joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004790
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x4a0
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rdi, rcx
call fcn.1400064e0
test eax, eax
je 0x1400047be
xor eax, eax
jmp 0x140004943
mov qword [rsp + 0x4b8], rbx
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x208
xor ebx, ebx
call fcn.140043ce0
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
test eax, eax
je 0x140004939
xor edx, edx
mov qword [rsp + 0x4c0], rbp
mov r8d, 0x208
lea rcx, [rsp + 0x270]
call fcn.140043ce0
lea r9, [rsp + 0x60]
mov edx, 0x104
lea r8, str._sShell32.dll
lea rcx, [rsp + 0x270]
call fcn.1400032c0
lea rcx, [rsp + 0x270]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
mov rbp, rax
test rax, rax
je 0x140004931
lea rdx, str.SHFileOperationW
mov qword [rsp + 0x490], r14
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140004920
xorps xmm0, xmm0
mov qword [rsp + 0x498], rsi
mov eax, 0x414
mov qword [rsp + 0x2c], rbx
mov ecx, 0x208
mov word [rsp + 0x40], ax
movdqu xmmword [rsp + 0x42], xmm0
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x52], ebx
mov word [rsp + 0x56], bx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x38], rbx
call fcn.14001f888
mov rsi, rax
test rax, rax
je 0x140004918
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140043ce0
mov r8, rdi
mov edx, 0x104
mov rcx, rsi
call fcn.140049578
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rdi + rcx*2], bx
jne 0x1400048e3
mov eax, ecx
mov word [rsi + rax*2], bx
lea eax, [rcx + 1]
mov word [rsi + rax*2], bx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rsi
call r14
test eax, eax
mov ecx, 1
cmove ebx, ecx
mov rcx, rsi
call fcn.14001f854
mov rsi, qword [rsp + 0x498]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov r14, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x4c0]
mov eax, ebx
mov rbx, qword [rsp + 0x4b8]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x4a0
pop rdi
ret

Function at 0x1400053c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x48], rax
test edx, edx
mov eax, 0x80
mov edi, 2
mov edx, 0x40000000
cmovne eax, edi
xor r9d, r9d
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov dword [rsp + 0x20], edi
call fcn.140006030
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000543d
lea r9, [rsp + 0x44]
mov word [rsp + 0x40], 0xfeff
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea eax, [rdi - 1]
jmp 0x14000543f
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001f4e0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140005460
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
mov word [rbp + 0x47], 0x100
lea rax, [rbp - 0x11]
mov qword [rbp - 0x11], rbx
mov qword [rsp + 0x50], rax
mov rsi, rcx
mov dword [rsp + 0x48], ebx
lea rcx, [rbp + 0x43]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov dword [rsp + 0x30], ebx
mov dl, 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov dword [rbp + 0x43], ebx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AllocateAndInitializeSid]
mov rax, qword [rbp - 0x11]
lea r9, [rbp - 0x19]
xorps xmm0, xmm0
mov qword [rbp + 0x1f], rax
xor r8d, r8d
mov qword [rbp + 0x17], 5
lea rdx, [rbp - 9]
mov dword [rbp - 9], 0xffffffff
lea ecx, [rbx + 1]
mov qword [rbp - 5], 1
movdqu xmmword [rbp + 3], xmm0
mov dword [rbp + 0x13], ebx
mov qword [rbp - 0x19], rbx
call qword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_SetEntriesInAclW]
lea edx, [rbx + 0x28]
lea ecx, [rbx + 0x40]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400055ba
lea edx, [rbx + 1]
mov rcx, rax
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_InitializeSecurityDescriptor]
mov r8, qword [rbp - 0x19]
lea edx, [rbx + 1]
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorDacl]
lea r9, [rbp + 0x27]
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov dword [rbp + 0x27], 0x18
mov edx, 0x40000000
mov qword [rbp + 0x2f], rdi
mov rcx, rsi
mov dword [rbp + 0x37], ebx
mov dword [rsp + 0x20], 2
call fcn.140006030
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400055b1
lea r9, [rbp + 0x4b]
mov word [rbp + 0x3f], 0xfeff
lea r8d, [rbx + 2]
mov qword [rsp + 0x20], rbx
lea rdx, [rbp + 0x3f]
mov rcx, rax
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x1400055c9
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rcx, qword [rbp - 0x11]
test rcx, rcx
je 0x1400055d8
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_FreeSid]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14001f4e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400058a0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, 0x1290
call fcn.14006c570
sub rsp, rax
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x1280], rax
mov rsi, r8
mov rbp, rcx
mov r8d, 0x800
lea rcx, [rsp + 0x280]
xor edx, edx
xor ebx, ebx
call fcn.140043ce0
mov r9, rbp
lea r8, str._s.
mov edx, 0x400
lea rcx, [rsp + 0x280]
call fcn.1400032c0
lea rcx, [rsp + 0x280]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140005915
mov r14d, 0x104
cmp eax, r14d
jb 0x140005993
mov r8d, 4
lea rdx, str.__
lea rcx, [rsp + 0x280]
call fcn.14004a5cc
test eax, eax
je 0x140005993
xor edx, edx
lea rcx, [rsp + 0xa80]
mov r8d, 0x800
call fcn.140043ce0
lea rax, [rsp + 0x280]
mov edx, 0x400
lea r9, str.__
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rsp + 0xa80]
call fcn.1400032c0
lea rcx, [rsp + 0xa80]
jmp 0x14000599b
lea rcx, [rsp + 0x280]
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005a5b
test byte [rsp + 0x30], 0x10
je 0x140005a3c
movzx ecx, word [rsp + 0x5c]
cmp cx, word [0x140080d2c]
movzx eax, word [rsp + 0x5e]
jne 0x1400059da
cmp ax, word [0x140080d2e]
je 0x140005a3c
cmp cx, word [0x140080d30]
jne 0x1400059fa
cmp ax, word [0x140080d32]
jne 0x1400059fa
movzx eax, word [rsp + 0x60]
cmp ax, word [0x140080d34]
je 0x140005a3c
test rsi, rsi
je 0x140005a3a
lea rcx, [rsp + 0x5c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005a10
cmp rax, 0x100
lea r8, [rsp + 0x5c]
mov r9d, 0x400
mov rdx, rbp
cmovbe r9d, r14d
mov rcx, rsi
call fcn.14000cf60
inc ebx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x1400059b3
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
mov eax, ebx
mov rcx, qword [rsp + 0x1280]
xor rcx, rsp
call fcn.14001f4e0
lea r11, [rsp + 0x1290]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140005a90
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x12a0
call fcn.14006c570
sub rsp, rax
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x1290], rax
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x290]
mov r8d, 0x800
xor ebx, ebx
call fcn.140043ce0
mov r9, rsi
lea r8, str._s.
mov edx, 0x400
lea rcx, [rsp + 0x290]
call fcn.1400032c0
lea rcx, [rsp + 0x290]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], bx
jne 0x140005b00
cmp eax, 0x104
jb 0x140005b7a
mov r8d, 4
lea rdx, str.__
lea rcx, [rsp + 0x290]
call fcn.14004a5cc
test eax, eax
je 0x140005b7a
xor edx, edx
lea rcx, [rsp + 0xa90]
mov r8d, 0x800
call fcn.140043ce0
lea rax, [rsp + 0x290]
mov edx, 0x400
lea r9, str.__
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rsp + 0xa90]
call fcn.1400032c0
lea rcx, [rsp + 0xa90]
jmp 0x140005b82
lea rcx, [rsp + 0x290]
lea rdx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005c4f
nop word [rax + rax]
test byte [rsp + 0x40], 0x10
je 0x140005c1b
movzx ecx, word [rsp + 0x6c]
cmp cx, word [0x140080d2c]
movzx eax, word [rsp + 0x6e]
jne 0x140005bc3
cmp ax, word [0x140080d2e]
je 0x140005c30
cmp cx, word [0x140080d30]
jne 0x140005be3
cmp ax, word [0x140080d32]
jne 0x140005be3
movzx eax, word [rsp + 0x70]
cmp ax, word [0x140080d34]
je 0x140005c30
lea rax, [rsp + 0x6c]
mov r9, rsi
lea r8, [0x140080d48]
mov qword [rsp + 0x20], rax
mov edx, 0x400
lea rcx, [rsp + 0x290]
call fcn.1400032c0
lea rcx, [rsp + 0x290]
call fcn.140005a90
add rbx, rax
jmp 0x140005c30
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x30], eax
add rbx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x140005ba0
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
mov rax, rbx
mov rcx, qword [rsp + 0x1290]
xor rcx, rsp
call fcn.14001f4e0
lea r11, [rsp + 0x12a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140005c80
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11d0]
mov eax, 0x12d0
call fcn.14006c570
sub rsp, rax
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rbp + 0x11c0], rax
mov r13, r8
mov qword [rsp + 0x38], rdx
mov rdi, rdx
mov r12, rcx
xor edx, edx
lea rcx, [rbp + 0x1c0]
mov r8d, 0x800
xor ebx, ebx
xor r14d, r14d
xor esi, esi
call fcn.140043ce0
mov r9, r12
lea r8, str._s.
mov edx, 0x400
lea rcx, [rbp + 0x1c0]
call fcn.1400032c0
lea rcx, [rbp + 0x1c0]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140005d10
cmp eax, 0x104
jb 0x140005d85
mov r8d, 4
lea rdx, str.__
lea rcx, [rbp + 0x1c0]
call fcn.14004a5cc
test eax, eax
je 0x140005d85
xor edx, edx
lea rcx, [rbp + 0x9c0]
mov r8d, 0x800
call fcn.140043ce0
lea rax, [rbp + 0x1c0]
mov edx, 0x400
lea r9, str.__
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rbp + 0x9c0]
call fcn.1400032c0
lea rcx, [rbp + 0x9c0]
jmp 0x140005d8c
lea rcx, [rbp + 0x1c0]
lea rdx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140005ed3
nop dword [rax]
nop dword [rax + rax]
mov edi, dword [rsp + 0x70]
test dil, 0x10
je 0x140005e61
movzx ecx, word [rbp - 0x64]
cmp cx, word [0x140080d2c]
movzx eax, word [rbp - 0x62]
jne 0x140005ddc
cmp ax, word [0x140080d2e]
je 0x140005eaf
cmp cx, word [0x140080d30]
jne 0x140005dff
cmp ax, word [0x140080d32]
jne 0x140005dff
movzx eax, word [rbp - 0x60]
cmp ax, word [0x140080d34]
je 0x140005eaf
xor eax, eax
lea r8, [0x140080d48]
mov dword [rsp + 0x40], eax
lea rcx, [rbp + 0x1c0]
mov dword [rsp + 0x44], eax
mov r9, r12
lea rax, [rbp - 0x64]
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.1400032c0
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x1c0]
call fcn.140005c80
mov ecx, dword [rsp + 0x44]
add rbx, rax
mov eax, dword [rsp + 0x40]
add r14d, eax
test eax, eax
jne 0x140005e5d
test ecx, ecx
jne 0x140005e5d
inc esi
jmp 0x140005eaf
add esi, ecx
jmp 0x140005eaf
lea rdx, str.desktop.ini
lea rcx, [rbp - 0x64]
call fcn.140048b10
test eax, eax
jne 0x140005e99
test dil, 2
je 0x140005e99
test dil, 4
je 0x140005e99
lea r8, [rsp + 0x48]
mov rcx, r12
call fcn.140006120
test eax, eax
je 0x140005e99
test byte [rsp + 0x48], 1
jne 0x140005eaf
mov eax, dword [rbp - 0x74]
mov dword [rsp + 0x34], eax
mov eax, dword [rbp - 0x70]
mov dword [rsp + 0x30], eax
add rbx, qword [rsp + 0x30]
inc r14d
lea rdx, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
test eax, eax
jne 0x140005db0
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140005edb
mov dword [rdi], r14d
mov rax, rbx
test r13, r13
je 0x140005ee7
mov dword [r13], esi
mov rcx, qword [rbp + 0x11c0]
xor rcx, rsp
call fcn.14001f4e0
mov rbx, qword [rsp + 0x1328]
add rsp, 0x12d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005f20
Capabilities:
Create directory

Disassembly:
push rbx
mov eax, 0x1040
call fcn.14006c570
sub rsp, rax
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rbx, rcx
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005f50
cmp eax, 0xf7
ja 0x140005f7d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.api_ms_win_shell_shdirectory_l1_1_0.dll_Ordinal_290]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x14000600a
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x800
call fcn.140043ce0
test rbx, rbx
je 0x140005fb6
mov r8, rbx
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.140049578
mov edx, 0x400
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
lea rcx, [rsp + 0x30]
call fcn.140005f20
xor edx, edx
lea rcx, [rsp + 0x830]
mov r8d, 0x800
call fcn.140043ce0
lea r9, str.__
mov qword [rsp + 0x20], rbx
lea r8, str._s_s
mov edx, 0x400
lea rcx, [rsp + 0x830]
call fcn.1400032c0
xor edx, edx
lea rcx, [rsp + 0x830]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x1040
pop rbx
ret

Function at 0x1400061f0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x1040
call fcn.14006c570
sub rsp, rax
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rax, 0xffffffffffffffff
mov rdi, rcx
mov rcx, rax
mov rbx, rdx
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x140006225
cmp ecx, 0x104
jae 0x140006259
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140006240
cmp eax, 0x104
jae 0x140006259
mov rcx, rdi
jmp 0x14000631a
xor edx, edx
lea rcx, [rsp + 0x830]
mov r8d, 0x800
call fcn.140043ce0
mov r8d, 4
lea rdx, str.__
mov rcx, rdi
call fcn.14004a5cc
lea rcx, [rsp + 0x830]
mov edx, 0x400
test eax, eax
jne 0x14000629e
mov r8, rdi
call fcn.140049578
jmp 0x1400062b6
lea r9, str.__
mov qword [rsp + 0x20], rdi
lea r8, str._s_s
call fcn.1400032c0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x800
call fcn.140043ce0
mov r8d, 4
lea rdx, str.__
mov rcx, rbx
call fcn.14004a5cc
lea rcx, [rsp + 0x30]
mov edx, 0x400
test eax, eax
jne 0x1400062f5
mov r8, rbx
call fcn.140049578
jmp 0x14000630d
lea r9, str.__
mov qword [rsp + 0x20], rbx
lea r8, str._s_s
call fcn.1400032c0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x830]
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_file_l2_1_2.dll_CopyFileW]
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14001f4e0
mov rbx, qword [rsp + 0x1060]
add rsp, 0x1040
pop rdi
ret
Function at 0x140006350
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x840
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rbx, rcx
call fcn.1400064e0
test eax, eax
je 0x14000637b
xor eax, eax
jmp 0x1400063f0
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140006382
cmp eax, 0x104
jb 0x1400063e7
mov r8d, 4
lea rdx, str.__
mov rcx, rbx
call fcn.14004a5cc
test eax, eax
je 0x1400063e7
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x800
call fcn.140043ce0
lea r9, str.__
mov qword [rsp + 0x20], rbx
lea r8, str._s_s
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.1400032c0
lea rcx, [rsp + 0x30]
jmp 0x1400063ea
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x840
pop rbx
ret
Function at 0x140006620
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x720
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x710], rax
xor r14d, r14d
lea rcx, [rsp + 0xe0]
xor edx, edx
mov r8d, 0x208
mov edi, r14d
call fcn.140043ce0
mov edx, 0x104
lea rcx, [rsp + 0xe0]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstVolumeW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14000686a
mov qword [rsp + 0x750], r15
lea r15d, [r14 + 1]
mov qword [rsp + 0x740], rbx
mov qword [rsp + 0x748], rsi
nop word [rax + rax]
mov r8d, 4
lea rdx, str.__
lea rcx, [rsp + 0xe0]
call fcn.14004a5cc
test eax, eax
jne 0x140006849
xor edx, edx
lea rcx, [rsp + 0x2f0]
mov r8d, 0x208
call fcn.140043ce0
mov dword [rsp + 0x38], r14d
lea rdx, [rsp + 0x2f0]
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov r8d, 0x104
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
test eax, eax
je 0x140006826
lea rdx, [0x140083528]
lea rcx, [rsp + 0x2f0]
call fcn.140048b10
test eax, eax
jne 0x140006826
xor edx, edx
lea rcx, [rsp + 0x500]
mov r8d, 0x208
call fcn.140043ce0
lea rax, [rsp + 0xe0]
mov r9, 0xffffffffffffffff
inc r9
cmp word [rax + r9*2], r14w
jne 0x140006752
dec r9
lea r8, [rsp + 0xe0]
mov edx, 0x104
lea rcx, [rsp + 0x500]
call fcn.14004a600
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x500]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov ebx, r14d
lea r8d, [r9 + 3]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140006826
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x90
call fcn.140043ce0
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x90
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70048
mov dword [rsp + 0x40], r14d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_io_l1_1_0.dll_DeviceIoControl]
test eax, eax
je 0x140006817
cmp dword [rsp + 0x50], r15d
jne 0x140006817
test byte [rsp + 0x90], r15b
cmovne ebx, r15d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test ebx, ebx
cmovne edi, r15d
mov r8d, 0x104
lea rdx, [rsp + 0xe0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextVolumeW]
test eax, eax
je 0x140006849
test edi, edi
je 0x1400066a0
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindVolumeClose]
mov r15, qword [rsp + 0x750]
mov rsi, qword [rsp + 0x748]
mov rbx, qword [rsp + 0x740]
mov eax, edi
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x720
pop r14
pop rdi
pop rbp
ret
Function at 0x140007c10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x140007c4b
xor eax, eax
cmp dx, si
cmove di, ax
movzx eax, di
jmp 0x140007d98
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140007c87
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140007c87
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, di
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x140007d98
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140007d8d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140007cce
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140007cf7
movzx ecx, di
mov rdx, qword [rbx + 0x80]
call fcn.140049240
cmp ax, si
je 0x140007d8d
movzx esi, di
jmp 0x140007d8d
lea r8, [rsp + 0x40]
mov word [rsp + 0x50], di
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x52]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x140007d8d
cmp eax, 1
jle 0x140007d4d
cmp eax, 3
jne 0x140007d8d
movzx ecx, word [rsp + 0x50]
jmp 0x140007cda
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x140007d7a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.140049da4
cmp rbp, rax
jne 0x140007d8d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
movzx eax, di
jne 0x140007d90
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14001f4e0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x140008a60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140008b11
cmp byte [rcx + 0x72], 0
je 0x140008b11
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140008ad3
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140008ad7
sub eax, 1
je 0x140008adb
sub eax, 2
je 0x140008b11
xor al, al
jmp 0x140008b13
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140008b08
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140049da4
cmp rdi, rax
jne 0x140008ad3
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140008b13
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001f4e0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140009c90
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
xor edi, edi
test ecx, ecx
je 0x140009d36
cmp qword [0x140096738], rdi
jne 0x140009ccd
mov qword [rsp + 0x28], rdi
lea r8, [0x140009dc0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x140096738], rax
cmp qword [0x140096740], rdi
jne 0x140009cfa
mov qword [rsp + 0x28], rdi
lea r8, [0x14000c6d0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x140096740], rax
cmp qword [0x140096748], rdi
jne 0x140009dae
mov qword [rsp + 0x28], rdi
lea r8, [0x14000c6f0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
mov qword [0x140096748], rax
mov eax, 1
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
lea rbx, [0x140096740]
mov qword [rsp + 0x48], rsi
mov esi, 2
nop dword [rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140009d6f
mov edx, 0x9c4
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbx], rdi
add rbx, 8
sub rsi, 1
jne 0x140009d50
mov rcx, qword [0x140096738]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
test rcx, rcx
je 0x140009dae
mov edx, 0x9c4
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov rcx, qword [0x140096738]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [0x140096738], rdi
mov eax, 1
add rsp, 0x30
pop rdi
ret