joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011268
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140011298
xor eax, eax
jmp 0x14001135b
mov rbp, rbx
cmp word [rax], si
je 0x1400112bd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400112a4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400112a0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140011188
movsxd r14, eax
test eax, eax
jne 0x1400112fb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140011291
mov rcx, r14
call fcn.14000e134
mov rdi, rax
test rax, rax
jne 0x140011314
xor ecx, ecx
call fcn.14000e0f8
jmp 0x1400112f0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140011188
test eax, eax
jne 0x140011345
mov rcx, rdi
call fcn.14000e0f8
jmp 0x14001134f
xor ecx, ecx
call fcn.14000e0f8
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140018590
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400185b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400185b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x100004f34
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
xor ebx, ebx
mov qword [rax - 0x30], rbx
mov dword [rax - 0x24], ebx
mov dword [rax - 0x28], ebx
mov qword [rax - 0x20], rbx
mov dword [rax - 0x18], ebx
mov dword [rax + 0x18], ebx
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
cmp rax, rbx
jne 0x100004fac
lea rax, [0x100023120]
mov rcx, qword [0x100023120]
cmp rcx, rax
je 0x100004fd3
test byte [rcx + 0x1c], 1
je 0x100004fd3
lea edx, [rbx + 0x11]
lea r8, [0x1000019b8]
mov rcx, qword [rcx + 0x10]
call fcn.100004898
jmp 0x100004fd3
call fcn.100018734
lea rcx, [0x1000019d0]
call fcn.10001862c
lea r8, [rsp + 0x70]
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.100004b1c
mov ebx, dword [rsp + 0x70]
mov edx, 1
lea rcx, [rsp + 0x28]
call fcn.1000170b4
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x100005120
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor ebx, ebx
mov rbp, r8
mov r12, rdx
mov rdi, rcx
cmp rdx, rbx
je 0x1000052de
cmp r8, rbx
je 0x1000052de
mov dword [rsp + 0x48], 4
call fcn.10000532c
cmp eax, ebx
mov esi, eax
jge 0x10000519e
mov rcx, qword [0x100023120]
lea rdx, [0x100023120]
cmp rcx, rdx
je 0x1000052b2
test byte [rcx + 0x1c], 1
je 0x1000052b2
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xb]
lea r8, [0x1000019a8]
mov r9, r12
call fcn.100005008
jmp 0x1000052b2
cmp qword [rdi + 0x80], rbx
je 0x1000051af
cmp dword [rdi + 0x8c], ebx
jne 0x1000051c8
cmp qword [rdi + 0x258], rbx
je 0x10000527f
cmp dword [rdi + 0x264], ebx
je 0x10000527f
cmp qword [rdi + 0x80], rbx
je 0x100005235
cmp dword [rdi + 0x8c], ebx
jbe 0x100005235
mov dword [rdi + 0x238], 1
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.100005cbc
cmp eax, ebx
mov esi, eax
jge 0x10000527b
mov rcx, qword [0x100023120]
lea rdx, [0x100023120]
cmp rcx, rdx
je 0x1000052b2
test byte [rcx + 0x1c], 1
je 0x1000052b2
mov edx, 0xe
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000019a8]
mov r9d, eax
call fcn.1000048bc
jmp 0x1000052b2
cmp qword [rdi + 0x258], rbx
je 0x1000051e3
cmp dword [rdi + 0x264], ebx
jbe 0x1000051e3
mov rdx, qword [rdi + 0x258]
mov rcx, rdi
call fcn.1000060fc
cmp eax, ebx
mov esi, eax
jge 0x1000051e3
mov rcx, qword [0x100023120]
lea rdx, [0x100023120]
cmp rcx, rdx
je 0x1000052b2
test byte [rcx + 0x1c], 1
je 0x1000052b2
mov edx, 0xd
jmp 0x100005220
mov esi, ebx
jmp 0x1000052b2
mov rcx, qword [0x100023120]
lea rdx, [0x100023120]
cmp rcx, rdx
je 0x1000052ad
test byte [rcx + 0x1c], 1
je 0x1000052ad
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000019a8]
mov edx, 0xc
call fcn.100004898
mov esi, 0x80004005
test byte [rdi + 0x230], 1
je 0x1000052c4
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, ebx
setl bl
cmp dword [rsp + 0x48], 3
mov dword [rbp], ebx
jne 0x1000052da
mov dword [rbp], 0x10
mov eax, esi
jmp 0x100005311
mov rcx, qword [0x100023120]
lea rdx, [0x100023120]
cmp rcx, rdx
je 0x10000530c
test byte [rcx + 0x1c], 1
je 0x10000530c
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000019a8]
mov edx, 0xa
call fcn.100004898
mov eax, 0x80070057
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x100006c70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
xor ebp, ebp
mov r12, r8
mov rsi, rcx
and dword [rsp + 0x68], ebp
test rdx, rdx
je 0x100006e8d
test r8, r8
je 0x100006e8d
call fcn.100006f34
mov edi, eax
test eax, eax
jns 0x100006ce4
mov rcx, qword [0x100023120]
lea rbx, [0x100023120]
cmp rcx, rbx
je 0x100006e71
test byte [rcx + 0x1c], 1
je 0x100006e71
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0xb]
lea r8, [0x100001998]
call fcn.100004898
jmp 0x100006e71
mov rax, qword [rsi + 0x240]
and dword [rsp + 0x58], ebp
lea r8, [rsi + 0x268]
mov ecx, dword [rax + 8]
lea r9, [rsp + 0x58]
mov edx, 1
call fcn.10001df94
test eax, eax
js 0x100006d1c
cmp dword [rsp + 0x58], ebp
jne 0x100006d1c
mov rcx, rsi
call fcn.100008f10
jmp 0x100006d1e
xor eax, eax
test eax, eax
jne 0x100006d58
mov rcx, qword [0x100023120]
lea rbx, [0x100023120]
cmp rcx, rbx
je 0x100006d4e
test byte [rcx + 0x1c], 1
je 0x100006d4e
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0xc]
lea r8, [0x100001998]
call fcn.100004898
mov edi, 0x80004005
jmp 0x100006e71
lea rax, [rsp + 0x68]
lea r8, [0x100006edc]
mov r9, rsi
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
jne 0x100006dc7
mov rcx, qword [0x100023120]
lea rbx, [0x100023120]
cmp rcx, rbx
je 0x100006dae
test byte [rcx + 0x1c], 1
je 0x100006dae
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0xd]
lea r8, [0x100001998]
call fcn.100004898
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x100006e71
mov edi, 1
lea rbx, [0x100023120]
test edi, edi
je 0x100006e05
cmp dword [rsi + 0x25c], 0
jne 0x100006e05
mov rcx, rsi
call fcn.100008f10
mov edi, eax
test eax, eax
jne 0x100006e2c
mov rcx, qword [0x100023120]
cmp rcx, rbx
je 0x100006e2c
test byte [rcx + 0x1c], 4
je 0x100006e2c
lea edx, [rax + 0xe]
jmp 0x100006e1c
mov rcx, qword [0x100023120]
cmp rcx, rbx
je 0x100006e2c
test byte [rcx + 0x1c], 4
je 0x100006e2c
mov edx, 0xf
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
call fcn.100004898
mov edx, 0x1a0a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100006e6f
cmp eax, 0x102
je 0x100006dd3
mov rcx, qword [0x100023120]
cmp rcx, rbx
je 0x100006e6f
test byte [rcx + 0x1c], 1
je 0x100006e6f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
mov edx, 0x10
mov r9d, eax
call fcn.1000048bc
xor edi, edi
mov eax, dword [rsi + 0x260]
mov dword [r12], eax
test rbp, rbp
je 0x100006e89
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x100006ec0
mov rcx, qword [0x100023120]
lea rbx, [0x100023120]
cmp rcx, rbx
je 0x100006ebb
test byte [rcx + 0x1c], 1
je 0x100006ebb
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
mov edx, 0xa
call fcn.100004898
mov eax, 0x80070057
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x100006f34
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, rdx
mov rdi, rcx
cmp rdx, rbx
jne 0x100006f86
mov rcx, qword [0x100023120]
lea rdi, [0x100023120]
cmp rcx, rdi
je 0x100006f7c
test byte [rcx + 0x1c], 1
je 0x100006f7c
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x12]
lea r8, [0x100001998]
call fcn.100004898
mov eax, 0x80070057
jmp 0x10000716c
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 6]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp rax, rbx
jne 0x100006fce
mov rcx, qword [0x100023120]
lea rdi, [0x100023120]
cmp rcx, rdi
je 0x100007069
test byte [rcx + 0x1c], 1
je 0x100007069
mov edx, 0x13
jmp 0x100007059
cmp dword [rax], 0x11f4
je 0x10000700c
cmp dword [rax], 0x1c6c
je 0x100006fee
cmp dword [rax], 0x9cb8
jne 0x10000702f
mov dword [rdi + 0x258], ebx
jmp 0x100007028
mov rdx, rax
mov rcx, rdi
mov qword [rdi + 0x250], rax
call fcn.10000856c
mov dword [rdi + 0x258], 2
jmp 0x100007028
mov rdx, rax
mov rcx, rdi
mov qword [rdi + 0x248], rax
call fcn.100008a84
mov dword [rdi + 0x258], 1
mov qword [rdi + 0x240], rax
mov rax, qword [rdi + 0x240]
cmp rax, rbx
jne 0x100007073
mov rcx, qword [0x100023120]
lea rdi, [0x100023120]
cmp rcx, rdi
je 0x100007069
test byte [rcx + 0x1c], 1
je 0x100007069
mov edx, 0x14
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
call fcn.100004898
mov ebx, 0x80004005
jmp 0x100007161
test byte [rax + 0x54], 0x10
jne 0x10000709a
xor ecx, ecx
call fcn.10001af5c
cmp eax, ebx
je 0x10000709a
mov rax, qword [rdi + 0x240]
or dword [rax + 0x60], 0x10
mov rax, qword [rdi + 0x240]
or dword [rax + 0x68], 0x10
mov edx, 1
mov rcx, rdi
call fcn.1000079d4
mov r11, qword [rdi + 0x240]
cmp r11, rbx
jne 0x1000070ef
mov rcx, qword [0x100023120]
lea rdi, [0x100023120]
cmp rcx, rdi
je 0x1000070e8
test byte [rcx + 0x1c], 1
je 0x1000070e8
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
mov edx, 0x52
call fcn.100004898
mov rcx, qword [0x100023120]
mov ebx, 0xe0000000
jmp 0x100007141
cmp qword [r11 + 0x38], rbx
je 0x100007107
cmp qword [r11 + 0x20], rbx
je 0x100007107
cmp qword [r11 + 0x30], rbx
je 0x100007107
cmp qword [r11 + 0x40], rbx
jne 0x100007161
mov rcx, qword [0x100023120]
lea rdi, [0x100023120]
cmp rcx, rdi
je 0x10000713c
test byte [rcx + 0x1c], 1
je 0x10000713c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
mov edx, 0x53
call fcn.100004898
mov rcx, qword [0x100023120]
mov ebx, 0x80004005
cmp rcx, rdi
je 0x100007161
test byte [rcx + 0x1c], 1
je 0x100007161
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
mov edx, 0x15
call fcn.100004898
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x100007bf0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
mov rcx, qword [0x100023120]
lea rbp, [0x100023120]
cmp rcx, rbp
je 0x100007c3e
test byte [rcx + 0x1c], 4
je 0x100007c3e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
mov edx, 0x2a
call fcn.100004898
mov rcx, qword [0x100023120]
cmp qword [rdi + 0x240], 0
jne 0x100007c72
cmp rcx, rbp
je 0x100007c68
test byte [rcx + 0x1c], 1
je 0x100007c68
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
mov edx, 0x2b
call fcn.100004898
mov eax, 0xe0000000
jmp 0x100007d0e
bt dword [rdi + 0x230], 0xc
jae 0x100007c83
xor eax, eax
jmp 0x100007d0e
mov rcx, qword [rdi + 0x240]
mov edx, dword [rcx + 0x9aa0]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x100007ca2
xor ebx, ebx
jmp 0x100007cc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
test ebx, ebx
jns 0x100007cf0
mov rcx, qword [0x100023120]
cmp rcx, rbp
je 0x100007d0c
test byte [rcx + 0x1c], 1
je 0x100007d0c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
mov edx, 0x2c
mov r9d, ebx
call fcn.1000048bc
jmp 0x100007d0c
test esi, esi
je 0x100007d0a
mov rcx, qword [rdi + 0x240]
mov edx, 0xfa0
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1000081d8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0xe0
and qword [rsp + 0x50], 0
xor eax, eax
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x78]
lea r8d, [rax + 0x60]
xor edx, edx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 0x240]
mov dword [rsp + 0x70], 0x68
test rcx, rcx
jne 0x10000825e
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x100008254
test byte [rcx + 0x1c], 1
je 0x100008254
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
mov edx, 0x3c
call fcn.100004898
mov eax, 0xe0000000
jmp 0x1000083a3
mov rcx, qword [rcx + 0x40]
call fcn.1000182f4
test eax, eax
jne 0x1000082a3
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x100008299
test byte [rcx + 0x1c], 1
je 0x100008299
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
mov edx, 0x3d
call fcn.100004898
mov ecx, 0x80004005
jmp 0x1000083a1
mov rcx, qword [rbx + 0x240]
lea rax, [rsp + 0x50]
mov ebp, 0x274
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
add rcx, rbp
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x28], 0x4000000
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x100008351
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x10000833b
test byte [rcx + 0x1c], 1
je 0x10000833b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100023120]
mov r9, qword [rbx + 0x240]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
add r9, rbp
mov edx, 0x3e
mov dword [rsp + 0x20], eax
call fcn.100005088
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
jmp 0x1000083a1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x10000839f
test byte [rcx + 0x1c], 4
je 0x10000839f
mov r9, qword [rbx + 0x240]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001998]
add r9, rbp
mov edx, 0x3f
call fcn.100005008
xor ecx, ecx
mov eax, ecx
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x100008a84
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov ebx, 0x9cb8
mov r12, rdx
mov rcx, rbx
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
xor r15d, r15d
mov rdi, rax
cmp rax, r15
jne 0x100008af2
mov rcx, qword [0x100023120]
lea rsi, [0x100023120]
cmp rcx, rsi
je 0x100008eeb
test byte [rcx + 0x1c], 1
je 0x100008eeb
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0x4b]
lea r8, [0x100001998]
call fcn.100004898
jmp 0x100008eeb
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rdi], ebx
mov dword [rdi + 4], 0x20000
mov eax, dword [r12 + 4]
lea r9, [rdi + 0x54]
lea r8, [rdi + 0x4c]
mov dword [rdi + 8], eax
mov eax, dword [r12 + 8]
lea rdx, [rdi + 0x48]
mov dword [rdi + 0xc], eax
mov rax, qword [r12 + 0xc]
mov qword [rdi + 0x10], rax
mov rax, qword [r12 + 0x14]
mov qword [rdi + 0x18], rax
mov rax, qword [r12 + 0x1c]
mov qword [rdi + 0x20], rax
mov rax, qword [r12 + 0x24]
mov qword [rdi + 0x28], rax
mov rax, qword [r12 + 0x2c]
mov qword [rdi + 0x30], rax
mov rax, qword [r12 + 0x34]
mov qword [rdi + 0x38], rax
mov rax, qword [r12 + 0x3c]
mov qword [rdi + 0x40], rax
mov ecx, dword [r12 + 0x44]
call fcn.10000a3f4
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
test byte [rdi + 0x48], 1
movzx r11d, ax
lea rsi, [0x100023120]
mov ecx, 0x400
mov dword [rdi + 0x5c], r11d
mov eax, dword [r12 + 0x50]
mov dword [rdi + 0x60], eax
mov eax, dword [r12 + 0x54]
mov dword [rdi + 0x64], eax
mov eax, dword [r12 + 0x58]
mov dword [rdi + 0x848c], r15d
mov dword [rdi + 0x68], eax
push 0x24448b41
pop rsp
Function at 0x10000ca80
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x510
mov rax, qword [0x100023110]
xor rax, rsp
mov qword [rsp + 0x500], rax
xor eax, eax
mov rdi, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rax + 0x68]
xor edx, edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call sub.msvcrt.dll_memset
mov ebp, 0x104
lea rcx, [rsp + 0xe0]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x10000cb20
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x10000ccb4
test byte [rcx + 0x1c], 1
je 0x10000ccb4
mov edx, 0x15
jmp 0x10000cc04
cmp eax, ebp
jb 0x10000cb54
mov ebx, 0x8007007a
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x10000ccb4
test byte [rcx + 0x1c], 1
je 0x10000ccb4
mov edx, 0x16
jmp 0x10000cc04
lea r9, [rsp + 0xe0]
lea r8, [0x100002740]
lea rcx, [rsp + 0x2f0]
mov rdx, rbp
call fcn.10000b314
mov ebx, eax
test eax, eax
jns 0x10000cba1
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x10000ccb4
test byte [rcx + 0x1c], 1
je 0x10000ccb4
mov edx, 0x17
jmp 0x10000cc04
lea rax, [rdi + 0x450]
lea rcx, [rdi + 0x248]
lea r9, [rsp + 0x2f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [0x100002770]
lea rcx, [rsp + 0xe0]
mov rdx, rbp
call fcn.10000b314
mov ebx, eax
test eax, eax
jns 0x10000cc19
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x10000ccb4
test byte [rcx + 0x1c], 1
je 0x10000ccb4
mov edx, 0x18
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001940]
call fcn.100004898
jmp 0x10000ccb4
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x8000000
and dword [rsp + 0x20], 0
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x10000ccb2
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x10000cc9c
test byte [rcx + 0x1c], 1
je 0x10000cc9c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001940]
mov edx, 0x19
call fcn.100004898
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10000ccb4
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x10000ccc4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x10000ccd4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.10001e7a0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x10000cd40
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x100023110]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbp, r8
mov rbx, rdx
lea rcx, [rsp + 0x42]
xor r15d, r15d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], r15w
call sub.msvcrt.dll_memset
mov r12d, r15d
cmp rbx, r15
je 0x10000cef0
cmp rbp, r15
je 0x10000cef0
lea rdi, [0x100002790]
mov rcx, rbx
mov word [rbp], r15w
mov rdx, rdi
call fcn.100015480
cmp rax, rbx
jne 0x10000cdf0
or rcx, 0xffffffffffffffff
xor eax, eax
lea r8, [0x1000027c8]
repne scasw ax, word [rdi]
mov edx, 0x104
not rcx
lea r9, [rbx + rcx*2 - 2]
mov rcx, rbp
call fcn.10000b314
cmp eax, r15d
jl 0x10000cef5
jmp 0x10000ceeb
lea rdx, [rsp + 0x40]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp eax, r15d
je 0x10000ceeb
mov eax, dword [0x1000027d0]
lea rcx, [rsp + 0x30]
mov rdi, rbx
mov dword [rcx], eax
movzx eax, word [0x1000027d4]
lea rsi, [rsp + 0x40]
mov word [rcx + 4], ax
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
mov word [rsp + 0x250], r15w
not rcx
lea r14, [rcx - 1]
movzx eax, word [rsi]
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x30]
mov r8d, 0x103
mov word [rsp + 0x30], ax
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, r15d
je 0x10000cecf
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x250]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
cmp ecx, r14d
jae 0x10000cecf
lea rdx, [rsp + 0x250]
mov rcx, rbx
call fcn.100015480
mov r12d, r15d
cmp rax, rbx
sete r12b
cmp r12d, r15d
je 0x10000cecf
mov eax, edi
lea r9, [rsp + 0x30]
lea r8, [0x1000027d8]
lea rcx, [rbx + rax*2]
mov edx, 0x104
mov qword [rsp + 0x20], rcx
mov rcx, rbp
call fcn.10000b314
cmp eax, r15d
jl 0x10000cef5
movzx eax, word [rsi]
add rsi, 2
cmp ax, r15w
jne 0x10000cecf
cmp r12d, r15d
jne 0x10000ceeb
cmp word [rsi], r15w
jne 0x10000ce42
mov eax, r15d
jmp 0x10000cef5
mov eax, 0x80070057
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.10001e7a0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x10000d078
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x248
mov rax, qword [0x100023110]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
mov r9, rdx
mov r8d, eax
cmp rdx, rax
jne 0x10000d0d3
mov rcx, qword [0x100023120]
lea rax, [0x100023120]
cmp rcx, rax
je 0x10000d0cc
test byte [rcx + 0x1c], 1
je 0x10000d0cc
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001940]
mov edx, 0x1b
call fcn.100004898
xor eax, eax
jmp 0x10000d179
cmp word [r9], 0x5c
mov rcx, rdx
mov edx, 1
lea r10d, [rdx + 3]
mov word [rsp + 0x20], ax
cmove edx, r10d
cmp word [r9], ax
je 0x10000d10a
cmp r8d, edx
jge 0x10000d10d
cmp word [rcx], 0x5c
jne 0x10000d101
inc r8d
add rcx, 2
cmp word [rcx], ax
jne 0x10000d0f3
cmp r8d, edx
jne 0x10000d179
sub rcx, r9
sar rcx, 1
cmp rcx, 0x7ffffffe
ja 0x10000d179
lea r11, [rsp + 0x20]
mov r8d, 0x104
lea rdx, [rsp + 0x20]
sub r9, r11
mov r10d, eax
cmp rcx, rax
je 0x10000d157
movzx r11d, word [r9 + rdx]
cmp r11w, ax
je 0x10000d157
dec r8
mov word [rdx], r11w
dec rcx
add rdx, 2
cmp r8, rax
jne 0x10000d134
cmp r8, rax
jne 0x10000d166
sub rdx, 2
mov r10d, 0x8007007a
cmp r10d, eax
mov word [rdx], ax
jl 0x10000d179
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.10001e7a0
add rsp, 0x248
ret