joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140e808b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140e808bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140e808cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140e808b5
lea eax, [rcx + 1]
jmp 0x140e808db
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140e808ee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140e808d4
sub eax, 3
jb 0x140e8090e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140e8095d
sar eax, 1
movsxd rbp, eax
jb 0x140e80944
jmp 0x140e8091c
add ebx, ebx
jne 0x140e8091a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140e80944
inc ecx
add ebx, ebx
jne 0x140e8092a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140e80944
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140e8093d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140e8092c
add ecx, 2
jmp 0x140e80949
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140e80872
jmp 0x140e808bd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xe70000]
mov eax, dword [rdi]
or eax, eax
je 0x140e809bd
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xe804ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140e8096d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140e809b7
mov qword [rbx], rax
add rbx, 8
jmp 0x140e8098d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140e80a01
cmp al, 0xef
ja 0x140e809e9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140e809c9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140e809d8
mov eax, dword [rdi]
add rdi, 4
jmp 0x140e809d8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140e80a80], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140e80a80
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140e80a70
sub rsp, 0xffffffffffffff80
jmp 0x1400014e0
Function at 0x100011f54
Capabilities:
Listen for remote procedure calls

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, qword [0x10005d5b8]
lea r14, [0x10005d570]
xor esi, esi
mov rbp, r8
mov r12, rdx
test r14, r14
jne 0x100011fb0
mov ebx, 0x80070057
lea r8d, [rsi + 0x56]
lea rdx, [0x10000d640]
lea rcx, [0x10000d6c8]
mov r9d, ebx
call fcn.10001394c
jmp 0x1000120fa
and qword [rsp + 0x60], rsi
mov r9, rcx
lea r8, [0x100006f50]
lea rcx, [rsp + 0x60]
lea rdx, [0x10000dc08]
call fcn.1000132ac
mov ebx, eax
test eax, eax
jns 0x100011ff9
lea rdx, [0x10000db70]
lea rcx, [0x10000dc18]
mov r9d, eax
mov r8d, 0xe3
call fcn.10001394c
mov rdi, qword [rsp + 0x60]
jmp 0x100012000
mov rsi, qword [rsp + 0x60]
xor edi, edi
test rdi, rdi
je 0x100012019
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jns 0x100012028
mov r8d, 0x5a
jmp 0x1000120cb
xor r9d, r9d
lea rcx, [0x100006f70]
mov r8, rsi
lea edi, [r9 + 0x14]
mov qword [0x10005d540], r14
mov qword [0x10005d548], r12
mov edx, edi
mov qword [0x10005d550], rbp
mov qword [0x10005d558], r13
call qword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
test eax, eax
je 0x100012067
lea r8d, [rdi + 0x59]
jmp 0x1000120bd
lea rcx, [0x10000d5e0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterIf]
test eax, eax
je 0x100012085
mov r8d, 0x72
jmp 0x1000120bd
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0xa]
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
test eax, eax
je 0x1000120a3
mov r8d, 0x75
jmp 0x1000120bd
mov ecx, 1
mov edx, edi
mov r8d, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
test eax, eax
je 0x1000120e1
mov r8d, 0x7a
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rdx, [0x10000d640]
lea rcx, [0x10000d6c8]
mov r9d, ebx
call fcn.10001394c
test rsi, rsi
je 0x1000120fa
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x100012708
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r12, qword [0x10005d5c0]
xor esi, esi
mov r13, r8
mov rbp, rcx
mov qword [rsp + 0x60], rsi
test rcx, rcx
je 0x1000128ea
test r12, r12
je 0x1000128ea
lea r14, [0x10005d570]
xor edi, edi
test r14, r14
jne 0x100012773
mov edi, 0x80070057
lea r8d, [rsi + 0x70]
lea rdx, [0x10000df30]
lea rcx, [0x10000dfa8]
mov r9d, edi
call fcn.10001394c
jmp 0x100012798
lea rcx, [0x10005d580]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [0x10005d578], r14
mov qword [0x10005d570], r14
mov dword [0x10005d5a8], 1
mov ebx, edi
test edi, edi
jns 0x1000127bf
lea rdx, [0x10000d8e0]
lea rcx, [0x10000d968]
mov r9d, edi
mov r8d, 0x4d
call fcn.10001394c
jmp 0x100012926
lea rdx, [0x10000d988]
lea rcx, [rsp + 0x60]
mov r8, rbp
mov dword [0x10005d568], 1
mov qword [0x10005d560], r12
call fcn.1000132ac
mov ebx, eax
test eax, eax
jns 0x100012810
lea rdx, [0x10000d8e0]
lea rcx, [0x10000d968]
mov r9d, eax
mov r8d, 0x5a
call fcn.10001394c
mov rsi, qword [rsp + 0x60]
jmp 0x10001290d
mov rsi, qword [rsp + 0x60]
xor edx, edx
xor ecx, ecx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x10005d5b0], rax
test rax, rax
jne 0x10001285a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x5f
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmove ebx, eax
mov r9d, ebx
jmp 0x1000128fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100012878
mov ebx, 0xc1420126
lea r8d, [rax - 0x54]
mov r9d, ebx
jmp 0x1000128fa
mov rcx, qword [0x10005d560]
lea r9, [0x10005d5b8]
mov r8, rbp
mov rdx, r14
call fcn.100016118
mov ebx, eax
test eax, eax
jns 0x1000128a2
mov r9d, eax
mov r8d, 0x6e
jmp 0x1000128fa
mov r9, qword [0x10005d5b8]
mov r8, r13
mov rdx, r12
mov rcx, rbp
mov qword [rsp + 0x20], r14
call fcn.100011f54
mov ebx, eax
test eax, eax
jns 0x1000128cd
mov r9d, eax
mov r8d, 0x75
jmp 0x1000128fa
lea rdx, [0x10000d9c0]
mov ecx, 0x20000
mov dword [0x10005d56c], 1
call fcn.1000134a0
jmp 0x10001290d
mov edi, 0x80070057
mov r8d, 0x45
mov ebx, edi
mov r9d, edi
lea rdx, [0x10000d8e0]
lea rcx, [0x10000d968]
call fcn.10001394c
test rsi, rsi
je 0x100012926
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1000142e8
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
xor edi, edi
mov r12, rdx
mov rbp, rcx
and dword [rax - 0x18], edi
xor eax, eax
xor ebx, ebx
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x38], rax
mov esi, 0x10c
test rbx, rbx
je 0x100014337
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
add esi, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1000143ff
lea rdx, [rsp + 0x30]
mov r9d, esi
mov r8, rax
mov rcx, rbp
mov dword [rsp + 0x20], 9
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
cmp eax, 0x80000005
je 0x10001438b
test eax, eax
js 0x1000143cc
mov ecx, dword [rsp + 0x30]
test ecx, ecx
js 0x1000143bb
test eax, eax
js 0x10001431e
mov ebp, dword [rbx]
add ebp, 2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x1000143dd
mov r8d, 0x366
jmp 0x100014405
mov edi, ecx
mov r8d, 0x35b
bts edi, 0x1c
mov r9d, edi
jmp 0x10001440e
mov edi, eax
mov r8d, 0x35a
bts edi, 0x1c
mov r9d, edi
jmp 0x10001440e
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.100039740
mov r8d, dword [rbx]
lea rdx, [rbx + 4]
mov rcx, rsi
call fcn.100039734
mov qword [r12], rsi
jmp 0x100014421
mov r8d, 0x34d
mov r9d, 0x8007000e
mov edi, r9d
lea rdx, [0x10000e090]
lea rcx, [0x10000e128]
call fcn.10001394c
test rbx, rbx
je 0x10001443a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x1000146b8
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov r13, rdx
xor edi, edi
lea rdx, [rsp + 0x30]
and dword [rax - 0x28], edi
xor eax, eax
mov rbp, r8
and dword [rsp + 0x78], eax
mov r12, rcx
xor esi, esi
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x100014738
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x5f7
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmove edi, eax
lea rdx, [0x10000e090]
lea rcx, [0x10000e180]
mov r9d, edi
call fcn.10001394c
jmp 0x1000147e8
cmp dword [rsp + 0x34], esi
je 0x10001474b
mov edi, 0x8007007a
mov r8d, 0x602
jmp 0x10001471d
mov ebx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x100014791
mov edi, 0x8007000e
mov r8d, 0x606
lea rdx, [0x10000e090]
lea rcx, [0x10000e180]
mov r9d, edi
call fcn.10001394c
jmp 0x1000147cf
mov eax, dword [rsp + 0x30]
mov dword [rbp], eax
test eax, eax
je 0x1000147c9
and qword [rsp + 0x20], rdi
sub eax, esi
mov edx, esi
lea r9, [rsp + 0x78]
mov rcx, r12
add rdx, rbx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100014803
add esi, dword [rsp + 0x78]
mov eax, dword [rsp + 0x30]
cmp esi, eax
jb 0x10001479c
mov qword [r13], rbx
xor ebx, ebx
test rbx, rbx
je 0x1000147e8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, edi
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x618
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, 0x80004005
test edi, edi
cmove edi, eax
jmp 0x100014779

Function at 0x1000170b4
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov r8, rdx
mov rbx, rcx
mov dword [rsp + 0x58], eax
test rdx, rdx
je 0x100017149
and qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
mov rcx, r8
call fcn.100017a14
test eax, eax
js 0x100017121
and dword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x100017121
test rbx, rbx
je 0x100017121
mov eax, dword [rsp + 0x58]
mov dword [rbx + 0x28], eax
jmp 0x100017125
mov eax, dword [rsp + 0x58]
cmp qword [rsp + 0x60], 0
je 0x10001715c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rsp + 0x58]
jmp 0x10001715c
test rcx, rcx
je 0x10001715c
mov rax, qword [rcx + 0x40]
test rax, rax
cmovne rbx, rax
mov eax, dword [rbx + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x100017690
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor edi, edi
xor esi, esi
mov rbp, r8
mov r13, rcx
cmp rcx, 0xffffffffffffffff
je 0x100017792
test rdx, rdx
je 0x100017792
test r8, r8
jne 0x1000176d7
lea rbp, [0x10000e84c]
lea r12d, [r8 + 8]
jmp 0x1000176e8
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, esi
lea r12d, [rsi + 0xa]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, r12d
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x10001771f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x100017775
mov dword [rbx], esi
test esi, esi
je 0x10001773b
mov edx, esi
lea rcx, [rbx + 4]
mov r8, rbp
shr rdx, 1
inc rdx
call fcn.100012fb4
mov edi, eax
test edi, edi
js 0x100017775
and dword [rsp + 0x30], 0
xor eax, eax
lea rdx, [rsp + 0x30]
mov r9d, r12d
mov r8, rbx
mov rcx, r13
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0x28
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jns 0x100017775
mov edi, eax
bts edi, 0x1c
test rbx, rbx
je 0x10001778e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
jmp 0x100017797
mov eax, 0x80070057
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x1000177b8
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov rdi, rcx
mov ebx, esi
cmp rcx, rsi
je 0x100017838
cmp word [rcx], si
je 0x100017838
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 7]
xor r9d, r9d
mov edx, 0x10000
mov rcx, rdi
mov dword [rsp + 0x28], 0x6200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x100017822
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
cmp eax, esi
jne 0x100017834
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
je 0x100017834
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x100017845
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x100017a14
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
xor r13d, r13d
mov r12, rdx
lea esi, [r13 + 1]
mov ebx, r13d
mov rbp, r13
cmp rdx, r13
jne 0x100017a4b
mov eax, 0x80070057
jmp 0x100017b4b
xor edx, edx
call fcn.100017964
mov rdi, rax
cmp rax, r13
je 0x100017a6d
mov edx, 0x5c
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rbp, rax
jmp 0x100017a8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
cmp ebx, r13d
jl 0x100017b30
cmp esi, r13d
je 0x100017b24
cmp ebx, r13d
mov esi, r13d
jl 0x100017adb
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, r13d
jne 0x100017adb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
cmp ebx, 0x80070090
je 0x100017af3
cmp ebx, 0x80070002
je 0x100017af3
cmp ebx, 0x80070003
jne 0x100017b1b
mov edx, 0x5c
mov rcx, rdi
mov word [rbp], r13w
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rbp, rax
cmp rax, r13
je 0x100017b1b
mov word [rax + 2], r13w
mov ebx, r13d
mov esi, 1
cmp ebx, r13d
jge 0x100017a8b
cmp ebx, r13d
jl 0x100017b30
mov qword [r12], rdi
mov rdi, r13
cmp rdi, r13
je 0x100017b49
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x10001c26c
Capabilities:
Delete file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rsi, rcx
xor eax, eax
xor ecx, ecx
xor ebp, ebp
mov r14d, r8d
mov rbx, rdx
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x68], eax
test rsi, rsi
je 0x10001c2b7
lea rdx, [r11 + 0x10]
lea rcx, [r11 + 8]
mov r8, rsi
call fcn.10001939c
mov ecx, dword [rsp + 0x60]
mov eax, dword [rsp + 0x68]
mov rdx, qword [rbx]
mov r13d, dword [rdx + 0x1c]
mov r12d, r13d
and r12d, 0x400
je 0x10001c2d5
test al, al
js 0x10001c2d5
xor eax, eax
jmp 0x10001c43e
and r13d, 0x4000
je 0x10001c2e4
bt eax, 0x11
jae 0x10001c2ce
test byte [rbx + 0x2c], 2
jne 0x10001c3bb
lea rdi, [rbx + 8]
cmp qword [rdi], 0xffffffffffffffff
je 0x10001c33f
bt ecx, 0x18
jae 0x10001c315
test r12d, r12d
jne 0x10001c315
mov rdx, rbx
mov rcx, rsi
call fcn.10001eb78
mov edi, eax
jmp 0x10001c3bd
mov r9, qword [rbx + 0x10]
mov r8, qword [rdi]
add rdx, 0x20
mov rcx, rsi
mov dword [rsp + 0x20], 1
call fcn.100020170
test eax, eax
je 0x10001c3a5
or dword [rbx + 0x2c], 2
xor edi, edi
jmp 0x10001c3c1
test r12d, r12d
jne 0x10001c349
test r13d, r13d
je 0x10001c367
mov rcx, rsi
call fcn.100019360
mov rcx, rax
call fcn.100026324
mov rbp, rax
test rax, rax
jne 0x10001c370
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx]
mov r9, qword [rcx + 0x10]
jmp 0x10001c373
xor r9d, r9d
mov r8, rbp
test rbp, rbp
jne 0x10001c37f
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx]
mov rcx, rsi
mov dword [rsp + 0x28], 1
add rdx, 0x20
mov qword [rsp + 0x20], rdi
call fcn.100020024
test eax, eax
je 0x10001c3a5
or dword [rbx + 0x2c], 3
jmp 0x10001c338
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x10001c3bd
xor edi, edi
test edi, edi
js 0x10001c41a
test r14d, r14d
je 0x10001c41a
test r13d, r13d
je 0x10001c3e0
mov r9, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rdx, [rbx + 8]
mov rcx, rsi
call fcn.10001da98
jmp 0x10001c3f8
test r12d, r12d
je 0x10001c3fa
mov r9, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rdx, [rbx + 8]
mov rcx, rsi
call fcn.10001dd1c
mov edi, eax
test edi, edi
js 0x10001c41a
mov r8, qword [rbx]
cmp qword [r8 + 0x60], 0
je 0x10001c41a
mov rdx, qword [rbx + 0x10]
lea r9, [rbx + 8]
mov rcx, rsi
call fcn.10001d814
mov edi, eax
test rbp, rbp
je 0x10001c43c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x10001c45c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor r13d, r13d
mov rdi, r9
mov rsi, r8
mov r12, rdx
mov rbp, rcx
cmp r9, r13
je 0x10001c491
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, rsi
call fcn.1000300c4
cmp eax, r13d
jne 0x10001c519
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, r13d
jne 0x10001c519
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
bt ebx, 0x1c
mov ecx, ebx
jae 0x10001c4e8
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
jne 0x10001c4dc
mov edx, ebx
jmp 0x10001c4fc
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
jmp 0x10001c4fc
and ecx, 0x1fff0000
movzx eax, bx
mov edx, ebx
cmp ecx, 0x70000
cmove edx, eax
mov r9d, edx
mov r8, rsi
mov rcx, rbp
mov edx, 0x947f
mov qword [rsp + 0x20], r13
call fcn.1000185d8
cmp ebx, r13d
jl 0x10001c58a
or r9d, 0xffffffff
mov r8, r12
mov rdx, rsi
mov rcx, rbp
call fcn.10001beb8
cmp eax, r13d
mov ebx, eax
jge 0x10001c58a
bt eax, 0x1c
mov ecx, eax
jae 0x10001c557
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
cmp eax, 0x13d
jne 0x10001c54b
mov edx, ebx
jmp 0x10001c56b
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
jmp 0x10001c56b
and ecx, 0x1fff0000
movzx eax, ax
mov edx, ebx
cmp ecx, 0x70000
cmove edx, eax
mov r9d, edx
mov r8, rsi
mov rcx, rbp
mov edx, 0x947f
mov qword [rsp + 0x20], r13
call fcn.1000185d8
cmp eax, 0xfffffffe
cmove ebx, r13d
cmp rdi, r13
je 0x10001c598
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x10001cb94
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r13, r8
mov r12d, edx
mov rsi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rbx + 8]
lea r8d, [rbx + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x10001cbf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r11d, eax
movzx eax, ax
or eax, 0x80070000
test r11d, r11d
cmovle eax, r11d
jmp 0x10001cd77
mov qword [rax], rsi
test rsi, rsi
je 0x10001cc0a
lea rdx, [rax + 0x4c]
lea rcx, [rax + 0x48]
mov r8, rsi
call fcn.10001939c
cmp r12d, 1
jbe 0x10001cd65
xor r8d, r8d
lea r9, [rdi + 8]
lea rcx, [rdi + 0x20]
lea edx, [r8 + 0x40]
mov dword [rdi + 0x50], r12d
call fcn.100017ee8
mov ebx, eax
test eax, eax
js 0x10001cd58
lea r9, [rdi + 0x28]
lea rcx, [rdi + 0x40]
xor r8d, r8d
mov edx, 0x100
call fcn.100017ee8
mov ebx, eax
test eax, eax
js 0x10001cd58
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebp, 0x80070000
mov qword [rdi + 0x30], rax
test rax, rax
jne 0x10001cc85
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x10001cd58
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x10001ccb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x10001cd58
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x10001b6e4]
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x38], rax
test rax, rax
jne 0x10001ccf8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x10001cd58
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov rcx, qword [rdi + 0x38]
lea edx, [r12 - 1]
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x10001b544]
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x18], rax
test rax, rax
jne 0x10001cd54
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x10001cd65
mov rdx, rdi
mov rcx, rsi
call fcn.10001ca44
jmp 0x10001cd75
mov qword [r13], rdi
test rsi, rsi
je 0x10001cd75
mov qword [rsi + 0xa8], rdi
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret