 0
jne 0x140004422
add rax, 8
cmp word [rax], 0
je 0x140004440
add rax, 2
cmp word [rax], 0
jne 0x140004436
add rax, 2
mov rdx, rax
and edx, 3
jbe 0x140004457
mov ecx, 4
sub rcx, rdx
add rax, rcx
cmp dword [rax + 0x14], 0x3ff
jne 0x140004384
movzx ecx, word [rax + 0x18]
add rax, 0x18
test cx, cx
jne 0x140004477
add rax, 2
jmp 0x14000448f
cmp cx, r8w
jne 0x140004483
add rax, 4
jmp 0x14000448f
movzx ecx, word [rax]
add rax, 2
test cx, cx
jne 0x140004483
xor edx, edx
movzx ecx, word [rax]
mov word [rbx], cx
test cx, cx
je 0x1400044bc
movzx ecx, word [rax + 2]
mov word [rbx + 2], cx
test cx, cx
je 0x1400044bc
add edx, 2
add rax, 4
add rbx, 4
cmp edx, 0x400
jb 0x140004491
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140004660
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rdx, [rsp + 0x20]
lea rcx, str.X:Sources
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400046b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.FindFirstFileA_failed__u
mov edx, eax
call fcn.140005180
jmp 0x140004700
test byte [rsp + 0x20], 0x10
je 0x1400046ee
lea rcx, [rsp + 0x4c]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400046c0
cmp rax, 5
jne 0x1400046ee
lea rdx, [rsp + 0x4c]
lea rcx, str.X:Sources_sw32uires.dll.mui
call fcn.1400058b0
test eax, eax
je 0x1400046ee
lea rcx, [rsp + 0x4c]
call fcn.1400044d0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400046b0
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x170
pop rbx
ret
Function at 0x140004810
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x50]
xor bpl, bpl
mov dil, 0x41
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov r13, qword [0x14002b720]
mov r12, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea rcx, str.Find_Windows:_Logical_Drives:_0x_x
mov edx, eax
mov ebx, eax
call fcn.140005180
test ebx, ebx
je 0x1400049d6
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x1c0], r15
test bpl, bpl
jne 0x14000499b
test bl, 1
je 0x140004990
cmp dil, 0x58
je 0x140004990
movsx r15d, dil
lea r8, str._C:_WINDOWS.BTSourcesPanther_setupact.log
lea rcx, [rsp + 0x60]
mov r9d, r15d
mov edx, 0x104
call fcn.14000d244
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x60]
lea edx, [r9 + 8]
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140004976
lea rdx, [rsp + 0x60]
lea rcx, str._s_Exist
call fcn.140005180
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x14000496b
mov rsi, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
lea rcx, str.__s__llu__llu__llu
mov r9, r12
mov r8, r13
mov qword [rsp + 0x20], rsi
call fcn.140005180
cmp rsi, r13
jbe 0x14000496b
cmp rsi, r12
jae 0x14000496b
lea rcx, str.Detect_Windows11_install_drive:__C_
mov edx, r15d
call fcn.140005180
movzx ebp, dil
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140004990
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x60]
lea rcx, str._s_NOT_Exist__u
mov r8d, eax
call fcn.140005180
inc dil
shr ebx, 1
jne 0x140004894
mov r14, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1b0]
mov r15, qword [rsp + 0x1c0]
movzx eax, bpl
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x180
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
movzx eax, bpl
jmp 0x1400049b7
Function at 0x140004e40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x58
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, str.SetupMonNroStart_...
call fcn.140005180
call fcn.140004660
cmp qword [0x14002a9a8], 0
jne 0x140004eb6
lea rcx, str.Prompt_not_found__add_default
call fcn.140005180
mov ecx, 0x808
call fcn.14000d2a8
mov qword [0x14002a9a8], rax
test rax, rax
je 0x140004eb6
lea r8, str.Windows_needs_to_restart_to_continue
mov edx, 0x400
mov rcx, rax
call fcn.14000d360
mov rax, qword [0x14002a9a8]
mov qword [rax + 0x800], 0
lea rcx, str.Wait_for_setup_finish...
call fcn.140005180
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [0x14002b720]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea r8, [0x140004d80]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x58
ret

Function at 0x140005070
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x4f0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rbx, rcx
lea rcx, [rsp + 0xe1]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0xe0], 0
call fcn.14000fe80
lea rax, [rsp + 0x508]
mov edx, 0x400
lea rcx, [rsp + 0xe0]
mov r8d, edx
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.14000f23c
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or dword [rsp + 0xac], 1
lea rdx, [rsp + 0xe0]
lea rcx, str.Process_Run:___s_
xor ebx, ebx
mov word [rsp + 0xb0], bx
call fcn.140005180
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x4f0
pop rbx
ret
Function at 0x140005180
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x490
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor edi, edi
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x68]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x74]
movzx edx, word [rsp + 0x72]
movzx r8d, word [rsp + 0x70]
movzx eax, word [rsp + 0x76]
movzx r10d, word [rsp + 0x6e]
movzx r11d, word [rsp + 0x6a]
movzx r9d, word [rsp + 0x68]
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r10d
mov ebx, 0x400
lea r8, str.__4d__02d__02d__02d:_02d:_02d._03d____u_
lea rcx, [rsp + 0x80]
mov edx, ebx
mov dword [rsp + 0x20], r11d
call fcn.14000d244
mov r9, qword [rsp + 0x4b0]
lea rdx, [rsp + 0x4b8]
movsxd rsi, eax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x80]
sub rbx, rsi
add rcx, rsi
mov r8, rbx
mov rdx, rbx
call fcn.14000f23c
mov rcx, qword [0x14002a9b0]
add esi, eax
test rcx, rcx
je 0x140005275
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
lea r8, [0x140022bd4]
lea rdx, str.X:Windows_system32_ventoy.log
lea rcx, [rsp + 0x60]
call fcn.14000d9d8
mov r9, qword [rsp + 0x60]
test r9, r9
je 0x1400052cf
lea rcx, [rsp + 0x80]
movsxd r8, esi
mov edx, 1
call fcn.14000e014
mov r9, qword [rsp + 0x60]
mov edx, 1
lea rcx, [0x140022bf8]
mov r8d, edx
call fcn.14000e014
mov rcx, qword [rsp + 0x60]
call fcn.14000e57c
mov rcx, qword [0x14002a9b0]
test rcx, rcx
je 0x1400052e5
test edi, edi
jne 0x1400052e5
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x490
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005300
Capabilities:
Create service
Start service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x180
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
lea rcx, [rsp + 0x71]
xor edi, edi
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x70], dil
call fcn.14000fe80
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [rbx + rdx], dil
jne 0x140005344
dec edx
movsxd rax, edx
js 0x14000539b
mov r8, rbx
lea rcx, [rax + rbx]
neg r8
nop
movzx eax, byte [rcx]
cmp al, 0x5c
je 0x14000537b
cmp al, 0x2f
je 0x14000537b
dec rcx
dec edx
lea rax, [r8 + rcx]
test rax, rax
jns 0x140005360
jmp 0x14000539b
movsxd rax, edx
lea r9, [rbx + 1]
lea r8, [0x140022bfc]
lea rcx, [rsp + 0x70]
mov edx, 0x100
add r9, rax
call fcn.14000d244
lea r8, [rsp + 0x70]
lea rcx, str.Load_NT_driver:__s__s
mov rdx, rbx
call fcn.140005180
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
jne 0x1400053e3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManager_failed_Error:_u
mov edx, eax
call fcn.140005180
lea eax, [rsi + 1]
jmp 0x140005534
lea rcx, str.OpenSCManager_OK
mov qword [rsp + 0x198], rbp
call fcn.140005180
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 1
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x70]
mov r9d, 0xf01ff
mov rcx, rsi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbp, rax
test rax, rax
jne 0x1400054ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
je 0x14000546f
cmp eax, 0x431
je 0x14000546f
mov edx, eax
lea rcx, str.CreateService_failed_v__u
jmp 0x140005494
lea rdx, [rsp + 0x70]
mov r8d, 0xf01ff
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbp, rax
test rax, rax
jne 0x1400054ac
mov edx, ebx
lea rcx, str.OpenService_failed__u
call fcn.140005180
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x14000552c
lea rcx, str.CreateService_imdisk_OK
call fcn.140005180
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x1400054d8
lea rcx, str.StartService_OK
call fcn.140005180
jmp 0x1400054f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
je 0x1400054f8
lea rcx, str.StartService_error___u
mov edx, eax
call fcn.140005180
mov edi, 1
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rax, str.failed
test edi, edi
lea rdx, str.success
lea rcx, str.Load_NT_driver__s
cmovne rdx, rax
call fcn.140005180
mov eax, edi
mov rbp, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14000d130
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140005560
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rdx
mov rbx, rcx
mov rdx, rcx
lea rcx, str.ReadWholeFile2Buf___s_
mov r15, r8
mov edi, 1
call fcn.140005180
mov qword [rsp + 0x30], 0
lea r8d, [rdi + 2]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400055ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_open_the_file__s___error:_u
mov rdx, rbx
mov r8d, eax
call fcn.140005180
jmp 0x14000569d
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x98], rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, eax
mov ebx, eax
call fcn.14000d2a8
mov rbp, rax
test rax, rax
jne 0x140005629
lea rcx, str.Failed_to_alloc_memory_size:_u
mov edx, ebx
call fcn.140005180
jmp 0x14000568c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x40]
mov r8d, ebx
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140005676
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rsp + 0x40]
lea rcx, str.ReadFile_failed__dwSize:_u__error:_u
mov r8d, eax
call fcn.140005180
jmp 0x14000568c
mov qword [r14], rbp
lea rcx, str.Success_read_file_size:_u
mov edx, ebx
mov dword [r15], ebx
call fcn.140005180
xor edi, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x98]
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400056c0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rdx
mov rbx, rcx
mov rdx, rcx
lea rcx, str.SaveBuffer2File___s__len:_u
mov edi, r8d
call fcn.140005180
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea r8d, [r9 + 3]
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000573f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_create_new_file__error:_u
mov edx, eax
call fcn.140005180
lea eax, [rbx + 2]
jmp 0x140005767
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140005780
Capabilities:
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x368
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x350], rax
lea rax, [r11 + 0x10]
mov r9, rcx
mov edx, 0x104
lea rcx, [rsp + 0x30]
mov r8d, edx
mov qword [rsp + 0x20], rax
call fcn.14000f23c
xor eax, eax
nop dword [rax]
movzx ecx, byte [rsp + rax + 0x30]
test cl, cl
je 0x1400057e9
cmp cl, 0x7f
ja 0x140005822
inc rax
cmp rax, 0x104
jl 0x1400057d0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140005889
test al, 0x10
je 0x140005889
mov eax, 1
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x368
ret
lea rax, [rsp + 0x140]
lea r8, [rsp + 0x30]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rsp + 0x30]
inc eax
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x140]
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1400057f4
xor eax, eax
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x368
ret
Function at 0x1400058b0
Capabilities:
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x380
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x360], rax
lea rax, [r11 + 0x10]
mov r9, rcx
mov edx, 0x104
lea rcx, [rsp + 0x40]
mov r8d, edx
xor ebx, ebx
mov qword [rsp + 0x20], rax
call fcn.14000f23c
mov qword [rsp + 0x378], rsi
mov qword [rsp + 0x370], rdi
mov eax, ebx
nop
movzx ecx, byte [rsp + rax + 0x40]
test cl, cl
je 0x140005929
cmp cl, 0x7f
ja 0x140005983
inc rax
cmp rax, 0x104
jl 0x140005910
mov edi, 1
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x40]
lea edx, [rdi + 7]
xor r9d, r9d
mov r8d, edi
mov dword [rsp + 0x28], ebx
mov esi, ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140005a17
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140005a07
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x140005a12
lea rax, [rsp + 0x150]
lea r8, [rsp + 0x40]
mov edi, 1
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebx
mov esi, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
inc eax
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov qword [rsp + 0x30], rbx
lea edx, [rdi + 7]
lea rcx, [rsp + 0x150]
xor r9d, r9d
mov r8d, edi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x140005955
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
cmove ebx, edi
lea rax, str.exist
test ebx, ebx
lea r8, str.NOT_exist
lea rdx, [rsp + 0x40]
lea rcx, str.File___s___s
cmovne r8, rax
call fcn.140005180
mov rdi, qword [rsp + 0x370]
mov rsi, qword [rsp + 0x378]
mov eax, ebx
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x380
pop rbx
ret
Function at 0x140005a70
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x308
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
movsx ebp, cl
mov rsi, rdx
lea rcx, str.GetPhyDiskUUID__C
mov edx, ebp
mov r14, r9
mov rdi, r8
call fcn.140005180
lea r8, str.._C:
lea rcx, [rsp + 0x70]
mov r9d, ebp
mov edx, 0x80
call fcn.14000d244
xor r15d, r15d
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], r15
lea r8d, [r15 + 3]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140005b19
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x70]
lea rcx, str.Could_not_open_the_disk__s___error:_u
mov r8d, eax
call fcn.140005180
jmp 0x140005c74
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x560000
mov rcx, rbx
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140005c57
cmp dword [rsp + 0x48], r15d
je 0x140005c57
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str._C:_is_in_PhysicalDrive_d_Offset:_llu
mov edx, ebp
movups xmm2, xmmword [rsp + 0x50]
movsd xmm1, qword [rsp + 0x60]
movdqa xmm0, xmm2
psrldq xmm0, 8
movups xmmword [r14], xmm2
movd r8d, xmm2
movq r9, xmm0
movsd qword [r14 + 0x10], xmm1
call fcn.140005180
mov r9d, dword [rsp + 0x50]
lea r8, str..PhysicalDrive_d
lea rcx, [rsp + 0x70]
mov edx, 0x80
call fcn.14000d244
xor r9d, r9d
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x70]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005afa
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0xf0]
mov r8d, 0x200
mov rcx, rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140005c31
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rsp + 0x40]
lea rcx, str.ReadFile_failed__dwSize:_u__error:_u
mov r8d, eax
call fcn.140005180
jmp 0x140005c6b
movaps xmm0, xmmword [rsp + 0x270]
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140005c4a
mov eax, dword [rsp + 0x2a8]
mov dword [rdi], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140005c79
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.DeviceIoControl_IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS_failed__error:_u
mov edx, eax
call fcn.140005180
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x308
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140006240
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov dil, 0x59
mov ebx, 0x1000000
call fcn.140006170
test eax, eax
je 0x140006281
lea rcx, str.Use_M:_for_2K10_PE
call fcn.140005180
mov al, 0x4d
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
lea rdx, str.VTLRI
nop word [rax + rax]
movzx eax, byte [rsi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x1400062b5
cmp rcx, 6
jne 0x140006290
mov al, 0x5a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea rcx, str.Drives0x_x
mov edx, eax
mov esi, eax
call fcn.140005180
nop dword [rax + rax]
test ebx, esi
je 0x1400062db
dec dil
shr ebx, 1
jne 0x1400062d0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret

Function at 0x1400062f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x200
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rsp + 0x30]
lea rcx, str.Read_MBR_Ret:_u_Size:_u_code:_u
mov edx, ebx
mov r9d, eax
call fcn.140005180
cmp byte [rsp + 0x202], 0xee
jne 0x140006403
lea rcx, str.GPT_partition_style
call fcn.140005180
mov ecx, 0x4400
call fcn.14000d2a8
mov rdi, rax
test rax, rax
je 0x1400063ff
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rsp + 0x30]
mov r8d, 0x4400
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test eax, eax
je 0x1400063e3
cmp dword [rsp + 0x30], 0x4400
jne 0x1400063e3
mov rbx, qword [rdi + 0x4a0]
mov rcx, rdi
call fcn.14000d268
jmp 0x140006416
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rsp + 0x30]
lea rcx, str.Failed_to_read_gpt_info__d__u__d
mov r9d, eax
mov edx, ebx
call fcn.140005180
xor eax, eax
jmp 0x140006428
lea rcx, str.MBR_partition_style
call fcn.140005180
mov ebx, dword [rsp + 0x216]
lea rcx, str.GetVentoyEfiPart_StartSector:__llu
mov rdx, rbx
call fcn.140005180
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000d130
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret