joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436e00
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x30], r14
xor r12d, r12d
test rcx, rcx
mov qword [rsp + 0x28], r15
mov r15d, edx
mov rsi, rcx
je 0x43707a
lea edx, [r12 + 0x3d]
call fcn.004387e0
test rax, rax
mov r14, rax
je 0x43707a
cmp rsi, rax
je 0x43707a
cmp byte [rax + 1], r12b
mov rbx, qword [0x00469098]
mov qword [rsp + 0x38], r13
mov r13d, r12d
sete r13b
cmp rbx, qword [0x004690a0]
jne 0x436e80
mov rcx, rbx
call fcn.00436d50
mov rbx, rax
mov qword [0x00469098], rax
test rbx, rbx
jne 0x436efd
test r15d, r15d
je 0x436ea6
cmp qword [0x004690a8], r12
je 0x436ea6
call fcn.00431c40
test eax, eax
je 0x436ef6
mov eax, 0xffffffff
jmp 0x436faf
test r13d, r13d
je 0x436eb2
xor eax, eax
jmp 0x436faf
mov ecx, 8
call fcn.00431220
test rax, rax
mov qword [0x00469098], rax
je 0x436e9c
mov qword [rax], r12
cmp qword [0x004690a8], r12
jne 0x436ef6
mov ecx, 8
call fcn.00431220
test rax, rax
mov qword [0x004690a8], rax
je 0x436e9c
mov qword [rax], r12
mov rbx, qword [0x00469098]
jmp 0x436efd
mov rbx, qword [0x00469098]
mov edx, r14d
mov rcx, rsi
mov qword [rsp + 0x58], rbp
sub edx, esi
mov qword [rsp + 0x68], rdi
call fcn.00436cb0
test eax, eax
movsxd rdi, eax
js 0x436f78
cmp qword [rbx], r12
je 0x436f78
mov rcx, qword [rbx + rdi*8]
call fcn.00426530
test r13d, r13d
je 0x436f72
cmp qword [rbx + rdi*8], r12
je 0x436f55
lea rdx, [rbx + rdi*8]
mov rcx, rdx
nop
nop
mov rax, qword [rdx + 8]
add rcx, 8
inc edi
mov qword [rdx], rax
cmp qword [rcx], r12
mov rdx, rcx
jne 0x436f40
movsxd rdx, edi
mov rcx, rbx
shl rdx, 3
call fcn.00431320
test rax, rax
je 0x436fe5
mov qword [0x00469098], rax
jmp 0x436fe5
mov qword [rbx + rdi*8], rsi
jmp 0x436fe5
test r13d, r13d
jne 0x43706b
test eax, eax
jns 0x436f87
neg edi
lea eax, [rdi + 2]
mov rcx, rbx
movsxd rdx, eax
shl rdx, 3
call fcn.00431320
test rax, rax
mov r11, rax
jne 0x436fd2
lea eax, [r11 - 1]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov r13, qword [rsp + 0x38]
mov r15, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
movsxd rax, edi
mov qword [r11 + rax*8], rsi
mov qword [r11 + rax*8 + 8], r12
mov qword [0x00469098], r11
test r15d, r15d
je 0x437056
xor eax, eax
mov rbx, 0xffffffffffffffff
mov rdi, rsi
mov rcx, rbx
repne scasb al, byte [rdi]
not rcx
inc rcx
call fcn.00431220
test rax, rax
mov rdi, rax
je 0x437056
mov rdx, rsi
sub rax, rsi
nop
nop
nop
movzx ecx, byte [rdx]
inc rdx
test cl, cl
mov byte [rax + rdx - 1], cl
jne 0x437020
lea rdx, [rax + r14]
mov rcx, rdi
mov byte [rdx], r12b
inc rdx
test r13d, r13d
cmovne rdx, r12
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov rcx, rdi
test eax, eax
cmove r12d, ebx
call fcn.00426530
test r13d, r13d
je 0x437063
mov rcx, rsi
call fcn.00426530
mov eax, r12d
jmp 0x436fa5
mov rcx, rsi
call fcn.00426530
xor eax, eax
jmp 0x436fa5
mov eax, 0xffffffff
jmp 0x436fb4
Function at 0x4388b0
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x28], r15
mov rax, qword [0x00467048]
mov qword [rbp + 0x18], rax
mov edi, r9d
mov r14, r8
mov r12d, edx
mov r13d, ecx
mov r10d, dword [0x00469948]
test r10d, r10d
jne 0x438953
xor r9d, r9d
xor r8d, r8d
lea edx, [r10 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x438933
mov r10d, 1
mov dword [0x00469948], r10d
jmp 0x438953
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r10d, dword [0x00469948]
mov ecx, 2
cmp eax, 0x78
cmove r10d, ecx
mov dword [0x00469948], r10d
cmp r10d, 1
jne 0x438970
mov r9d, edi
mov r8, r14
mov edx, r12d
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x438a8f
cmp r10d, 2
je 0x438982
test r10d, r10d
je 0x438982
xor eax, eax
jmp 0x438a8f
xor esi, esi
xor r15d, r15d
mov eax, dword [rbp + 0x90]
test eax, eax
cmove eax, dword [0x004697f8]
mov dword [rbp + 0x90], eax
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
movsxd rcx, eax
mov dword [rbp], ecx
test eax, eax
je 0x438a8f
lea rax, [rcx + 0xf]
and rax, 0xfffffffffffffff0
call fcn.0044e660
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x10], rbx
jmp 0x4389ff
test rbx, rbx
jne 0x438a1a
movsxd rcx, ecx
call fcn.00431220
mov rbx, rax
test rax, rax
je 0x438a8f
mov r15d, 1
mov r9d, dword [rbp]
mov r8, rbx
mov edx, r12d
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x438a80
test edi, edi
jne 0x438a5c
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], 0
lea r9d, [rdi - 1]
mov r8, rbx
lea edx, [rdi + 1]
mov ecx, dword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
jmp 0x438a80
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
mov r9d, 0xffffffff
mov r8, rbx
lea edx, [r9 + 2]
mov ecx, dword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test r15d, r15d
je 0x438a8d
mov rcx, rbx
call fcn.00426530
mov eax, esi
mov rcx, qword [rbp + 0x18]
call fcn.0044e630
mov rbx, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x50]
mov rdi, qword [rbp + 0x48]
mov r12, qword [rbp + 0x40]
mov r13, qword [rbp + 0x38]
mov r14, qword [rbp + 0x30]
mov r15, qword [rbp + 0x28]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x438ac0
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x28], r15
mov rax, qword [0x00467048]
mov qword [rbp + 0x18], rax
mov esi, r9d
mov r15, r8
mov r13d, edx
mov r14d, ecx
mov r10d, dword [0x0046994c]
test r10d, r10d
jne 0x438b63
xor r9d, r9d
xor r8d, r8d
lea edx, [r10 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x438b43
mov r10d, 1
mov dword [0x0046994c], r10d
jmp 0x438b63
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r10d, dword [0x0046994c]
mov ecx, 2
cmp eax, 0x78
cmove r10d, ecx
mov dword [0x0046994c], r10d
cmp r10d, 2
je 0x438cbd
test r10d, r10d
je 0x438cbd
cmp r10d, 1
jne 0x438cb9
xor edi, edi
mov r12d, edi
mov eax, edi
mov dword [rbp], edi
mov eax, dword [rbp + 0x90]
test eax, eax
cmove eax, dword [0x004697f8]
mov dword [rbp + 0x90], eax
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movsxd rcx, eax
mov dword [rbp + 4], ecx
test eax, eax
je 0x438ccf
mov rax, rcx
add rax, rax
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.0044e660
sub rsp, rax
lea rbx, [rsp + 0x40]
mov qword [rbp + 0x10], rbx
jmp 0x438c0e
test rbx, rbx
jne 0x438c31
movsxd rcx, ecx
add rcx, rcx
call fcn.00431220
mov rbx, rax
test rax, rax
je 0x438ccf
mov dword [rbp], 1
mov r9d, dword [rbp + 4]
mov r8, rbx
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x438ca6
test esi, esi
jne 0x438c79
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9d, [rsi - 1]
mov r8, rbx
xor edx, edx
mov ecx, dword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r12d, eax
jmp 0x438ca6
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r15
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
mov ecx, dword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r12d, eax
cmp dword [rbp], 0
je 0x438cb4
mov rcx, rbx
call fcn.00426530
mov eax, r12d
jmp 0x438ccf
xor eax, eax
jmp 0x438ccf
mov r9d, esi
mov r8, r15
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov rcx, qword [rbp + 0x18]
call fcn.0044e630
mov rbx, qword [rbp + 0x58]
mov rsi, qword [rbp + 0x50]
mov rdi, qword [rbp + 0x48]
mov r12, qword [rbp + 0x40]
mov r13, qword [rbp + 0x38]
mov r14, qword [rbp + 0x30]
mov r15, qword [rbp + 0x28]
lea rsp, [rbp + 0x60]
pop rbp
ret
Function at 0x439720
Capabilities:
Hash data with md5

Disassembly:
lea rax, [0x00450d98]
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x40], rax
mov dword [rcx + 0x4c], eax
mov dword [rcx + 0x48], eax
mov dword [rcx + 0x50], 0x67452301
mov dword [rcx + 0x54], 0xefcdab89
mov rax, rcx
mov dword [rcx + 0x58], 0x98badcfe
mov dword [rcx + 0x5c], 0x10325476
ret

Function at 0x43a3f0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rax, qword [rcx + 0x1c8]
mov qword [r11 - 8], r12
mov r12, rcx
test byte [rax + 0x10], 1
je 0x43a51d
mov qword [r11 - 0x10], r13
xor r13d, r13d
cmp dword [rcx + 0xa4], r13d
jbe 0x43a518
mov qword [r11 - 0x18], r14
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
nop
nop
nop
mov rax, qword [r12 + 0xb0]
mov edx, dword [r12 + 0xc0]
lea rcx, [r12 + 0xb0]
call qword [rax + 8]
mov esi, dword [r12 + 0x2f8]
mov edi, dword [r12 + 0x2f0]
mov ebp, r13d
and esi, 0xfffd
add rbp, qword [r12 + 0xb8]
or esi, 2
movzx ebx, byte [rbp]
call fcn.0043ef50
xor bl, dil
shr edi, 8
movzx ecx, bl
mov ebx, dword [r12 + 0x2f8]
mov eax, dword [rax + rcx*4]
xor eax, edi
movzx edi, al
mov dword [r12 + 0x2f0], eax
add edi, dword [r12 + 0x2f4]
imul edi, edi, 0x8088405
inc edi
mov dword [r12 + 0x2f4], edi
shr edi, 0x18
call fcn.0043ef50
xor dil, bl
shr ebx, 8
inc r13d
movzx ecx, dil
mov eax, dword [rax + rcx*4]
xor eax, ebx
mov dword [r12 + 0x2f8], eax
mov eax, esi
xor eax, 1
imul eax, esi
sar eax, 8
xor byte [rbp], al
cmp r13d, dword [r12 + 0xa4]
jb 0x43a440
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x43a5a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 0x1c8]
mov qword [rsp + 0x50], rsi
mov rsi, rcx
test byte [rax + 0x10], 1
je 0x43a6a2
test edx, edx
je 0x43a6a2
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x40], rbx
xor ebp, ebp
mov r13d, edx
mov qword [rsp + 0x58], rdi
mov rax, qword [rsi + 0xb0]
mov edx, dword [rsi + 0xc0]
lea rcx, [rsi + 0xb0]
call qword [rax + 8]
mov ecx, dword [rsi + 0x2f8]
mov r11, qword [rsi + 0xb8]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
sar eax, 8
xor byte [r11 + rbp], al
movzx ebx, byte [r11 + rbp]
mov edi, dword [rsi + 0x2f0]
call fcn.0043ef50
xor bl, dil
shr edi, 8
movzx ecx, bl
mov ebx, dword [rsi + 0x2f8]
mov eax, dword [rax + rcx*4]
xor eax, edi
movzx edi, al
mov dword [rsi + 0x2f0], eax
add edi, dword [rsi + 0x2f4]
imul edi, edi, 0x8088405
inc edi
mov dword [rsi + 0x2f4], edi
shr edi, 0x18
call fcn.0043ef50
xor dil, bl
shr ebx, 8
inc rbp
movzx ecx, dil
mov eax, dword [rax + rcx*4]
xor eax, ebx
dec r13
mov dword [rsi + 0x2f8], eax
jne 0x43a5e3
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x38
ret

Function at 0x43a860
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbp
xor ebp, ebp
mov qword [rsp + 0x40], rsi
cmp dword [rcx + 0x2e0], ebp
mov rsi, rcx
mov dword [rcx + 0x2f0], 0x12345678
mov dword [rcx + 0x2f4], 0x23456789
mov dword [rcx + 0x2f8], 0x34567890
jbe 0x43a949
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rdi
nop
mov rax, qword [rsi + 0x2d0]
mov edx, dword [rsi + 0x2e0]
lea rcx, [rsi + 0x2d0]
call qword [rax + 8]
mov rax, qword [rsi + 0x2d8]
mov edi, dword [rsi + 0x2f0]
movzx ebx, byte [rbp + rax]
call fcn.0043ef50
xor bl, dil
shr edi, 8
movzx ecx, bl
mov ebx, dword [rsi + 0x2f8]
mov eax, dword [rax + rcx*4]
xor eax, edi
movzx edi, al
mov dword [rsi + 0x2f0], eax
add edi, dword [rsi + 0x2f4]
imul edi, edi, 0x8088405
inc edi
mov dword [rsi + 0x2f4], edi
shr edi, 0x18
call fcn.0043ef50
xor dil, bl
shr ebx, 8
inc ebp
movzx ecx, dil
mov eax, dword [rax + rcx*4]
xor eax, ebx
mov dword [rsi + 0x2f8], eax
cmp ebp, dword [rsi + 0x2e0]
jb 0x43a8b0
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
Function at 0x43a960
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x50], r12
mov rbp, rcx
xor r8d, r8d
lea edx, [r8 + 0xc]
lea rcx, [rsp + 0x28]
call fcn.0043e7a0
nop
mov edx, dword [rsp + 0x38]
lea rcx, [rsp + 0x28]
mov rax, qword [rsp + 0x28]
call qword [rax + 8]
lea rcx, [rbp + 0xd0]
xor r9d, r9d
lea r8d, [r9 + 0xc]
mov rdx, qword [rsp + 0x30]
call fcn.00441ff0
xor r12d, r12d
nop
nop
nop
mov edx, dword [rsp + 0x38]
lea rcx, [rsp + 0x28]
mov rax, qword [rsp + 0x28]
call qword [rax + 8]
mov r11d, dword [rbp + 0x2f8]
and r11d, 0xfffd
or r11d, 2
mov esi, r11d
xor esi, 1
imul esi, r11d
sar esi, 8
mov rax, qword [rsp + 0x30]
xor sil, byte [r12 + rax]
mov ebx, dword [rbp + 0x2f0]
call fcn.0043ef50
movzx edx, sil
xor dl, bl
movzx ecx, dl
shr ebx, 8
mov eax, dword [rax + rcx*4]
xor eax, ebx
mov dword [rbp + 0x2f0], eax
movzx edi, al
add edi, dword [rbp + 0x2f4]
imul edi, edi, 0x8088405
inc edi
mov dword [rbp + 0x2f4], edi
shr edi, 0x18
mov ebx, dword [rbp + 0x2f8]
call fcn.0043ef50
xor dil, bl
movzx ecx, dil
shr ebx, 8
mov eax, dword [rax + rcx*4]
xor eax, ebx
mov dword [rbp + 0x2f8], eax
inc r12
cmp r12, 0xc
jl 0x43a9d0
mov rcx, qword [rbp + 0x1c8]
movzx eax, byte [rcx + 0x10]
shr al, 3
test al, 1
je 0x43aa8d
cmp byte [rcx + 0x15], sil
sete bl
jmp 0x43aa94
cmp byte [rcx + 0x1b], sil
sete bl
lea rcx, [rsp + 0x28]
call fcn.0043e630
mov al, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x50]
add rsp, 0x58
ret
Function at 0x443bd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
sub rsp, 0x108
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov rax, qword [0x00467048]
mov qword [rsp + 0xd0], rax
movzx ebx, dl
mov rsi, rcx
add rcx, 0x90
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 8]
mov byte [rsi + 0xc0], bl
mov dl, 1
movzx ecx, bl
call fcn.0043ef30
mov qword [rsi + 0xb8], rax
mov ebp, dword [rsi + 0x78]
cmp byte [rsi + 0x88], 0
jne 0x443d6d
xor edi, edi
test ebp, ebp
jle 0x443d9e
mov r12, rdi
lea r13, [0x00453c60]
nop
nop
mov rax, qword [rsi + 0x70]
mov rbx, qword [r12 + rax]
mov qword [rsp + 0x30], r13
mov eax, dword [rbx + 8]
mov dword [rsp + 0x38], eax
movzx eax, word [rbx + 0xc]
mov word [rsp + 0x3c], ax
movzx eax, word [rbx + 0xe]
mov word [rsp + 0x3e], ax
movzx eax, word [rbx + 0x10]
mov word [rsp + 0x40], ax
movzx eax, word [rbx + 0x12]
mov word [rsp + 0x42], ax
movzx eax, word [rbx + 0x14]
mov word [rsp + 0x44], ax
movzx eax, word [rbx + 0x16]
mov word [rsp + 0x46], ax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x48], eax
mov eax, dword [rbx + 0x1c]
mov dword [rsp + 0x4c], eax
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x50], eax
movzx eax, word [rbx + 0x24]
mov word [rsp + 0x54], ax
movzx eax, word [rbx + 0x26]
mov word [rsp + 0x56], ax
mov eax, dword [rbx + 0x28]
mov dword [rsp + 0x58], eax
movzx eax, word [rbx + 0x2c]
mov word [rsp + 0x5c], ax
movzx eax, word [rbx + 0x2e]
mov word [rsp + 0x5e], ax
mov eax, dword [rbx + 0x30]
mov dword [rsp + 0x60], eax
lea rdx, [rbx + 0x38]
lea rcx, [rsp + 0x68]
call fcn.0043e8b0
nop
lea rdx, [rbx + 0x58]
lea rcx, [rsp + 0x88]
call fcn.0043e8b0
nop
lea rdx, [rbx + 0x78]
lea rcx, [rsp + 0xa8]
call fcn.0043e8b0
nop
cmp byte [rsi + 0x88], 0
jne 0x443d41
movzx r8d, byte [rsi + 0x89]
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.0043edb0
movzx r8d, di
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.00443080
nop
lea rcx, [rsp + 0x30]
call fcn.0043d0a0
inc edi
add r12, 8
cmp edi, ebp
jl 0x443c60
jmp 0x443d9e
xor edi, edi
test ebp, ebp
jle 0x443d9e
mov rbx, rdi
nop
nop
nop
mov rdx, qword [rsi + 0x70]
movzx r8d, di
mov rdx, qword [rbx + rdx]
mov rcx, rsi
call fcn.00443080
inc edi
add rbx, 8
cmp edi, ebp
jl 0x443d80
mov rcx, qword [rsp + 0xd0]
call fcn.0044e630
mov rbx, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x128]
mov rsi, qword [rsp + 0x100]
mov rdi, qword [rsp + 0xf8]
mov r12, qword [rsp + 0xf0]
mov r13, qword [rsp + 0xe8]
add rsp, 0x108
ret

Function at 0x444a20
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x444c50
Capabilities:
Get disk size

Disassembly:
push rbx
sub rsp, 0x110
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.0043af10
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.00444b40
nop
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 8]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x138]
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x444dcf
mov edx, dword [rsp + 0x40]
test edx, edx
jle 0x444d00
mov r9, qword [rsp + 0x38]
movsxd rax, edx
movzx r8d, byte [rax + r9 - 1]
mov al, 0x5c
lea rcx, [0x00450ba8]
cmp al, r8b
je 0x444cf6
inc rcx
movzx eax, byte [rcx]
test al, al
je 0x444d00
jmp 0x444ce5
dec edx
mov dword [rsp + 0x40], edx
test edx, edx
jg 0x444cd3
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 8]
movsxd rbx, dword [rsp + 0x40]
lea edx, [rbx + 1]
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 8]
cmp ebx, ebx
jge 0x444d3e
mov rdx, qword [rsp + 0x38]
add rdx, rbx
lea rcx, [rdx + 1]
mov eax, ebx
sub eax, ebx
movsxd r8, eax
call fcn.004266e0
mov rax, rbx
add rax, qword [rsp + 0x38]
mov byte [rax], 0x5c
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 8]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x138]
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x128]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x444dcf
lea rax, [0x0044f640]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
xor eax, eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x48], eax
test rcx, rcx
je 0x444db5
call fcn.00426530
lea rax, [0x0044f620]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
call fcn.00445230
xor eax, eax
jmp 0x444e28
mov ebx, dword [rsp + 0x128]
imul ebx, dword [rsp + 0x130]
imul ebx, dword [rsp + 0x138]
lea rax, [0x0044f640]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
xor eax, eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x48], eax
test rcx, rcx
je 0x444e10
call fcn.00426530
lea rax, [0x0044f620]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x60]
call fcn.00445230
mov eax, ebx
add rsp, 0x110
pop rbx
ret

Function at 0x444e80
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbp
mov rbp, rcx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x40], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
mov esi, eax
jne 0x444eb0
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
mov rcx, rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rdi
call fcn.00427c70
mov ecx, esi
mov bl, 1
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x444eda
xor bl, bl
jmp 0x444ee5
mov rdx, rdi
mov rcx, rbp
call fcn.00412810
mov rcx, rdi
call fcn.00426470
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x444f10
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x100
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.0043af10
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.00444b40
mov rbx, rax
mov r8, qword [rax]
mov edx, dword [rax + 0x10]
mov rcx, rax
call qword [r8 + 8]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
sete bl
lea rax, [0x0044f640]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x28]
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x38], eax
test rcx, rcx
je 0x444f89
call fcn.00426530
lea rax, [0x0044f620]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x50]
call fcn.00445230
mov al, bl
add rsp, 0x100
pop rbx
ret

Function at 0x445180
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rdi, rcx
movzx ebx, dl
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4451bf
test bl, bl
je 0x4451ae
lea ecx, [rax + 0x71]
mov rdx, rdi
call fcn.00439cd0
int3
xor al, al
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x28
ret

Function at 0x4451d0
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rdi, rcx
movzx ebx, r8b
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x445210
test bl, bl
je 0x4451ff
lea ecx, [rax + 0x72]
mov rdx, rdi
call fcn.00439cd0
int3
xor al, al
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x28
ret