joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478f10
Capabilities:
Enumerate services

Disassembly:
test rdx, rdx
je 0x479155
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
xor r12d, r12d
mov r15, rdx
xor edx, edx
mov dword [rbp + 0x1a0], r12d
xor ecx, ecx
mov dword [rbp + 0x1a8], r12d
mov dword [rbp + 0x1b0], r12d
lea r8d, [r12 + 4]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
je 0x47913b
lea rax, [rbp + 0x1b0]
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea esi, [r12 + 3]
lea rax, [rbp + 0x1a8]
mov r8d, esi
mov qword [rsp + 0x30], rax
lea edi, [rsi + 0x2d]
lea rax, [rbp + 0x1a0]
mov edx, edi
mov qword [rsp + 0x28], rax
mov rcx, r14
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
jne 0x478fca
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x479132
mov ecx, dword [rbp + 0x1a0]
movabs r13, 0xaaaaaaaaaaaaaaab
mov rax, r13
mul rcx
mov rcx, 0xffffffffffffffff
mov rax, rdi
shr rdx, 5
inc rdx
mul rdx
lea rdx, [0x0047b0a0]
cmovo rax, rcx
mov rcx, rax
call fcn.0042267c
mov rbx, rax
test rax, rax
je 0x479132
mov ecx, dword [rbp + 0x1a0]
mov rax, r13
mul rcx
mov rcx, rbx
shr rdx, 5
inc rdx
lea r8, [rdx + rdx*2]
xor edx, edx
shl r8, 4
call fcn.00424830
lea rax, [rbp + 0x1b0]
mov r9, rbx
mov qword [rsp + 0x38], rax
mov r8d, esi
lea rax, [rbp + 0x1a8]
mov edx, edi
mov qword [rsp + 0x30], rax
mov rcx, r14
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x1a0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
test eax, eax
je 0x47912a
mov esi, r12d
cmp dword [rbp + 0x1a8], r12d
jbe 0x47912a
lea rax, [rsp + 0x58]
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], rax
lea rax, [0x0048d7e0]
mov qword [rsp + 0x40], rax
mov eax, esi
mov dword [rsp + 0x54], 0x104
mov word [rsp + 0x58], r12w
lea rdi, [rax + rax*2]
add rdi, rdi
mov rdx, qword [rbx + rdi*8]
test rdx, rdx
je 0x47911c
lea r8, [rsp + 0x40]
call fcn.00478c04
test al, al
je 0x47911c
or rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], r12w
jne 0x4790dc
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x4790fd
mov r8d, eax
mov rdx, r15
call fcn.00438e94
jmp 0x479108
cmp dword [rsp + 0x50], 1
mov eax, r12d
setae al
test eax, eax
jne 0x47911c
cmp dword [rbx + rdi*8 + 0x14], 1
je 0x47911c
mov rdx, qword [rbx + rdi*8]
call fcn.00478e00
inc esi
cmp esi, dword [rbp + 0x1a8]
jb 0x47908f
mov rcx, rbx
call fcn.00422660
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x47915c
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rax - 0x388]
sub rsp, 0x470
mov r14, rdx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
call fcn.00424830
test r14, r14
je 0x4792a4
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x4792a4
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x479293
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x479285
mov r8d, 0x104
lea rdx, [rbp + 0x160]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x47927c
lea rcx, [rbp + 0x160]
call qword [sym.imp.USER32.dll_CharLowerW]
mov rdx, r14
lea rcx, [rbp + 0x160]
call fcn.00423b70
test rax, rax
je 0x47927c
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTopWindow]
jmp 0x479262
and dword [rbp + 0x390], 0
lea rdx, [rbp + 0x390]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rsp + 0x28]
cmp dword [rbp + 0x390], ecx
mov rcx, rbx
je 0x47926c
mov edx, 2
call qword [sym.imp.USER32.dll_GetWindow]
mov rbx, rax
test rax, rax
jne 0x479231
jmp 0x47927c
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4791ce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x4792dc
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x7c8]
sub rsp, 0x8c0
xor esi, esi
lea rcx, [0x0048d7e0]
mov rbx, rdx
mov qword [rsp + 0x20], rcx
mov edx, 0x104
mov qword [rbp + 0x140], rcx
lea rax, [rsp + 0x38]
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x360]
lea rax, [rbp + 0x158]
mov dword [rbp + 0x154], edx
xor edx, edx
mov qword [rbp + 0x148], rax
mov r8d, 0x208
mov dword [rsp + 0x30], esi
mov word [rsp + 0x38], si
mov dword [rbp + 0x150], esi
mov word [rbp + 0x158], si
call fcn.00424830
mov r8d, 0x103
lea rdx, [rbp + 0x360]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x360]
call qword [sym.imp.USER32.dll_CharLowerW]
test rbx, rbx
je 0x47948b
cmp word [rbx], si
je 0x47948b
mov r8, rbx
lea rdx, str._s.exe
lea rcx, [rbp + 0x140]
call fcn.004012e8
mov rcx, qword [rbp + 0x148]
lea rdx, [rbp + 0x570]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x47948b
test byte [rbp + 0x570], 0x10
jne 0x47946a
lea r9, [rbp + 0x59c]
mov r8, rbx
lea rdx, [0x00491de8]
lea rcx, [rsp + 0x20]
call fcn.004012e8
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x479440
mov edx, dword [rsp + 0x30]
inc edx
call fcn.0043771c
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x479440
lea r8, [rbp + 0x360]
mov rax, rcx
sub r8, rcx
movzx edx, word [rax]
cmp dx, word [rax + r8]
jne 0x479439
add rax, 2
test dx, dx
jne 0x479422
mov eax, esi
jmp 0x47944a
sbb eax, eax
or eax, 1
jmp 0x47944a
cmp dword [rsp + 0x30], 1
mov eax, esi
setae al
test eax, eax
je 0x47946a
lea rdx, [0x0048d7c4]
call fcn.00423b70
mov rdx, rax
call fcn.0047915c
mov rdx, rbx
call fcn.00478f10
lea rdx, [rbp + 0x570]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4793ce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x212a6e8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x212a6f2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x212a71b
pop rbp
sub rbp, 0x33
sub rbp, 0x1d2a6e8
sub rsp, 0x20
jmp 0x212a73a
mov rax, 0x1d2a6e8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x217cac69
xor byte [rax], dl
inc rax
dec rcx
jne 0x212a759
jmp 0x212a770
and eax, esp
and dl, 0xe0
push rbp
imul ebp, dword [rcx + 0x69], 0x61a8e821
push 0x68216969
and byte [rcx], 0xae
test eax, 0x69696963
and dword [rsi + 0x696941ab], ebp
imul esp, dword [rcx], 0x68218b9e
test al, 0xe2
call 0x6b7c1102
and dword [rax - 0x7f], ebp
cmp dword [rcx], edi
and ecx, edx
int1
test byte [rdi + 0x69], 0x69
imul ebp, dword [rcx + 0x69], 0x6e26d021
int 0x68
imul ebp, dword [rcx + 0x69], 0x80682169
and ebx, edx
push rbp
cmp eax, 0x6969cfab
imul ebp, dword [rcx - 0x7f], 0x6969696c
cmp byte [rdi + 0x69], 0x69
imul ebp, dword [rax + 0x78586b81], 0x6da8e821
imul ebp, dword [rcx + 0x69], 0x66a19621
in al, dx
xchg dword [rsi + 0x31aa9696], edx
xor edi, dword [rbx]
cmp dword [rcx], esp
sal ecx, 1
test byte [rdi + 0x69], 0x69
imul ebp, dword [rcx + 0x69], 0x6e26d021
int 0x68
imul ebp, dword [rcx + 0x69], 0x80682169
sub dword [rcx + rbp*2 + 0x69], 0x6be48069
imul ebp, dword [rcx + 0x3b], 0x69691481
imul esi, dword [rbx], 0xbee0213e
and dword [rax - 0x60], ebx
and dword [rax - 0x45], ebx
invalid
Function at 0x407074
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x407082
and edx, 0x3fff
jmp fcn.00406fcc

Function at 0x407088
Capabilities:
Delete directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040b1e4
mov ebx, eax
cmp eax, 1
je 0x4070b8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x4070b8
mov al, 1
jmp 0x407109
test ebx, ebx
je 0x407107
lea rcx, [rsp + 0x28]
call fcn.0040354c
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040b8b0
test al, al
je 0x4070fd
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call fcn.00402388
mov al, bl
jmp 0x407109
mov rcx, qword [rsp + 0x28]
call fcn.00402388
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x407130
Capabilities:
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, rdx
mov r12, rcx
call fcn.0040b1e4
mov esi, eax
mov rcx, rbp
call fcn.0040b1e4
mov edi, eax
mov ebx, 1
cmp esi, ebx
je 0x40717f
cmp eax, ebx
je 0x40717f
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x40717f
mov al, bl
jmp 0x40720d
test esi, esi
jne 0x40718b
test edi, edi
je 0x40720b
lea rcx, [rsp + 0x48]
call fcn.0040354c
nop
lea rcx, [rsp + 0x38]
call fcn.0040354c
nop
cmp esi, ebx
je 0x4071a9
cmp edi, ebx
jne 0x4071ab
xor bl, bl
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x48]
mov rdx, rbp
mov rcx, r12
call fcn.0040b8f8
test al, al
je 0x4071f6
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x38]
call fcn.00402388
nop
mov rcx, qword [rsp + 0x48]
call fcn.00402388
mov al, bl
jmp 0x40720d
mov rcx, qword [rsp + 0x38]
call fcn.00402388
nop
mov rcx, qword [rsp + 0x48]
call fcn.00402388
xor al, al
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x4073b0
Capabilities:
Create directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040b1e4
mov ebx, eax
cmp eax, 1
je 0x4073ef
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4073e2
mov al, 1
jmp 0x407442
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x407440
test ebx, ebx
je 0x407440
lea rcx, [rsp + 0x28]
call fcn.0040354c
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040b8b0
test al, al
je 0x407436
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call fcn.00402388
mov al, bl
jmp 0x407442
mov rcx, qword [rsp + 0x28]
call fcn.00402388
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x407474
Capabilities:
Delete file

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call fcn.004086c8
cmp eax, 0xffffffff
je 0x4074aa
test al, 0x10
jne 0x4074aa
test al, 1
je 0x4074aa
and eax, 0xfffffffe
mov edx, eax
mov rcx, rbx
call fcn.00406fcc
test al, al
je 0x40751b
mov rcx, rbx
call fcn.0040b1e4
mov edi, eax
cmp eax, 1
je 0x4074ca
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4074ca
mov al, 1
jmp 0x40751b
test edi, edi
je 0x407519
lea rcx, [rsp + 0x28]
call fcn.0040354c
nop
cmp edi, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.0040b8b0
test al, al
je 0x40750f
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call fcn.00402388
mov al, bl
jmp 0x40751b
mov rcx, qword [rsp + 0x28]
call fcn.00402388
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x40754c
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
cmp eax, ecx
setne al
add rsp, 0x28
ret

Function at 0x407564
Capabilities:
Get common file path

Disassembly:
push rbx
push rdi
sub rsp, 0x278
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, rcx
mov dword [rcx + 8], 0
mov rax, qword [rcx]
mov word [rax], 0
mov word [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov ecx, 0x114
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test eax, eax
je 0x407666
cmp ebx, 0x114
jae 0x4075d0
mov word [rsp + 0x268], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.00403730
mov al, 1
jmp 0x407666
lea rcx, [rsp + 0x20]
call fcn.0040354c
nop
cmp ebx, dword [rsp + 0x2c]
jbe 0x4075ed
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.00403220
mov rdx, qword [rsp + 0x20]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r11d, eax
test eax, eax
jne 0x40760f
mov rcx, qword [rsp + 0x20]
call fcn.00402388
xor al, al
jmp 0x407666
mov rcx, qword [rsp + 0x20]
mov word [rcx + rbx*2], 0
xor eax, eax
cmp word [rcx], ax
je 0x40762d
inc eax
add rcx, 2
cmp word [rcx], 0
jne 0x407621
mov dword [rsp + 0x28], eax
cmp eax, r11d
jne 0x40765a
lea eax, [rbx - 1]
cmp eax, r11d
jne 0x40765a
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.00403798
nop
mov rcx, qword [rsp + 0x20]
call fcn.00402388
mov al, 1
jmp 0x407666
mov rcx, qword [rsp + 0x20]
call fcn.00402388
xor al, al
add rsp, 0x278
pop rdi
pop rbx
ret

Function at 0x407758
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x250
mov rbx, rcx
lea rdx, [rsp + 0x20]
xor edi, edi
mov ecx, 0x114
mov word [rsp + 0x20], di
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov esi, eax
call fcn.00403730
mov rcx, rbx
call fcn.0040ab6c
cmp esi, edi
je 0x4077a5
cmp esi, 0x114
jae 0x4077a5
mov edi, 1
mov al, dil
add rsp, 0x250
pop rdi
pop rsi
pop rbx
ret
Function at 0x4077b4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbp, r9
mov rsi, r8
mov r12b, dl
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
shl ebx, 2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor edi, ebx
shl edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r13d, eax
xor r13d, edi
xor edi, edi
mov ebx, edi
lea r15d, [rdi + 1]
mov dword [rsi + 8], edi
mov rcx, qword [rsi]
mov byte [rcx], dil
cmp r12b, dil
je 0x40787c
mov r10d, r13d
mov r9, rdi
mov r11d, 8
mov r8d, r10d
and r8d, 0xf
shr r10d, 4
lea edx, [r8 + 0x30]
lea eax, [r8 + 0x37]
movzx ecx, al
movzx eax, dl
cmp r8d, 0xa
cmovb ecx, eax
mov byte [rsp + r9 + 0x38], cl
add r9, r15
sub r11, r15
jne 0x407820
mov byte [rsp + r9 + 0x38], dil
cmp rbp, rdi
je 0x40785f
mov rcx, rsi
call fcn.00403d68
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.00402fac
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 2
cmove eax, r15d
add r13d, eax
mov r12b, r15b
cmp rbp, rdi
je 0x407893
lea rdx, str..tmp
mov rcx, rsi
call fcn.00402fac
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.004035b8
nop
mov rdx, qword [rsi]
lea rcx, [rsp + 0x28]
call fcn.004039f0
mov rcx, qword [rsp + 0x28]
call fcn.004092d4
cmp al, dil
je 0x4078d5
mov ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, qword [rsp + 0x28]
call fcn.00402388
jmp 0x40791c
cmp rbp, rdi
je 0x4078f1
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
mov rcx, rbp
call fcn.0040a030
cmp al, dil
jne 0x40792a
jmp 0x407900
mov rcx, qword [rsp + 0x28]
call fcn.004073b0
cmp al, dil
jne 0x407939
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x407912
cmp eax, 0xb7
jne 0x407948
mov rcx, qword [rsp + 0x28]
call fcn.00402388
add ebx, r15d
cmp ebx, 0x64
jb 0x407806
jmp 0x407952
mov rcx, qword [rsp + 0x28]
call fcn.00402388
mov al, r15b
jmp 0x40795d
mov rcx, qword [rsp + 0x28]
call fcn.00402388
mov al, r15b
jmp 0x40795d
mov rcx, qword [rsp + 0x28]
call fcn.00402388
mov dword [rsi + 8], edi
mov rax, qword [rsi]
mov byte [rax], dil
xor al, al
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4086c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040b1e4
mov ebx, eax
cmp eax, 1
je 0x4086f5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408746
test ebx, ebx
je 0x408741
lea rcx, [rsp + 0x28]
call fcn.0040354c
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040b8b0
test al, al
je 0x408737
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rcx, qword [rsp + 0x28]
call fcn.00402388
mov eax, ebx
jmp 0x408746
mov rcx, qword [rsp + 0x28]
call fcn.00402388
mov eax, 0xffffffff
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x409414
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbp, rcx
movsxd rbx, dword [rcx + 8]
mov rdi, rbx
test ebx, ebx
je 0x409464
shl rdi, 3
add ebx, 0xffffffff
sub rdi, 8
mov rax, qword [rbp]
mov rsi, qword [rdi + rax]
test rsi, rsi
je 0x409460
mov rcx, qword [rsi]
call fcn.00402388
mov rcx, rsi
call fcn.00402388
test ebx, ebx
jne 0x40943c
mov dword [rbp + 8], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test eax, eax
je 0x409569
mov rcx, rdi
xor ebx, ebx
mov qword [rsp + 0x80], rbx
test eax, eax
je 0x4094a3
add rcx, rcx
call fcn.00402350
mov rbx, rax
mov qword [rsp + 0x80], rax
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
test eax, eax
je 0x40955f
cmp eax, edi
ja 0x40955f
lea rcx, [rsp + 0x28]
call fcn.0040354c
nop
xor r13d, r13d
xor edi, edi
test esi, esi
je 0x409540
mov r12, rbx
cmp word [r12], 0
jne 0x409536
lea rdx, [rbx + r13*2]
lea rcx, [rsp + 0x28]
call fcn.00403730
lea r13d, [rdi + 1]
mov rcx, rbp
call fcn.00445a44
mov ecx, 0x10
call fcn.00402350
mov qword [rsp + 0x88], rax
test rax, rax
je 0x409522
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.004036a8
mov r11, rax
jmp 0x409525
xor r11d, r11d
mov ecx, dword [rbp + 8]
lea eax, [rcx + 1]
mov dword [rbp + 8], eax
mov rax, qword [rbp]
mov qword [rax + rcx*8], r11
inc edi
add r12, 2
cmp edi, esi
jb 0x4094d7
cmp r13d, esi
sete dil
mov rcx, qword [rsp + 0x28]
call fcn.00402388
nop
mov rcx, rbx
call fcn.00402388
mov al, dil
jmp 0x409569
mov rcx, rbx
call fcn.00402388
xor al, al
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x409638
Capabilities:
Get file size

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp byte [rcx + 9], 0
mov rbx, rdx
je 0x409657
cmp byte [rcx + 0xa], 0
je 0x409657
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
jmp 0x409693
mov rcx, qword [rcx]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov edi, eax
jne 0x409682
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x409682
xor al, al
jmp 0x409695
mov ecx, dword [rsp + 0x40]
mov rax, rdi
shl rcx, 0x20
add rcx, rdi
mov qword [rbx], rcx
mov al, 1
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x4097b8
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
setne al
mov dword [rbx], ecx
add rsp, 0x30
pop rbx
ret

Function at 0x4097f4
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x400000
cmp r8d, eax
cmova r8d, eax
jmp fcn.004097b8

Function at 0x4098b8
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov eax, 0x400000
mov rbx, r9
cmp r8d, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
cmova r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x4099cc
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call fcn.004096f8
xor ebx, ebx
cmp al, bl
je 0x4099f4
cmp qword [rsp + 0x50], rdi
je 0x4099f8
xor al, al
jmp 0x409a06
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, ebx
setne al
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x40bc48
Capabilities:
Get disk size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov r12, rcx
lea rcx, [0x004609f0]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetDiskFreeSpaceExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40bcae
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, r12
call rax
test eax, eax
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rax, qword [rsp + 0x48]
setne bpl
mov qword [rdi], rax
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x40bd00
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
imul rcx, rax
test bpl, bpl
mov qword [rbx], rcx
jne 0x40bcfe
mov eax, dword [rsp + 0x38]
imul rax, rcx
mov qword [rsi], rax
mov eax, dword [rsp + 0x3c]
imul rax, qword [rbx]
mov qword [rdi], rax
mov al, 1
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret