joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000426f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140010040]
jne 0x1400039aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400039a6
repz ret
ror rcx, 0x10
jmp 0x1400041c8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140011280]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140011378]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000424d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140011280]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000426f
mov rax, qword [rsp + 0x88]
mov qword [0x140011378], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140011318], rax
mov rax, qword [0x140011378]
mov qword [0x1400111f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140011300], rax
mov dword [0x1400111e0], 0xc0000409
mov dword [0x1400111e4], 1
mov rax, qword [0x140010040]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140010048]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140011278], eax
mov ecx, 1
call fcn.140004cb4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000c328]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140011278], 0
jne 0x1400042f6
mov ecx, 1
call fcn.140004cb4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140005360
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140006610
nop
cmp dword [0x1400117c0], 1
je 0x14000530c
mov dword [0x1400117bc], 1
mov byte [0x1400117b8], r12b
test ebx, ebx
jne 0x1400052f8
mov rcx, qword [0x140012250]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400052e5
mov rcx, qword [0x140012248]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140005284
call fcn.140004cc4
cmp qword [rdi], rax
jne 0x140005284
jmp 0x14000526a
cmp rdi, rsi
jb 0x1400052e5
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140004cc4
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140012250]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140012248]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400052c3
cmp r13, rax
je 0x1400052e3
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14000526a
lea rdx, [0x14000c280]
lea rcx, [0x14000c278]
call fcn.1400050b4
lea rdx, [0x14000c290]
lea rcx, [0x14000c288]
call fcn.1400050b4
nop
test r12d, r12d
je 0x14000531b
mov ecx, 8
call fcn.140006510
test r12d, r12d
jne 0x140005346
mov dword [0x1400117c0], 1
lea ecx, [r12 + 8]
call fcn.140006510
mov ecx, r15d
call fcn.140005048
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400051d4

Function at 0x14000536c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400051d4
Function at 0x140007978
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140004cc4
xor ebx, ebx
mov rdi, rax
cmp qword [0x140011f38], rbx
jne 0x140007a7e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140007b53
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007b53
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140011f38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140011f40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140011f48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140011f58], rax
test rax, rax
je 0x140007a75
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140011f50], rax
jmp 0x140007a85
mov rax, qword [0x140011f50]
jmp 0x140007a8c
mov rax, qword [0x140011f50]
mov r11, qword [0x140011f58]
cmp rax, rdi
je 0x140007af4
cmp r11, rdi
je 0x140007af4
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140011f58]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140007af4
test rax, rax
je 0x140007af4
call rsi
test rax, rax
je 0x140007aee
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140007aee
test byte [rsp + 0x38], 1
jne 0x140007af4
bts ebp, 0x15
jmp 0x140007b32
mov rcx, qword [0x140011f40]
cmp rcx, rdi
je 0x140007b32
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140007b32
call rax
mov rbx, rax
test rax, rax
je 0x140007b32
mov rcx, qword [0x140011f48]
cmp rcx, rdi
je 0x140007b32
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140007b32
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140011f38]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140007b53
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140007b55
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x141896058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1418961df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141896089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14189606f
add dl, dl
jne 0x141896096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418960f6
xor eax, eax
add dl, dl
jne 0x1418960a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1418961ad
add dl, dl
jne 0x1418960b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418960c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418960d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1418960dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1418960ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14189607e
mov eax, 1
add dl, dl
jne 0x141896106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141896113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1418960fb
sub eax, ebx
mov ebx, 1
jne 0x14189614c
mov ecx, 1
add dl, dl
jne 0x14189612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14189613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141896123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14189607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141896168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141896175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14189615d
cmp eax, 0x7d00
jae 0x14189619b
cmp eax, 0x500
jb 0x141896196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14189607e
cmp eax, 0x7f
ja 0x14189619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14189607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1418961d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14189607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x4021e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x218
xor edi, edi
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rcx + rax + 0x88]
mov rbp, rsp
lea rsi, [rbp + 0x208]
add rax, rcx
mov r12d, dword [rax + 0x20]
mov r13d, dword [rax + 0x1c]
mov r14d, dword [rax + 0x24]
add r12, rcx
mov ebx, dword [r12]
add rbx, rcx
movsx r10w, byte [rbx]
test r10b, r10b
je 0x4022f4
mov rax, rbp
mov byte [rax], 0
add rax, 1
cmp rax, rsi
jne 0x402234
xor eax, eax
jmp 0x402247
mov eax, r15d
lea r15d, [rax + 1]
movsx r9w, byte [rbx + r15]
mov r11, r15
test r9b, r9b
jne 0x402244
test r11d, r11d
je 0x402286
lea r11, [rbp + r15*2]
add rax, rbx
jmp 0x402279
movsx r9w, byte [rax]
sub rax, 1
mov word [r11], r9w
sub r11, 2
cmp rbx, rax
jne 0x402270
mov word [rsp], r10w
xor r11d, r11d
jmp 0x402293
mov r11d, r9d
lea r9d, [r11 + 1]
cmp word [rsp + r9*2], 0
mov rax, r9
jne 0x402290
test eax, eax
je 0x402310
lea r9, [rbp + 2]
mov ebx, dword [r8 + 0x80]
xor eax, eax
lea r11, [r9 + r11*2]
jmp 0x4022c8
movzx r10d, word [r9]
add r9, 2
imul eax, ebx
movzx r10d, r10w
add eax, r10d
cmp r11, r9
jne 0x4022c0
cmp edx, eax
je 0x402316
add rdi, 1
mov ebx, dword [r12 + rdi*4]
add rbx, rcx
movsx r10w, byte [rbx]
test r10b, r10b
jne 0x402231
xor eax, eax
add rsp, 0x218
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
cmp edx, eax
jne 0x4022db
lea rax, [rcx + rdi*2]
movzx eax, word [rax + r14]
lea rax, [rcx + rax*4]
mov eax, dword [rax + r13]
add rax, rcx
jmp 0x4022f6

Function at 0x4023b0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10

Function at 0x4024d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor eax, eax
mov rdi, qword [rsp + 0xb0]
mov r12, rcx
mov qword [rsp + 0xa0], r8
lea rcx, [rsp + 0x38]
nop word [rax + rax]
movzx r8d, byte [rdi + rax + 0x70]
mov byte [rcx + rax], r8b
add rax, 1
cmp rax, 4
jne 0x402500
xor eax, eax
add rcx, 4
nop word [rax + rax]
movzx r8d, byte [rdi + rax + 0x20]
mov byte [rcx + rax], r8b
add rax, 1
cmp rax, 4
jne 0x402520
lea ebp, [rdx - 8]
mov rbx, r12
xor r15d, r15d
xor r13d, r13d
xor r11d, r11d
xor r14d, r14d
lea r8, [r12 + 8]
lea rsi, [rsp + 0x37]
lea esi, [rsp + 0x37]
sub r8, r12
mov eax, ebp
sub eax, r8d
je 0x402640
sub eax, 1
xor ecx, ecx
jmp 0x402575
invalid
invalid
push rcx
Function at 0x402500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor eax, eax
mov rdi, qword [rsp + 0xb0]
mov r12, rcx
mov qword [rsp + 0xa0], r8
lea rcx, [rsp + 0x38]
nop word [rax + rax]
movzx r8d, byte [rdi + rax + 0x70]
mov byte [rcx + rax], r8b
add rax, 1
cmp rax, 4
jne 0x402500
xor eax, eax
add rcx, 4
nop word [rax + rax]
movzx r8d, byte [rdi + rax + 0x20]
mov byte [rcx + rax], r8b
add rax, 1
cmp rax, 4
jne 0x402520
lea ebp, [rdx - 8]
mov rbx, r12
xor r15d, r15d
xor r13d, r13d
xor r11d, r11d
xor r14d, r14d
lea r8, [r12 + 8]
lea rsi, [rsp + 0x37]
lea esi, [rsp + 0x37]
sub r8, r12
mov eax, ebp
sub eax, r8d
je 0x402640
sub eax, 1
xor ecx, ecx
jmp 0x402575
invalid
invalid
push rcx

Function at 0x4026a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx r8d, byte [rsi + rdx]
cmp byte [r10 + rdx], r8b
je 0x40258f
invalid
cmp r8b, 0x3f
jne 0x402565
add rdx, 1
cmp rdx, 9
jne 0x40257e
lea rbx, [rbx + rcx + 1]
test rbx, rbx
je 0x402640
mov eax, dword [rbx]
lea r8, [rbx + 8]
mov r10d, eax
mov edx, eax
movzx ecx, ah
shl r10d, 0x18
shr edx, 0x18
add edx, r10d
mov r10d, ecx
shr eax, 8
shl r10d, 0x10
and eax, 0xff00
add r10d, edx
add r10d, eax
mov eax, dword [rdi + 0x94]
cmp dword [rbx + 8], eax
je 0x402695
test r11, r11
je 0x402550
lea ecx, [r10 + r14]
mov eax, r14d
add rax, r11
cmp ecx, r13d
ja 0x402728
lea r14d, [r10 - 1]
test r10d, r10d
je 0x402626
xor edx, edx
jmp 0x402613
mov rdx, r10
movzx r10d, byte [rbx + rdx + 8]
cmp rdx, r14
mov byte [rax + rdx], r10b
lea r10, [rdx + 1]
jne 0x402610
sub r8, r12
mov eax, ebp
mov r14d, ecx
sub eax, r8d
jne 0x40255e
nop word [rax + rax]
xor eax, eax
test r11, r11
je 0x402684
test r11, r11
jne 0x4025ec
mov eax, dword [rbx + 0x10]
mov r11, qword [r9 + 0x48]
mov rcx, qword [r9 + 0xc8]
lea r13d, [rax + 0x10]
test r13d, r13d
mov eax, r13d
je 0x402720
mov qword [rsp + 0x28], r8
mov ecx, dword [rcx + 0x100]
mov edx, eax
mov qword [rsp + 0xa8], r9
mov dword [rsp + 0x24], r10d
call r11
mov r10d, dword [rsp + 0x24]
mov r11, rax
xor eax, eax
mov r8, qword [rsp + 0x28]
mov eax, dword [rsp + 0x28]
mov r9, qword [rsp + 0xa8]
lea ecx, [r10 - 1]
test r10d, r10d
jne 0x402703
jmp 0x402715
mov rax, rdx
movzx edx, byte [rbx + rax + 8]
cmp rcx, rax
mov byte [r11 + rax], dl
lea rdx, [rax + 1]
lea edx, [rax + 1]
jne 0x402700
add r14d, r10d
mov r15, r8
jmp 0x402550
mov eax, dword [rcx + 0xa0]
jmp 0x4026b8
sub r13d, r14d
mov edx, 0
lea r9d, [r13 - 1]
jne 0x402743
jmp 0x402647

Function at 0x403098
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, edi
mov qword [rsi + 0x10], rax
call fcn.004021e0
mov edx, dword [rbx + 0x108]
mov qword [rsi + 0x78], rax
call fcn.004021e0
mov edx, dword [rbx + 0xb8]
mov qword [rsi + 8], rax
call fcn.004021e0
mov edx, dword [rbx + 0xe8]
mov qword [rsi + 0x30], rax
call fcn.004021e0
mov edx, dword [rbx + 0x68]
mov qword [rsi], rax
call fcn.004021e0
mov edx, dword [rbx + 0x1c]
mov rcx, rbp
mov qword [rsi + 0x68], rax
call fcn.004021e0
mov edx, dword [rbx + 0xb4]
Function at 0x403898
Capabilities:
Encode data using xor

Disassembly:
xor dword [rax], r12d
add rax, 4
cmp rdx, rax
jne 0x403891
mov rax, qword [rsi + 0xc8]
mov edx, dword [rax + 0xa0]
mov ecx, dword [rax + 0x100]
call qword [rsi + 0x48]
xor edx, edx
mov r12, rax
movsx ax, byte [r13]
test al, al
je 0x4038d6
mov word [r12 + rdx*2], ax
add rdx, 1
movsx ax, byte [r13 + rdx]
test al, al
jne 0x4038c2
mov rax, qword [rsi + 0xc8]
xor r13d, r13d
mov edx, dword [rax + 0xa0]
mov ecx, dword [rax + 0x100]
call qword [rsi + 0x48]
mov ecx, 0x104
mov rdx, rax
mov rdi, rax
mov edi, eax
call qword [rsi + 0x68]
mov rax, qword [rsi + 0xc8]
mov edx, 0xd
mov ecx, dword [rax + 0x100]
call qword [rsi + 0x48]
mov rcx, qword [rsp + 0x48]
mov r10d, 0x25
mov r11d, 0x78
mov word [rsp + 0x92], r10w
mov r8, qword [rsi + 0xb8]
mov rbp, rax
mov word [rsp + 0x94], r11w
mov word [rsp + 0x96], r13w
mov r13, qword [rsi + 0x10]
lea rdx, [rcx + 8]

Function at 0x4070f4
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x407102
and edx, 0x3fff
jmp fcn.0040704c

Function at 0x407108
Capabilities:
Delete directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040aa6c
mov ebx, eax
cmp eax, 1
je 0x407138
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x407138
mov al, 1
jmp 0x407189
test ebx, ebx
je 0x407187
lea rcx, [rsp + 0x28]
call fcn.00403640
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040b0e8
test al, al
je 0x40717d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call fcn.004023c4
mov al, bl
jmp 0x407189
mov rcx, qword [rsp + 0x28]
call fcn.004023c4
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x4071b0
Capabilities:
Move file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, rdx
mov r12, rcx
call fcn.0040aa6c
mov esi, eax
mov rcx, rbp
call fcn.0040aa6c
mov edi, eax
mov ebx, 1
cmp esi, ebx
je 0x4071ff
cmp eax, ebx
je 0x4071ff
mov rdx, rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4071ff
mov al, bl
jmp 0x40728d
test esi, esi
jne 0x40720b
test edi, edi
je 0x40728b
lea rcx, [rsp + 0x48]
call fcn.00403640
nop
lea rcx, [rsp + 0x38]
call fcn.00403640
nop
cmp esi, ebx
je 0x407229
cmp edi, ebx
jne 0x40722b
xor bl, bl
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x48]
mov rdx, rbp
mov rcx, r12
call fcn.0040b128
test al, al
je 0x407276
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x38]
call fcn.004023c4
nop
mov rcx, qword [rsp + 0x48]
call fcn.004023c4
mov al, bl
jmp 0x40728d
mov rcx, qword [rsp + 0x38]
call fcn.004023c4
nop
mov rcx, qword [rsp + 0x48]
call fcn.004023c4
xor al, al
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x407430
Capabilities:
Create directory

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040aa6c
mov ebx, eax
cmp eax, 1
je 0x40746f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x407462
mov al, 1
jmp 0x4074c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4074c0
test ebx, ebx
je 0x4074c0
lea rcx, [rsp + 0x28]
call fcn.00403640
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040b0e8
test al, al
je 0x4074b6
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call fcn.004023c4
mov al, bl
jmp 0x4074c2
mov rcx, qword [rsp + 0x28]
call fcn.004023c4
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x4074e8
Capabilities:
Delete file

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call fcn.004085d4
cmp eax, 0xffffffff
je 0x40751e
test al, 0x10
jne 0x40751e
test al, 1
je 0x40751e
and eax, 0xfffffffe
mov edx, eax
mov rcx, rbx
call fcn.0040704c
test al, al
je 0x40758f
mov rcx, rbx
call fcn.0040aa6c
mov edi, eax
cmp eax, 1
je 0x40753e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40753e
mov al, 1
jmp 0x40758f
test edi, edi
je 0x40758d
lea rcx, [rsp + 0x28]
call fcn.00403640
nop
cmp edi, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.0040b0e8
test al, al
je 0x407583
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x28]
call fcn.004023c4
mov al, bl
jmp 0x40758f
mov rcx, qword [rsp + 0x28]
call fcn.004023c4
xor al, al
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x4075b8
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor ecx, ecx
cmp eax, ecx
setne al
add rsp, 0x28
ret

Function at 0x4085d4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rcx
call fcn.0040aa6c
mov ebx, eax
cmp eax, 1
je 0x408601
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408652
test ebx, ebx
je 0x40864d
lea rcx, [rsp + 0x28]
call fcn.00403640
nop
cmp ebx, 1
setne r8b
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.0040b0e8
test al, al
je 0x408643
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rcx, qword [rsp + 0x28]
call fcn.004023c4
mov eax, ebx
jmp 0x408652
mov rcx, qword [rsp + 0x28]
call fcn.004023c4
mov eax, 0xffffffff
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x4090c4
Capabilities:
Get disk information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r12, rcx
movsxd rbx, dword [rcx + 8]
mov rdi, rbx
test ebx, ebx
je 0x409114
shl rdi, 3
add ebx, 0xffffffff
sub rdi, 8
mov rax, qword [r12]
mov rsi, qword [rdi + rax]
test rsi, rsi
je 0x409110
mov rcx, qword [rsi]
call fcn.004023c4
mov rcx, rsi
call fcn.004023c4
test ebx, ebx
jne 0x4090ec
mov dword [r12 + 8], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test eax, eax
je 0x409208
mov rcx, rdi
xor ebx, ebx
mov qword [rsp + 0x80], rbx
test eax, eax
je 0x409155
add rcx, rcx
call fcn.00402398
mov rbx, rax
mov qword [rsp + 0x80], rax
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
test eax, eax
je 0x4091fe
cmp eax, edi
ja 0x4091fe
lea rcx, [rsp + 0x28]
call fcn.00403640
nop
xor r13d, r13d
xor edi, edi
test esi, esi
je 0x4091df
mov rbp, rbx
cmp word [rbp], 0
jne 0x4091d5
lea rdx, [rbx + r13*2]
lea rcx, [rsp + 0x28]
call fcn.004037d4
lea r13d, [rdi + 1]
mov ecx, 0x10
call fcn.00402398
mov qword [rsp + 0x88], rax
test rax, rax
je 0x4091c8
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.0040374c
jmp 0x4091ca
xor eax, eax
mov rdx, rax
mov rcx, r12
call fcn.004010c0
inc edi
add rbp, 2
cmp edi, esi
jb 0x409189
cmp r13d, esi
sete dil
mov rcx, qword [rsp + 0x28]
call fcn.004023c4
nop
mov rcx, rbx
call fcn.004023c4
mov al, dil
jmp 0x409208
mov rcx, rbx
call fcn.004023c4
xor al, al
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x4092ac
Capabilities:
Get file size

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp byte [rcx + 8], 0
mov rbx, rdx
je 0x4092cb
cmp byte [rcx + 9], 0
je 0x4092cb
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
jmp 0x4092ff
mov rcx, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov edi, eax
jne 0x4092ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4092ee
xor al, al
jmp 0x409301
mov ecx, dword [rsp + 0x40]
mov rax, rdi
shl rcx, 0x20
add rcx, rdi
mov qword [rbx], rcx
mov al, 1
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x40939c
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
setne al
mov dword [rbx], ecx
add rsp, 0x30
pop rbx
ret

Function at 0x4093d8
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x00508070]
cmp r8d, eax
cmova r8d, eax
jmp fcn.0040939c

Function at 0x409498
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x00508070]
mov rcx, qword [rcx]
mov rbx, r9
cmp r8d, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
cmova r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret