joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad14930
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x270
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ebp, r9d
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
call fcn.4ad12ff0
lea rax, [rsp + 0x50]
sub rbx, rax
mov r10d, 0x106
lea rcx, [rsp + 0x50]
xor r12d, r12d
lea rax, [r10 + 0x7ffffef8]
cmp rax, r12
je 0x4ad149a1
movzx eax, word [rbx + rcx]
cmp ax, r12w
je 0x4ad149a1
mov word [rcx], ax
add rcx, 2
sub r10, 1
jne 0x4ad1497e
cmp r10, r12
je 0x4ad1f06b
mov word [rcx], r12w
cmp word [rsp + 0x50], r12w
je 0x4ad149ca
cmp word [rsp + 0x52], 0x3a
jne 0x4ad149ca
cmp word [rsp + 0x54], r12w
je 0x4ad1f074
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x30], r12d
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, 6
mov rcx, rdi
call fcn.4ad14a88
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x30]
mov r8d, 0xe
mov ecx, esi
mov dword [rsp + 0x20], 0x106
call fcn.4ad13950
lea r8, str._5lu
lea rcx, [0x4ad4ad20]
mov r9, rbp
mov edx, 0x104
call fcn.4ad01484
lea r11, [rsp + 0x50]
lea r9, [0x4ad4ad20]
mov edx, 0x2379
mov r8d, 2
mov rcx, rdi
mov qword [rsp + 0x20], r11
call fcn.4ad13c6c
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.4ad01000
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
sub rcx, 2
jmp 0x4ad149aa
lea r8, [0x4ad29784]
lea rcx, [rsp + 0x50]
mov edx, 0x106
call fcn.4ad01ac0
nop
jmp 0x4ad149ca
Function at 0x4ad217f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x40
mov rdi, rcx
xor r12d, r12d
mov rbx, r12
mov dword [r11 + 0x18], r12d
mov qword [r11 - 0x28], rcx
cmp rdx, r12
je 0x4ad2184c
cmp word [rdx], r12w
je 0x4ad2184c
lea rax, [r11 - 0x28]
mov qword [r11 - 0x38], rax
lea r9d, [r12 + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
cmp eax, r12d
je 0x4ad21847
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4ad218fc
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x4ad21886
lea rcx, [0x4ad29778]
call fcn.4ad01880
mov rbx, rax
mov qword [rsp + 0x38], rax
jmp 0x4ad218fc
cmp eax, r12d
je 0x4ad21895
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4ad218fc
mov ecx, dword [rsp + 0x70]
call fcn.4ad016dc
mov rbx, rax
mov qword [rsp + 0x38], rax
cmp rax, r12
je 0x4ad218f0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
mov esi, eax
cmp eax, r12d
je 0x4ad218fc
mov rcx, rbx
call fcn.4ad01040
mov rbx, r12
mov qword [rsp + 0x38], rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4ad218fc
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, qword [rsp + 0x30]
cmp rdi, rcx
je 0x4ad2190c
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x4ad21924
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x240
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor r13d, r13d
mov rax, rdx
mov r12, rcx
cmp rdx, r13
jne 0x4ad21a14
mov esi, r13d
lea r8, [rsp + 0x20]
mov r9d, 0x104
mov edx, esi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
cmp eax, r13d
jne 0x4ad21a01
cmp word [rsp + 0x20], 0x2e
jne 0x4ad219cf
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.4ad217f0
mov rbp, rax
cmp rax, r13
je 0x4ad219e8
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x4ad219c7
lea rdx, [rsp + 0x20]
lea rcx, str._s_s_r_n
mov r8, rbp
call fcn.4ad05fc4
mov ebx, eax
mov rcx, rbp
call fcn.4ad01040
cmp dword [0x4ad2e19c], r13d
jne 0x4ad219f7
inc esi
cmp ebx, r13d
jne 0x4ad21aaa
jmp 0x4ad2195e
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
mov ecx, eax
call fcn.4ad0b8b0
mov eax, 1
jmp 0x4ad21aac
cmp eax, 0x103
jne 0x4ad21aaa
mov ebx, r13d
jmp 0x4ad21aaa
xor edx, edx
mov rcx, rax
call fcn.4ad02f30
mov rcx, rax
call fcn.4ad01880
mov rsi, rax
cmp rax, r13
je 0x4ad219f7
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, r13
je 0x4ad21a45
mov word [rax], r13w
mov rdx, rsi
mov rcx, r12
call fcn.4ad217f0
mov rbp, rax
cmp rax, r13
je 0x4ad21a83
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x4ad21a83
lea rcx, str._s_s_r_n
mov r8, rbp
mov rdx, rsi
call fcn.4ad05fc4
mov ebx, eax
jmp 0x4ad21a9a
mov r8, rsi
mov edx, 1
mov ecx, 0x400023a3
call fcn.4ad0b8b0
mov ebx, 1
mov rcx, rbp
call fcn.4ad01040
mov rcx, rsi
call fcn.4ad01040
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.4ad01000
mov rbx, qword [rsp + 0x280]
add rsp, 0x240
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x4ad21adc
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rbx, r8
mov rsi, rdx
mov r12, rcx
xor r13d, r13d
cmp r8, r13
je 0x4ad21b6e
cmp word [r8], r13w
je 0x4ad21b6e
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov dword [rsp + 0x20], ecx
mov r9, rbx
lea r8d, [r13 + 1]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, r13d
jne 0x4ad21b4e
mov r8, rbx
mov rdx, rsi
lea rcx, str._s_s_r_n
call fcn.4ad05fc4
jmp 0x4ad21bf0
xor edx, edx
mov ecx, eax
call fcn.4ad0b8b0
mov r8, rsi
mov edx, 1
mov ecx, 0x235d
call fcn.4ad0b8b0
jmp 0x4ad21bf0
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RegDeleteKeyExW]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, r13d
je 0x4ad21bf0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x2000000
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, r13d
je 0x4ad21bbf
cmp eax, 2
je 0x4ad21bf0
xor edx, edx
mov ecx, eax
call fcn.4ad0b8b0
jmp 0x4ad21bf0
lea rdx, [0x4ad29778]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_RegDeleteValueW]
mov edi, eax
mov dword [rsp + 0x70], eax
cmp eax, r13d
je 0x4ad21be5
xor edx, edx
mov ecx, eax
call fcn.4ad0b8b0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
cmp edi, r13d
jne 0x4ad21c0e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x8000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x4ad21c0e
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x4ad22550
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor edi, edi
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x4ad22719
lea r9, [rsp + 0x44]
lea r8d, [rdi + 0x40]
lea rdx, [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x4ad225e7
cmp dword [rsp + 0x44], 0x40
jne 0x4ad225e7
mov ecx, 0x5a4d
mov eax, edi
cmp cx, word [rsp + 0x60]
sete al
jmp 0x4ad225e9
mov eax, edi
cmp eax, edi
je 0x4ad22710
mov edx, dword [rsp + 0x9c]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, edi
cmp eax, 0xffffffff
setne cl
cmp ecx, edi
je 0x4ad22710
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x40]
mov r8d, 4
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x4ad2264f
cmp dword [rsp + 0x44], 4
jne 0x4ad2264f
cmp dword [rsp + 0x40], 0x4550
mov eax, edi
sete al
jmp 0x4ad22651
mov eax, edi
cmp eax, edi
je 0x4ad22710
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov r8d, 0x14
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x4ad22710
cmp dword [rsp + 0x40], 0x14
jne 0x4ad22710
cmp word [rsp + 0x58], di
jbe 0x4ad22710
movzx ebx, word [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, rdi
je 0x4ad22710
movzx ebp, word [rsp + 0x58]
lea r9, [rsp + 0x40]
mov rdx, rax
mov rcx, rsi
mov r8d, ebp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, edi
je 0x4ad226fc
cmp ebp, dword [rsp + 0x40]
jne 0x4ad226fc
movzx eax, word [rsp + 0x48]
cmp eax, 0x14c
je 0x4ad226f0
cmp eax, 0x8664
jne 0x4ad226fc
lea rax, [rbx + 0x44]
cmp rax, rdi
je 0x4ad226fc
mov di, word [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, di
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.4ad01000
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x4ad23dc0
Capabilities:
Timestomp file

Disassembly:
push rbx
sub rsp, 0x40
mov eax, dword [0x4ad2e16c]
mov r8d, 3
mov r10, r9
mov rbx, rdx
cmp eax, r8d
jne 0x4ad23e10
cmp dword [0x4ad2e1bc], 0
jne 0x4ad23df8
xor edx, edx
mov ecx, 0x2340
call fcn.4ad07d88
add rsp, 0x40
pop rbx
ret
mov r9d, dword [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rcx + 8]
mov r8, r10
call fcn.4ad24820
mov dword [rbx], eax
jmp 0x4ad23df2
mov edx, 2
cmp eax, edx
jne 0x4ad23e92
mov rcx, qword [rcx + 8]
lea r9d, [rdx - 1]
call fcn.4ad11788
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4ad23e4a
mov rcx, qword [rsp + 0x78]
call fcn.4ad0478c
lea ecx, [rbx + 0x6f]
call fcn.4ad110f8
lea edx, [rbx + 2]
xor ecx, ecx
call fcn.4ad2477c
int3
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov ecx, ebx
call fcn.4ad0319c
inc dword [0x4ad2e168]
jmp 0x4ad23df2
mov rcx, qword [rsp + 0x78]
call fcn.4ad0478c
mov edx, 1
mov ecx, 0x2349
call fcn.4ad2477c
int3
Function at 0x4ad24604
Capabilities:
Delete file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov r12, r9
mov ebp, r8d
mov rbx, rdx
mov esi, ecx
xor edi, edi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
and qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov r8d, ebp
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad2465b
cmp ebp, dword [rsp + 0x30]
jne 0x4ad2465b
cmp dword [0x4ad2e19c], edi
je 0x4ad246d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rsp + 0x70]
mov dword [0x4ad2e13c], eax
call fcn.4ad0319c
mov ecx, esi
call fcn.4ad0319c
mov ecx, esi
call fcn.4ad03380
test eax, eax
je 0x4ad24689
mov edi, 0x1d
jmp 0x4ad24692
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [0x4ad2e13c]
and dword [0x4ad2e138], 0
mov eax, 0x70
test ecx, ecx
cmove ecx, eax
cmp dword [0x4ad2e19c], 0
mov dword [0x4ad2e13c], ecx
je 0x4ad246bc
xor edi, edi
jmp 0x4ad246c5
test edi, edi
jne 0x4ad246c5
call fcn.4ad110f8
mov edx, 1
mov ecx, edi
call fcn.4ad2477c
int3
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret

Function at 0x4ad24820
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
xor ebp, ebp
mov r13, r8
mov rsi, rdx
and dword [rax - 0x24], ebp
mov r14d, r9d
lea edx, [rbp + 2]
lea r8d, [rbp + 3]
xor r9d, r9d
call fcn.4ad11788
mov edi, eax
cmp eax, 0xffffffff
jne 0x4ad24874
lea ecx, [rbp + 0x6e]
call fcn.4ad110f8
lea edx, [rbp + 1]
xor ecx, ecx
call fcn.4ad2477c
int3
mov ecx, edi
call qword [sym.imp.msvcrt.dll__get_osfhandle]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov rcx, rax
mov r8d, r14d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ad24946
mov eax, dword [rsi + 0x38]
mov ebx, dword [rsp + 0x30]
mov r12d, ebx
test eax, 0xc000
jne 0x4ad248cd
cmp ebx, 2
jbe 0x4ad248c6
mov ecx, 0xfeff
cmp word [r13], cx
jne 0x4ad248c6
bts eax, 0xe
jmp 0x4ad248ca
bts eax, 0xf
mov dword [rsi + 0x38], eax
test ebx, ebx
je 0x4ad248fb
mov eax, dword [rsi + 0x38]
xor ecx, ecx
lea r9, [rsp + 0x34]
and eax, 0x8002
lea r8, [rsp + 0x30]
mov rdx, r13
cmp eax, 0x8002
sete cl
call fcn.4ad23120
mov ebx, dword [rsp + 0x30]
mov ebp, eax
cmp ebx, r14d
je 0x4ad24874
test ebp, ebp
jne 0x4ad24925
mov ecx, edi
sub ebx, r12d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
lea r9d, [rbp + 1]
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, edi
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
mov dword [0x4ad2e13c], eax
call fcn.4ad0319c
mov ecx, dword [0x4ad2e13c]
xor edx, edx
call fcn.4ad0b8b0
mov edx, 1
xor ecx, ecx
call fcn.4ad2477c
int3
Function at 0x4ad2497c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov rdi, rcx
mov ecx, dword [rcx]
mov r12, r9
mov ebp, r8d
mov rsi, rdx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [rdi]
call fcn.4ad0319c
mov r13d, 1
xor edx, edx
lea r8d, [r13 + 2]
mov r9d, r13d
mov rcx, rsi
call fcn.4ad11788
mov dword [rdi], eax
cmp eax, 0xffffffff
jne 0x4ad249ee
mov r8, rsi
mov edx, r13d
mov ecx, 0x4000271f
call fcn.4ad0b8b0
mov eax, r13d
jmp 0x4ad24a9e
mov ebx, ebp
mov ecx, eax
neg ebx
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r9d, 2
xor r8d, r8d
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [rdi]
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rdx, qword [rsp + 0x70]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov rcx, rax
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4ad24a42
mov ecx, dword [rdi]
call fcn.4ad0319c
or dword [rdi], 0xffffffff
jmp 0x4ad249d6
cmp dword [rsp + 0x50], ebp
jne 0x4ad24a36
mov rdx, qword [rsp + 0x70]
mov r8, rbp
mov rcx, r12
call sub.msvcrt.dll_memcmp
mov ecx, dword [rdi]
test eax, eax
jne 0x4ad24a38
call fcn.4ad0319c
xor r9d, r9d
mov edx, r13d
lea r8d, [r9 + 3]
mov rcx, rsi
call fcn.4ad11788
mov dword [rdi], eax
cmp eax, 0xffffffff
je 0x4ad249d6
mov ecx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov r9d, 2
xor r8d, r8d
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x4ad251bc
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x458
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x440], rax
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x30]
mov edx, 0x208
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor ecx, ecx
cmp eax, ecx
je 0x4ad25213
cmp eax, 0x208
jae 0x4ad25213
mov word [rsp + 0x36], cx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x4ad25213
mov eax, 1
jmp 0x4ad25215
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.4ad01000
add rsp, 0x458
ret

Function at 0x4ad25460
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea edx, [rbx + 4]
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, 3
jne 0x4ad254aa
cmp word [rsp + 0x2a], 0x3a
jne 0x4ad254aa
cmp word [rsp + 0x2c], 0x5c
jne 0x4ad254aa
xor eax, eax
jmp 0x4ad25503
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4ad25501
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 5
jne 0x4ad25501
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad25501
test al, 1
je 0x4ad25501
and eax, 0xfffffffe
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4ad25501
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4ad254f9
xor ebx, ebx
jmp 0x4ad25501
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.4ad01000
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x4ad27160
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x480
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x470], rax
lea rdx, [rsp + 0x50]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
xor ebx, ebx
cmp eax, ebx
jne 0x4ad27199
mov eax, 1
jmp 0x4ad2720d
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, ebx
je 0x4ad2720b
cmp eax, 4
je 0x4ad2720b
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x260]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
cmp eax, ebx
je 0x4ad27192
lea rdx, str.NTFS
lea rcx, [rsp + 0x260]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
sete bl
mov eax, ebx
jmp 0x4ad2720d
xor eax, eax
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.4ad01000
add rsp, 0x480
pop rbx
ret
Function at 0x140098010
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
movaps xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rsi, rcx
lea rax, [0x140439e48]
mov qword [rcx], rax
lea rax, [rcx + 8]
mov qword [rbp - 0x58], rax
mov dword [rcx + 8], 0
mov word [rcx + 0xc], 0
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x30], 0
mov qword [rcx + 0x38], 0xf
mov byte [rcx + 0x20], 0
lea rax, [0x1404388f8]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x58], 0
mov qword [rcx + 0x60], 0xf
mov byte [rcx + 0x48], 0
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x80], 0
mov qword [rcx + 0x88], 0xf
mov byte [rcx + 0x70], 0
mov qword [rcx + 0x68], rax
mov byte [rcx + 0x90], 0
mov dword [rcx + 0x94], 0
lea rax, [rcx + 0xa8]
mov qword [rbp - 0x50], rax
xorps xmm6, xmm6
movups xmmword [rcx + 0xb0], xmm6
mov qword [rcx + 0xc0], 0
mov byte [rcx + 0xc8], 1
mov dword [rcx + 0xcc], 1
movups xmmword [rcx + 0xd0], xmm6
mov qword [rcx + 0xe0], 0
lea rdi, [0x14043a7a8]
mov qword [rcx + 0xa8], rdi
mov qword [rcx + 0xa0], 0
mov byte [rcx + 0x1e0], 0
lea rbx, [rcx + 0x1e4]
mov r8d, 0x150
mov rcx, rbx
xor edx, edx
call fcn.14041da70
mov qword [rbp - 0x48], rbx
mov rcx, rbx
xor edx, edx
call fcn.1402d68d0
mov dword [rsi + 0x334], 0
lea rax, [rsi + 0x348]
mov qword [rbp - 0x40], rax
movups xmmword [rsi + 0x348], xmm6
movups xmmword [rsi + 0x358], xmm6
mov qword [rsi + 0x368], 0
mov ecx, 0x70
call fcn.1403f542c
lea rcx, [rsi + 0x360]
mov qword [rbp - 0x38], rcx
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov byte [rax + 0x18], 1
movzx ecx, byte [0x1405015c4]
add cl, 0xba
mov byte [rax + 0x19], cl
mov qword [rsi + 0x360], rax
lea rax, [rsi + 0x370]
mov qword [rbp - 0x30], rax
movups xmmword [rsi + 0x370], xmm6
mov qword [rsi + 0x380], 0
lea rax, [rsi + 0x390]
mov qword [rbp - 0x28], rax
movups xmmword [rsi + 0x390], xmm6
mov qword [rsi + 0x3a0], 0
mov eax, dword [0x1405758b0]
mov ecx, dword [0x140579420]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x26838]
jg 0x140098278
lea rax, [0x1405756e8]
mov qword [rsi + 0x3a8], rax
lea rax, [rsi + 0x3c8]
mov qword [rbp - 0x20], rax
movups xmmword [rsi + 0x3d0], xmm6
mov qword [rsi + 0x3e0], 0
mov byte [rsi + 0x3e8], 1
mov dword [rsi + 0x3ec], 1
movups xmmword [rsi + 0x3f0], xmm6
mov qword [rsi + 0x400], 0
mov qword [rsi + 0x3c8], rdi
mov rcx, rsi
call fcn.140098740
mov rax, rsi
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [0x1405015c0]
lea ecx, [rax + 0x7380dc9e]
mov edx, eax
xor edx, 0x7380dc9e
mov r8d, eax
and r8d, 0x7380dc9e
lea r8d, [rdx + r8*2]
lea r9d, [rax - 0x526116e0]
add eax, 0xf797aa51
mov dword [rsp + 0x20], eax
lea rdx, [0x1405758b0]
call fcn.1400aabf0
cmp dword [0x1405758b0], 0xffffffff
jne 0x140098208
lea rcx, [0x1405756e8]
call fcn.140098f90
lea rcx, [0x140099220]
mov edx, 0x4a20c8c2
mov r8d, 0x39c171e1
call fcn.1400aa090
mov dword [rsp + 0x20], 0x8416cdb4
lea rdx, [0x1405758b0]
xor ecx, ecx
xor r8d, r8d
mov r9d, 0x3a1e0c83
call fcn.1400aabf0
jmp 0x140098208
Function at 0x140099420
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov ebp, dword [0x1405758c4]
lea rax, [fcn.140099420]
add eax, eax
add eax, 0x14c0
mov ecx, eax
not ecx
test ecx, eax
jne 0x140099460
movzx eax, byte [rbx + 0x19]
mov ecx, dword [0x140575634]
cmp ecx, 0x43
jl 0x140099467
nop
test rbx, rbx
je 0x140099460
jmp 0x14009944f
test al, al
jne 0x1400994f8
nop
mov r8, qword [rbx + 0x10]
mov eax, ebp
xor eax, eax
not eax
and eax, dword [0x140502f54]
xor eax, ebp
add eax, 0x1b89912b
mov ecx, eax
xor ecx, 0xe476a2fb
and eax, 0x6476a2fb
lea eax, [rcx + rax*2]
cdqe
add rax, qword [0x140502f68]
mov rcx, rdi
mov rdx, rsi
call qword [case.0x14013cbc3.0]
mov r14, qword [rbx]
mov eax, dword [0x140502f50]
or eax, ebp
xor ecx, ecx
sub ecx, dword [0x1405015c0]
mov edx, ecx
xor edx, 0x8c7f5789
and ecx, 0xc7f5789
lea ecx, [rdx + rcx*2]
add ecx, eax
movsxd rax, ecx
add rax, qword [0x140502f60]
mov edx, 0x70
mov rcx, rbx
call qword [case.0x14013cbc3.0]
cmp byte [r14 + 0x19], 0
mov rbx, r14
je 0x140099470
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400a8830
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov eax, dword [0x140575630]
mov ecx, dword [0x1405015c0]
add ecx, eax
add ecx, 0x8c7f2362
imul ecx, eax
test cl, 1
jne 0x1400a8863
mov rcx, rsi
call fcn.140347960
mov al, 1
test al, al
jne 0x1400a88a4
lea rax, [fcn.1400a8830]
add eax, eax
add eax, 0x1100
mov edi, eax
xor edi, 0xfffffffe
and edi, eax
nop dword [rax + rax]
mov rcx, rsi
call fcn.140347960
mov eax, dword [0x1405015c0]
mov ecx, eax
xor ecx, 0x7380dc9d
and eax, 0x7380dc9d
lea eax, [rcx + rax*2]
cmp edi, eax
jne 0x1400a8880
jmp 0x1400a8855
add rsp, 0x28
pop rdi
pop rsi
ret