joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005c1dc
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14b, r8b
mov r15, rdx
mov r12, rcx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x50]
mov ebp, eax
mov r13d, eax
xor sil, sil
call fcn.140055d78
test r14b, r14b
jne 0x14005c312
mov eax, 0x14
lea rcx, [rsp + 0x50]
cmp ebp, eax
cmovl r13d, eax
lea eax, [r13 + 4]
movsxd rbx, eax
mov rdx, rbx
call fcn.140055e58
mov rdi, qword [rsp + 0x50]
mov r8, rbx
mov rcx, rdi
xor edx, edx
call fcn.1400cc8d0
lea r11d, [rbp + 1]
mov rdx, r12
movsxd r8, r11d
mov rcx, rdi
call fcn.14001a4c0
test ebp, ebp
jle 0x14005c27f
mov rax, rbp
add sil, sil
add sil, byte [r12]
inc r12
sub rax, 1
jne 0x14005c26f
mov al, sil
mov ecx, ebp
xor r12d, r12d
shr al, 5
sar ecx, 2
lea r11, [0x140000000]
add cl, al
mov al, sil
shr sil, 2
shl al, 3
movsxd r10, r13d
mov r9d, r12d
add cl, al
mov r8, r12
add cl, sil
add cl, bpl
movzx eax, cl
cdq
and edx, 0x3f
add eax, edx
and eax, 0x3f
sub eax, edx
cmp r10, r12
movsxd rcx, eax
mov sil, byte [rcx + r11 + 0xf1360]
jle 0x14005c30d
mov eax, 0x66666667
imul r9d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
inc r9d
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
mov al, byte [rcx + r11 + 0xf13a8]
xor al, byte [r8 + rdi]
xor al, sil
mov byte [r8 + rdi], al
inc r8
cmp r8, r10
jl 0x14005c2cf
mov ebp, r13d
jmp 0x14005c315
xor r12d, r12d
lea eax, [rbp + rbp*2 + 0x10]
mov rcx, r15
movsxd rdx, eax
call fcn.1400560cc
mov rbx, qword [r15]
mov word [rbx], r12w
add rbx, 2
mov word [rbx], r12w
cmp byte [rdi], r12b
je 0x14005c428
cmp r14b, r12b
jne 0x14005c359
mov eax, 0x23
mov word [rbx], ax
mov word [rbx + 2], ax
movzx eax, sil
mov word [rbx + 4], ax
add rbx, 6
movsxd r8, r13d
mov r9b, 8
mov word [rbx], r12w
movzx edx, byte [rdi]
add r8, rdi
lea r10, [0x140000000]
inc rdi
mov cl, r9b
cmp cl, 6
jge 0x14005c385
cmp cl, r12b
jle 0x14005c3e2
cmp rdi, r8
jne 0x14005c3e5
mov al, dl
and al, 0x3f
cmp r14b, r12b
je 0x14005c39b
movzx eax, al
mov al, byte [rax + r10 + 0xf1360]
jmp 0x14005c3c2
cmp al, r12b
jne 0x14005c3a4
mov al, 0x2b
jmp 0x14005c3c2
cmp al, 1
jne 0x14005c3ac
mov al, 0x2f
jmp 0x14005c3c2
cmp al, 0xc
jae 0x14005c3b4
add al, 0x2e
jmp 0x14005c3c2
cmp al, 0x26
jae 0x14005c3bc
add al, 0x35
jmp 0x14005c3c2
cmp al, 0x40
jae 0x14005c3c2
add al, 0x3b
movzx eax, al
shr edx, 6
mov word [rbx], ax
add rbx, 2
add cl, 0xfa
jns 0x14005c376
mov eax, 0x3d
mov word [rbx], ax
add rbx, 2
jmp 0x14005c376
cmp rdi, r8
jae 0x14005c418
movzx eax, byte [rdi]
inc rdi
shl eax, cl
add cl, r9b
or edx, eax
cmp rdi, r8
jae 0x14005c418
movzx eax, byte [rdi]
inc rdi
shl eax, cl
add cl, r9b
or edx, eax
cmp rdi, r8
jae 0x14005c418
movzx eax, byte [rdi]
inc rdi
shl eax, cl
or edx, eax
add cl, r9b
cmp cl, r12b
jg 0x14005c376
mov word [rbx], r12w
mov rbx, qword [r15]
lea rcx, [rsp + 0x50]
call fcn.14004ea6c
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14005d924
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
xor r8d, r8d
call fcn.14004fd5c
mov rcx, qword [rbx]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_SetEndOfFile]
Function at 0x14005e788
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
and qword [rax - 0x40], 0
and dword [rax - 0x38], 0
and qword [rax + 0x20], 0
mov dword [rax - 0x48], 0x80
mov rdi, rdx
mov rdx, rcx
mov rbp, r8
mov dword [rax - 0x50], 3
and qword [rax - 0x58], 0
lea rcx, [rax + 0x20]
mov r9d, 1
mov r8d, 0x80000000
call fcn.140003590
mov rbx, qword [rsp + 0x98]
test rbx, rbx
jne 0x14005e7f2
xor eax, eax
jmp 0x14005e8d5
and dword [rsp + 0x98], 0
lea r13, [rsp + 0x98]
test rdi, rdi
cmovne r13, rdi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r14d, r14d
test rbp, rbp
setne r14b
mov dword [r13], eax
test r14d, r14d
je 0x14005e85c
mov edx, eax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rbp], rax
test rax, rax
jne 0x14005e84e
cmp rbx, 0xffffffffffffffff
je 0x14005e7eb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005e7eb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
jmp 0x14005e894
mov esi, eax
mov rcx, qword [0x1401070f0]
lea r8, [rsi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x14005e886
lea ecx, [rax + 2]
call fcn.140055c10
cmp eax, 4
je 0x14005e85e
mov dword [rdi + 4], 0xaa55
mov qword [rdi], rsi
add rdi, 8
test rdi, rdi
je 0x14005e83d
mov r8d, dword [r13]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test r14d, r14d
je 0x14005e8c3
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp rbx, 0xffffffffffffffff
je 0x14005e8d2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14005f4e8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rsi, rcx
mov edi, 0x104
mov rdx, rdi
mov rcx, rbx
call fcn.1400560cc
mov r11, qword [rbx]
xor ebp, ebp
mov word [r11], bp
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, ebp
mov edi, eax
jle 0x14005f556
mov rcx, qword [rbx]
cmp word [rcx], bp
jne 0x14005f556
lea ecx, [rax + 2]
movsxd rdx, ecx
mov rcx, rbx
call fcn.1400560cc
mov rdx, qword [rbx]
lea r8d, [rdi + 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14005f6ac
Capabilities:
Get disk information
Get disk information via ioctl

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
xor edi, edi
mov esi, edx
mov eax, 3
cmp edx, edi
jge 0x14005f7b1
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x14005f6dd
mov eax, 0xffdf
and cx, ax
mov r8d, 0x3a
mov word [rsp + 0x40], cx
mov word [rsp + 0x50], cx
lea edx, [r8 + 0x22]
mov word [rsp + 0x42], r8w
mov word [rsp + 0x52], r8w
lea eax, [rdx - 0x2e]
mov word [rsp + 0x44], dx
mov word [rsp + 0x48], dx
mov word [rsp + 0x4a], dx
mov word [rsp + 0x4e], dx
mov qword [rsp + 0x30], rdi
lea r8d, [rax - 0x2b]
lea rcx, [rsp + 0x48]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x28], edi
mov word [rsp + 0x46], di
mov word [rsp + 0x4c], ax
mov word [rsp + 0x54], di
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14005f75b
mov eax, 1
jmp 0x14005f89b
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x2d1080
mov rcx, rbp
mov dword [rsp + 0x28], 0xc
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
lea rcx, [rsp + 0x40]
cmovne esi, dword [rsp + 0x64]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp esi, 0xffffffff
je 0x14005f751
xor r8d, r8d
mov edx, eax
mov ecx, esi
mov dword [rsp + 0x2a8], edi
call fcn.140055340
cmp eax, edi
je 0x14005f751
lea rcx, [rsp + 0x2a8]
xor r8d, r8d
mov edx, eax
mov dword [rsp + 0x2b8], edi
mov dword [rsp + 0x5c], edi
mov dword [rsp + 0x2b0], edi
mov dword [rsp + 0x2a8], eax
call qword [sym.imp.SETUPAPI.dll_CM_Get_Parent]
mov r8d, dword [rsp + 0x2a8]
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x2b8]
xor r9d, r9d
call qword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
mov ebx, dword [rsp + 0x2b8]
mov esi, 1
shr ebx, 0xe
mov ebp, 0x208
and bl, 1
mov ecx, dword [rsp + 0x2a8]
mov word [rsp + 0x70], di
mov dword [rsp + 0x20], edi
mov r9d, ebp
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x2b0]
cmp bl, dil
je 0x14005f85b
call qword [sym.imp.SETUPAPI.dll_CM_Request_Device_EjectW]
jmp 0x14005f861
call qword [sym.imp.SETUPAPI.dll_CM_Query_And_Remove_SubTreeW]
cmp eax, edi
jne 0x14005f86e
cmp dword [rsp + 0x2b0], edi
je 0x14005f88e
lea rcx, [0x140106ec0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc8
call fcn.14001bbe8
inc esi
cmp esi, 3
jg 0x14005f891
jmp 0x14005f82e
mov dil, 1
neg dil
sbb eax, eax
not eax
and eax, 2
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140061a34
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x80
mov ebp, r8d
lea r8, [rax - 0x28]
xor r12d, r12d
mov r9d, 0x2001b
mov dword [rax - 0x78], 4
mov qword [rax - 0x28], r12
call fcn.14004fb44
cmp eax, r12d
jne 0x140061c33
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0xb8], r12d
mov dword [rsp + 0x64], r12d
mov dword [rsp + 0x60], r12d
test bpl, 1
je 0x140061aa2
mov rcx, qword [rsp + 0x70]
lea rdx, [0x1400e94a4]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x64]
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [rsp + 0xb8]
cmp ecx, dword [rsp + 0x60]
mov edi, eax
cmovb ecx, dword [rsp + 0x60]
mov dword [rsp + 0xb8], ecx
lea edx, [rcx*4 + 8]
lea rcx, [rsp + 0x78]
call fcn.140056040
cmp edi, r12d
jne 0x140061c1c
mov rbx, qword [rsp + 0x78]
test bpl, 4
je 0x140061ba4
mov esi, dword [rsp + 0x64]
dec esi
cmp esi, r12d
jl 0x140061ba4
mov eax, dword [rsp + 0xb8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea eax, [rax*4 + 1]
lea r9, [rsp + 0x6c]
mov r8, rbx
mov dword [rsp + 0x6c], eax
mov word [rbx], r12w
mov rcx, qword [rsp + 0x70]
mov edx, esi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, r12d
je 0x140061b85
mov edi, eax
jmp 0x140061b9f
cmp word [rbx], r12w
je 0x140061b9f
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, r12d
cmovne edi, eax
sub esi, 1
jns 0x140061b3d
test bpl, 2
je 0x140061c1c
mov esi, dword [rsp + 0x68]
dec esi
cmp esi, r12d
jl 0x140061c1c
mov eax, dword [rsp + 0xb8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea eax, [rax*4 + 1]
lea r9, [rsp + 0x6c]
mov r8, rbx
mov dword [rsp + 0x6c], eax
mov word [rbx], r12w
mov rcx, qword [rsp + 0x70]
mov edx, esi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, r12d
je 0x140061bfd
mov edi, eax
jmp 0x140061c17
cmp word [rbx], r12w
je 0x140061c17
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
call qword [0x140107178]
cmp eax, r12d
cmovne edi, eax
sub esi, 1
jns 0x140061bb5
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x78]
call fcn.14004ea6c
mov eax, edi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140061c4c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
mov rdi, r8
lea rcx, [rsp + 0x78]
or r8, 0xffffffffffffffff
call fcn.1400601ac
lea rcx, [rsp + 0x30]
or r8, 0xffffffffffffffff
mov rbx, qword [rax]
mov rdx, rdi
call fcn.1400601ac
lea rdx, str._r_nRegSetDHCP__s__s__r_n
lea rcx, [0x140106ec0]
mov r9, qword [rax]
mov r8, rbx
call fcn.140015e80
lea rcx, [rsp + 0x78]
call fcn.14004ea6c
lea rcx, [rsp + 0x30]
call fcn.14004ea6c
mov rax, qword [str.0.0.0.0]
mov rcx, qword [rsi]
lea r11, [rsp + 0x38]
mov r9d, 4
lea rdx, str.EnableDHCP
mov qword [r11], rax
mov al, byte [0x1400f2a40]
mov dword [rsp + 0x28], r9d
mov byte [r11 + 8], al
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsi]
mov ebx, 9
lea rax, [rsp + 0x38]
lea rdx, str.IPAddress
lea r9d, [rbx - 2]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsi]
lea rax, [rsp + 0x38]
lea r9d, [rbx - 2]
lea rdx, str.SubnetMask
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsi]
lea rbx, [0x1400e9d50]
lea rdx, str.DefaultGateway
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test rdi, rdi
je 0x140061db4
cmp byte [rdi], 0x2d
cmovne rbx, rdi
cmp byte [rdi], 0
je 0x140061db4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rdx, str.NameServer
mov r9d, 1
movsxd rcx, eax
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, 1
add rsp, 0x50
pop rdi
ret
Function at 0x140064b00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov eax, 1
mov r14, rcx
mov r13, rdx
lea rcx, [rsp + 0x30]
xor esi, esi
mov edx, 0x100000
mov rdi, r9
mov r15d, r8d
mov r12d, eax
mov ebx, eax
mov word [rsp + 0x40], si
call fcn.140056040
cmp rdi, rsi
jne 0x140064b72
lea rdx, [rsp + 0x40]
mov ecx, 0x104
mov r12d, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdi, [rsp + 0x40]
mov ebx, eax
cmp eax, esi
je 0x140064cb6
mov eax, 0xe0000000
mov ebp, 0xa0000000
cmp r12d, esi
cmovne ebp, eax
xor r9d, r9d
lea rax, [rsp + 0x298]
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 3]
mov rcx, r13
mov edx, ebp
mov dword [rsp + 0x298], esi
mov dword [rsp + 0x20], esi
call qword [0x1401071c8]
mov rsi, rax
test rax, rax
jne 0x140064c04
cmp r12d, 1
jne 0x140064bf1
lea rax, [rsp + 0x298]
mov r12d, 2
btr ebp, 0x1e
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8d, [r12 + 1]
xor r9d, r9d
mov edx, ebp
mov rcx, r13
call qword [0x1401071c8]
mov rsi, rax
test rax, rax
je 0x140064bb4
xor r13d, r13d
cmp rsi, r13
jne 0x140064c07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, r13d
jmp 0x140064c07
xor r13d, r13d
cmp ebx, r13d
je 0x140064ca8
mov rdx, rdi
mov rcx, rsi
call qword [0x1401071d0]
mov ebx, eax
cmp eax, r13d
jne 0x140064c2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 1
mov edx, r15d
mov rcx, rsi
call qword [0x1401071d8]
mov rdi, rax
cmp rax, r13
jne 0x140064c4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, r13d
cmp ebx, r13d
je 0x140064c9a
mov eax, 0x200
mov ebp, r13d
cmp r12d, r13d
cmove ebp, eax
mov rdx, r14
mov rcx, rdi
mov r8d, ebp
call qword [0x1401071e0]
mov ebx, eax
cmp eax, r13d
jne 0x140064c9a
cmp r12d, 2
jne 0x140064c8f
bts ebp, 9
mov rdx, r14
mov rcx, rdi
mov r8d, ebp
call qword [0x1401071e0]
mov ebx, eax
cmp ebx, r13d
jne 0x140064c9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rdi, r13
je 0x140064ca8
mov rcx, rdi
call qword [0x1401071e8]
cmp rsi, r13
je 0x140064cb6
mov rcx, rsi
call qword [0x1401071e8]
lea rcx, [rsp + 0x30]
call fcn.14004ea6c
lea r11, [rsp + 0x250]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14006527c
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov edi, r9d
mov r14, r8
mov r13, rdx
mov rbp, rcx
cmp r8, r15
jne 0x1400652cf
movzx eax, word [rdx]
lea r14, [r11 + 0x18]
mov word [rsp + 0x70], ax
movzx eax, word [rdx + 2]
mov word [rsp + 0x72], ax
lea eax, [r15 + 0x5c]
mov word [rsp + 0x74], ax
mov word [r11 + 0x1e], r15w
lea rcx, [rsp + 0x20]
mov edx, 0x209
call fcn.140056040
mov rbx, qword [rsp + 0x20]
lea rcx, str.Device_
mov r8d, 8
mov rdx, rbp
mov word [rbx], r15w
call fcn.14004fdfc
cmp al, r15b
jne 0x14006533d
lea rcx, str.DosDevices_
mov r8d, 0xc
mov rdx, rbp
call fcn.14004fdfc
cmp al, r15b
jne 0x14006533d
cmp word [rbp], r15w
je 0x140065340
cmp word [rbp + 2], r15w
je 0x140065340
lea rcx, [rbp + 4]
mov edx, 0x3a
call qword [sym.imp.SHLWAPI.dll_StrChrW]
cmp rax, r15
je 0x140065340
or edi, 1
lea rcx, [0x1400f2da8]
mov r8d, 0xb
mov rdx, rbp
call fcn.14004fdfc
mov sil, byte [rsp + 0x80]
cmp al, r15b
je 0x14006536a
and edi, 0xfffffffe
cmp sil, r15b
jne 0x140065397
cmp sil, r15b
je 0x140065379
movzx ecx, word [r13]
call fcn.1400529e8
mov r8, rbp
mov rdx, r13
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
mov r12d, eax
cmp eax, r15d
jne 0x1400653ab
cmp sil, r15b
jl 0x1400653f9
mov sil, r15b
mov r8d, 0x208
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x1400653d8
cmp sil, r15b
jle 0x1400653f9
mov r8d, 0x208
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
cmp eax, r15d
je 0x1400653f9
mov ecx, edi
mov r8, rbp
mov rdx, r13
or ecx, 0xe
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
cmp sil, r15b
mov r12d, eax
jl 0x1400653f9
cmp eax, r15d
jne 0x1400653f9
mov sil, 0xff
jmp 0x14006536a
lea rcx, [rsp + 0x20]
call fcn.14004ea6c
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
mov eax, r12d
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140066304
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rcx
mov r15, rdx
xor ebp, ebp
mov dword [rdx], ebp
lea rcx, [rax + 0x20]
mov edx, 0x2008
mov r13, r8
call fcn.140055ddc
mov rbx, qword [rsp + 0x88]
lea rdi, [rbx + 0x800]
mov esi, 0x800
xor edx, edx
mov rcx, rdi
mov r8, rsi
mov dword [rsp + 0x78], ebp
call fcn.1400cc8d0
lea r9, [rsp + 0x78]
mov r8d, esi
mov rdx, rbx
mov rcx, r14
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebp
je 0x140066536
mov eax, dword [rbx + 0x1b4]
movzx ecx, word [rbx + 0x1fe]
mov r12b, bpl
cmp eax, 0x46424246
je 0x140066450
cmp eax, 0x534c5055
je 0x140066450
cmp eax, 0x5352424d
jne 0x140066536
mov esi, 0xaa55
cmp ecx, esi
jne 0x140066536
cmp dword [rbx + 0x1c], ebp
jne 0x140066536
mov ebp, 0x200
xor edx, edx
mov rcx, rdi
mov r8, rbp
call fcn.1400cc8d0
xor r8d, r8d
mov edx, 0x4a00
mov rcx, r14
call fcn.14004fd5c
lea r9, [rsp + 0x78]
xor ebx, ebx
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
je 0x140066536
cmp dword [rdi + 0x1b4], 0x5352424d
movzx eax, word [rdi + 0x1fe]
jne 0x140066536
cmp eax, esi
jne 0x140066536
cmp dword [rdi + 0x1c], 0x25
jne 0x140066536
movzx esi, byte [rdi + 0x67]
cmp bx, si
jne 0x14006643c
lea esi, [rbx + 1]
mov ebx, dword [rdi + 0x5c]
movzx eax, si
add ebx, eax
mov eax, dword [rdi + 0x60]
shl rax, 0x20
add rbx, rax
jmp 0x1400664b6
mov ebp, 0x200
mov esi, 1
xor edx, edx
mov r8, rbp
mov rcx, rdi
mov r12b, sil
call fcn.1400cc8d0
xor r8d, r8d
mov edx, 0x8600
mov rcx, r14
call fcn.14004fd5c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140066536
mov al, byte [rdi + 0x1f8]
and al, 0xc0
cmp al, 0x40
jne 0x140066536
mov rbx, qword [rdi + 0x1f0]
add rbx, rsi
mov r8, rbp
xor edx, edx
mov rcx, rdi
call fcn.1400cc8d0
mov rdx, rbx
shl rdx, 9
jmp 0x140066509
lea rdx, [0x1400f2ef8]
lea rcx, [rdi + 3]
mov r8d, 0xa
call fcn.14004ea9c
cmp eax, r9d
je 0x14006655c
cmp rbx, 0x41
je 0x140066536
cmp r12b, r9b
jne 0x140066536
mov r8, rbp
xor edx, edx
mov rcx, rdi
mov ebx, 0x41
call fcn.1400cc8d0
mov edx, 0x8200
xor r8d, r8d
mov rcx, r14
call fcn.14004fd5c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r9d, r9d
cmp eax, r9d
jne 0x1400664cc
lea rcx, [rsp + 0x88]
call fcn.14004ea6c
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [rdi + 0x2c]
mov ebx, dword [rdi + 0x68]
mov eax, dword [rdi + 0x28]
and ecx, 0xffffffc0
shl rbx, 0x20
shl ecx, 9
or rbx, rax
mov dword [r15], ecx
cmp r13, r9
je 0x140066586
mov rcx, qword [rdi + 0x74]
shl rcx, 9
mov qword [r13], rcx
lea rcx, [rsp + 0x88]
call fcn.14004ea6c
shl rbx, 9
mov rax, rbx
jmp 0x140066547
Function at 0x14006659c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r14d, dx
mov edx, 0x134
mov ebp, r9d
mov r15, rcx
call fcn.1400560cc
lea rcx, [rsp + 0x20]
mov edx, 0xca
call fcn.140056040
mov r12d, dword [rsp + 0x90]
movzx ebx, byte [rsp + 0x90]
and r12d, 0x100
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov rdi, qword [r15]
mov ecx, ebx
xor r8d, r8d
mov esi, eax
neg ecx
mov r13b, r8b
sbb al, al
and al, 0xfe
inc al
neg ebx
sbb ebx, ebx
mov byte [rsp + 0x90], al
and ebx, 0x19
cmp ebp, r8d
je 0x14006662c
cmp ebp, 1
not esi
jle 0x14006662c
and esi, 0xfffffffc
cmp ebx, 0x1a
movsxd r12, r12d
jge 0x1400666af
mov r15d, dword [rsp + 0x80]
cmp ebx, r8d
jl 0x1400666aa
mov ecx, ebx
mov edx, 1
movsx eax, al
shl edx, cl
lea ebp, [rbx + 0x41]
add ebx, eax
test esi, edx
je 0x14006669e
cmp r12, r8
je 0x14006666c
movsx ecx, bpl
call fcn.1400cbdbc
xor r8d, r8d
cmp eax, r8d
je 0x14006669e
cmp r13b, r8b
je 0x14006667f
cmp r14w, r8w
je 0x14006667f
mov word [rdi], r14w
add rdi, 2
movsx eax, bpl
mov r13b, 1
mov word [rdi], ax
add rdi, 2
cmp r15d, r8d
je 0x14006669e
mov eax, 0x3a
mov word [rdi], ax
add rdi, 2
cmp ebx, 0x1a
mov al, byte [rsp + 0x90]
jl 0x14006663c
mov r15, qword [rsp + 0x70]
mov word [rdi], r8w
mov rbx, qword [r15]
lea rcx, [rsp + 0x20]
call fcn.14004ea6c
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14006687c
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea rcx, [rsp + 0x30]
lea r8d, [rax + rax*2]
movsxd rdx, r8d
call fcn.140055ddc
mov rdx, qword [rsp + 0x30]
xor ebx, ebx
lea r8, [rdx + 1]
mov byte [rdx], 0x20
mov r9d, ebx
mov byte [r8], bl
mov cl, bl
jmp 0x1400668da
mov al, byte [rdi]
cmp al, 0x3d
jne 0x140066913
cmp cl, bl
jle 0x1400668d7
mov byte [r8], r9b
mov cl, bl
inc r8
mov r9d, ebx
inc rdi
cmp byte [rdi], bl
jne 0x1400668c2
mov byte [r8], bl
mov r9d, 0xfde9
mov rcx, rsi
or r8, 0xffffffffffffffff
call fcn.140056188
mov rbx, qword [rsi]
lea rcx, [rsp + 0x30]
call fcn.14004ea6c
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp al, 0x41
jb 0x14006691f
cmp al, 0x5a
ja 0x14006691f
sub al, 0x41
jmp 0x140066945
cmp al, 0x61
jb 0x14006692b
cmp al, 0x7a
ja 0x14006692b
sub al, 0x47
jmp 0x140066945
cmp al, 0x30
jb 0x140066937
cmp al, 0x39
ja 0x140066937
add al, 4
jmp 0x140066945
cmp al, 0x2b
jne 0x14006693f
mov al, 0x3e
jmp 0x140066945
cmp al, 0x2f
jne 0x140066974
mov al, 0x3f
movzx eax, al
shl eax, cl
or r9d, eax
add cl, 6
cmp cl, 8
jge 0x140066965
cmp cl, bl
jle 0x1400668d7
cmp byte [rdi], bl
jne 0x1400668d7
mov byte [r8], r9b
inc r8
shr r9d, 8
add cl, 0xf8
jmp 0x140066950
mov rax, qword [rsi]
mov word [rax], bx
jmp 0x1400668f6