joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c72ec110
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x248
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1e0], rcx
call sub.msvcrt.dll__errno
mov dword [rax], 0
cmp qword [rbp + 0x1e0], 0
jne 0x1c72ec152
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
mov eax, 0
jmp 0x1c72ec39a
mov rax, qword [rbp + 0x1e0]
movzx eax, word [rax]
test ax, ax
jne 0x1c72ec176
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
mov eax, 0
jmp 0x1c72ec39a
mov rax, qword [rbp + 0x1e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
call rax
mov dword [rbp + 0x1bc], eax
cmp dword [rbp + 0x1bc], 0xffffffff
jne 0x1c72ec1ad
call sub.msvcrt.dll__errno
mov dword [rax], 2
mov eax, 0
jmp 0x1c72ec39a
mov eax, dword [rbp + 0x1bc]
and eax, 0x10
test eax, eax
jne 0x1c72ec1cf
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
mov eax, 0
jmp 0x1c72ec39a
mov rdx, qword [rbp + 0x1e0]
lea rax, [rbp - 0x60]
mov r8d, 0x104
mov rcx, rax
call sub.msvcrt.dll__wfullpath
lea rax, [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_wcslen
mov rbx, rax
lea rax, [0x1c743ea00]
mov rcx, rax
call sub.msvcrt.dll_wcslen
add rbx, rax
lea rax, [0x1c743ea04]
mov rcx, rax
call sub.msvcrt.dll_wcslen
add rax, rbx
add rax, 0x229
add rax, rax
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x1b0], rax
cmp qword [rbp + 0x1b0], 0
jne 0x1c72ec252
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
mov eax, 0
jmp 0x1c72ec39a
mov rax, qword [rbp + 0x1b0]
lea rcx, [rax + 0x44c]
lea rax, [rbp - 0x60]
mov rdx, rax
call sub.msvcrt.dll_wcscpy
mov rax, qword [rbp + 0x1b0]
movzx eax, word [rax + 0x44c]
test ax, ax
je 0x1c72ec303
mov rax, qword [rbp + 0x1b0]
add rax, 0x44c
mov rcx, rax
call sub.msvcrt.dll_wcslen
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x1b0]
add rdx, 0x220
movzx eax, word [rax + rdx*2 + 0xc]
cmp ax, 0x2f
je 0x1c72ec303
mov rax, qword [rbp + 0x1b0]
add rax, 0x44c
mov rcx, rax
call sub.msvcrt.dll_wcslen
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x1b0]
add rdx, 0x220
movzx eax, word [rax + rdx*2 + 0xc]
cmp ax, 0x5c
je 0x1c72ec303
mov rax, qword [rbp + 0x1b0]
add rax, 0x44c
lea rdx, [0x1c743ea00]
mov rcx, rax
call sub.msvcrt.dll_wcscat
mov rax, qword [rbp + 0x1b0]
add rax, 0x44c
lea rdx, [0x1c743ea04]
mov rcx, rax
call sub.msvcrt.dll_wcscat
mov rax, qword [rbp + 0x1b0]
mov qword [rax + 0x440], 0xffffffffffffffff
mov rax, qword [rbp + 0x1b0]
mov dword [rax + 0x448], 0
mov rax, qword [rbp + 0x1b0]
mov dword [rax + 0x230], 0
mov rax, qword [rbp + 0x1b0]
mov word [rax + 0x234], 0
mov rax, qword [rbp + 0x1b0]
mov word [rax + 0x236], 0
mov rax, qword [rbp + 0x1b0]
add rax, 0x238
mov r8d, 0x208
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [rbp + 0x1b0]
add rsp, 0x248
pop rbx
pop rbp
ret
Function at 0x1c72eca00
Capabilities:
Enumerate disk volumes
Get disk information
Get disk size
Get file size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
lea rdx, [rbp - 0x38]
mov rax, qword [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jne 0x1c72eca44
mov ecx, 9
call fcn.1c72facf0
mov eax, 0xffffffff
jmp 0x1c72ecc08
mov rax, qword [rbp - 0x38]
cmp rax, qword [rbp + 0x18]
jb 0x1c72eca58
mov eax, 0
jmp 0x1c72ecc08
lea rdx, [rbp - 0x70]
mov rax, qword [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
call rax
test eax, eax
jne 0x1c72eca84
mov ecx, 0x16
call fcn.1c72facf0
mov eax, 0xffffffff
jmp 0x1c72ecc08
mov edx, 2
mov ecx, 0x33
call sub.msvcrt.dll_calloc
mov qword [rbp - 0x18], rax
mov edx, 2
mov ecx, 0x106
call sub.msvcrt.dll_calloc
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x18], 0
je 0x1c72ecab8
cmp qword [rbp - 0x20], 0
jne 0x1c72ecacc
mov ecx, 9
call fcn.1c72facf0
mov eax, 0xffffffff
jmp 0x1c72ecc08
mov qword [rbp - 8], 0
mov rax, qword [rbp - 0x18]
mov edx, 0x32
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
call rax
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x3c]
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x105
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
call rax
mov dword [rbp - 0xc], eax
mov edx, dword [rbp - 0x54]
mov eax, dword [rbp - 0x3c]
cmp edx, eax
jne 0x1c72ecb48
mov rax, qword [rbp - 0x18]
mov qword [rbp - 8], rax
jmp 0x1c72ecb66
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x28]
mov r8d, 0x32
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
call rax
test eax, eax
jne 0x1c72ecaed
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindVolumeClose]
call rax
cmp qword [rbp - 8], 0
jne 0x1c72ecb89
mov rax, qword [rbp - 0x18]
mov rcx, rax
call fcn.1c72fb8c0
mov rax, qword [rbp - 0x20]
mov rcx, rax
call fcn.1c72fb8c0
lea rdx, [rbp - 0x30]
mov rax, qword [rbp - 8]
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
call rax
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov rcx, rax
call fcn.1c72fb8c0
cmp dword [rbp - 0xc], 0
jne 0x1c72ecbdb
mov ecx, 0x1b
call fcn.1c72facf0
mov eax, 0xffffffff
jmp 0x1c72ecc08
mov rax, qword [rbp - 0x38]
mov rdx, rax
mov rax, qword [rbp + 0x18]
sub rax, rdx
mov rdx, qword [rbp - 0x30]
cmp rdx, rax
jae 0x1c72ecc03
mov ecx, 0x1b
call fcn.1c72facf0
mov eax, 0xffffffff
jmp 0x1c72ecc08
mov eax, 0
add rsp, 0xb0
pop rbp
ret
Function at 0x1c72fe9b9
Capabilities:
Print debug messages

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
cmp qword [rbp + 0x10], 0
je 0x1c72feb04
mov rax, qword [rbp + 0x10]
mov rcx, rax
call fcn.1c72fdfdd
cmp eax, 1
jne 0x1c72feaf7
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
movabs rax, 0x6b5f6e6970732070
movabs rdx, 0x20726f6620737965
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
movabs rax, 0x20646165726874
mov edx, 0
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x15], 0
mov qword [rbp - 0xd], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov ecx, eax
lea rax, [rbp - 0x70]
add rax, 0x27
mov r8d, 0xa
mov rdx, rax
mov rax, qword [sym.imp.msvcrt.dll__ultoa]
call rax
mov dword [rbp - 4], 0x27
jmp 0x1c72feaad
add dword [rbp - 4], 1
mov eax, dword [rbp - 4]
cdqe
movzx eax, byte [rbp + rax - 0x70]
test al, al
je 0x1c72feac3
mov eax, dword [rbp - 4]
cmp eax, 0x69
jbe 0x1c72feaa9
mov eax, dword [rbp - 4]
cmp eax, 0x69
ja 0x1c72feae2
mov eax, dword [rbp - 4]
cdqe
mov byte [rbp + rax - 0x70], 0xa
mov eax, dword [rbp - 4]
add eax, 1
cdqe
mov byte [rbp + rax - 0x70], 0
lea rax, [rbp - 0x70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rax
call sub.msvcrt.dll_abort
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov qword [rax], rdx
jmp 0x1c72feb05
nop
add rsp, 0x90
pop rbp
ret
Function at 0x1c72ffd17
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xffffffffffffffff
lea rax, [0x1c72ffb3a]
mov rdx, rax
lea rax, [0x1c7494e40]
mov rcx, rax
call fcn.1c72ff132
mov eax, dword [0x1c74304c0]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x1c72ffd6a
mov rax, qword [rbp - 0x10]
jmp 0x1c72ffeca
call fcn.1c72fe895
mov qword [rbp - 0x10], rax
mov rax, qword [0x1c7498040]
test rax, rax
je 0x1c72ffd86
cmp qword [rbp - 0x10], 0
jne 0x1c72ffd90
mov eax, 0
jmp 0x1c72ffeca
mov rax, qword [rbp - 0x10]
mov dword [rax + 0x44], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0x70], eax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
lea rcx, [rax + 0x68]
mov rax, qword [rbp - 8]
mov rdx, rax
call fcn.1c72fe9b9
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xb8], 0
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
lea rdi, [rax + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
test eax, eax
jne 0x1c72ffe6b
call sub.msvcrt.dll_abort
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadPriority]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0xc0], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 0
mov rax, qword [rbp - 0x10]
movzx edx, byte [rax + 0x40]
and edx, 0xffffffcf
or edx, 0x10
mov byte [rax + 0x40], dl
mov eax, dword [0x1c74304c0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
test eax, eax
jne 0x1c72ffec6
call sub.msvcrt.dll_abort
mov rax, qword [rbp - 0x10]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1c72fffc7
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x10], 0
mov rax, qword [rbp + 0x10]
mov dword [rbp - 4], eax
call fcn.1c72ffd17
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call fcn.1c72ffb68
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 0x40]
and eax, 0x30
test al, al
jne 0x1c7300034
mov rax, qword [rbp - 0x18]
add rax, 0xd0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_longjmp]
call rax
mov eax, dword [0x1c74304c0]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x1c7300178
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x1c73000d1
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x1c730008c
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.1c72fe76e
mov qword [rbp - 0x10], 0
mov eax, dword [0x1c74304c0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x1c7300178
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 1
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x1c730010b
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x44]
and eax, 4
test eax, eax
je 0x1c7300178
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.1c72fe76e
mov qword [rbp - 0x10], 0
mov eax, dword [0x1c74304c0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x1c7318490
Capabilities:
Create directory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x1c73184d0
call fcn.1c73c8a10
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.msvcrt.dll__errno]
mov edi, dword [rax]
cmp edi, 0x11
je 0x1c73184f8
call fcn.1c73c8a20
mov dword [rbx], edi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rdx, rbx
mov rcx, rsi
call fcn.1c739c8b0
cmp al, 2
jne 0x1c73184dd
xor eax, eax
jmp 0x1c73184ea
Function at 0x1c739b8f0
Capabilities:
Get common file path

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
xor r11d, r11d
mov rdi, qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r12, [rsp + 0x40]
mov rbp, rdx
mov rbx, rcx
mov edx, 0x400
mov qword [rsp + 0x30], r12
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x38], 0
mov word [rsp + 0x40], r11w
nop dword [rax]
xor r8d, r8d
mov rcx, rsi
call fcn.1c73d6880
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
call rdi
mov edx, eax
cmp qword [rsp + 0x38], rdx
jb 0x1c739b930
mov qword [rsp + 0x28], rdx
test eax, eax
je 0x1c739ba00
call fcn.1c73c8a10
mov rdx, qword [rsp + 0x28]
xor edi, edi
mov dword [rbp], edi
xor r8d, r8d
mov rcx, rsi
mov qword [rbp + 8], rax
call fcn.1c73d6880
mov rax, qword [rsp + 0x30]
lea rcx, [rbx + 0x10]
mov rdi, qword [rsp + 0x38]
mov qword [rbx], rcx
cmp rax, r12
je 0x1c739ba70
mov qword [rbx], rax
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rdi
lea rdi, [rbx + 0x20]
xor r10d, r10d
mov rcx, rdi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0
mov word [rsp + 0x40], r10w
call fcn.1c73a0970
mov rcx, rbx
call fcn.1c739fc70
mov rcx, qword [rsp + 0x30]
cmp rcx, r12
je 0x1c739b9e8
mov rax, qword [rsp + 0x40]
lea rdx, [rax + rax + 2]
call fcn.1c7421610
mov r9d, dword [rbp]
test r9d, r9d
je 0x1c739ba20
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.1c73c8a10
mov rdx, qword [rsp + 0x28]
jmp 0x1c739b968
mov rdx, rbp
mov rcx, rbx
call fcn.1c739c8b0
mov r8d, dword [rbp]
test r8d, r8d
jne 0x1c739ba90
cmp al, 2
je 0x1c739b9f1
mov rax, qword [rbx]
xor edx, edx
mov qword [rbx + 8], 0
mov rcx, rbx
mov word [rax], dx
call fcn.1c739fc70
call fcn.1c73c8a20
mov dword [rbp], 0x14
mov qword [rbp + 8], rax
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, rdi
add r8, 1
je 0x1c739b9a0
add r8, r8
mov rdx, r12
call sub.msvcrt.dll_memcpy
jmp 0x1c739b9a0
mov rax, qword [rbx]
xor ecx, ecx
mov qword [rbx + 8], 0
mov word [rax], cx
mov rcx, rbx
call fcn.1c739fc70
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1c739c680
Capabilities:
Delete directory
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
call fcn.1c73990c0
test al, al
je 0x1c739c6ce
cmp al, 0xff
je 0x1c739c6e0
mov rdx, rbx
mov rcx, rsi
call fcn.1c739c8b0
cmp al, 2
je 0x1c739c6f8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1c739c705
mov eax, dword [rbx]
test eax, eax
jne 0x1c739c6ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.1c73c8a10
mov dword [rbx], esi
mov qword [rbx + 8], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.1c73c8a10
mov dword [rbx], 0
mov qword [rbx + 8], rax
jmp 0x1c739c6ce
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x1c739c6a8
call fcn.1c73c8a10
mov dword [rbx], 0
mov qword [rbx + 8], rax
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1c739c770
Capabilities:
Move file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rbp, rcx
mov rdx, r8
mov rbx, r8
mov rcx, rsi
call fcn.1c739c8b0
mov rdi, rax
cmp al, 0xff
je 0x1c739c7d0
mov ecx, dword [rbx]
test ecx, ecx
jne 0x1c739c7c3
test al, al
jne 0x1c739c7e8
mov rdx, qword [rsi]
mov rcx, qword [rbp]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1c739c830
call fcn.1c73c8a10
mov dword [rbx], 0
mov qword [rbx + 8], rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.1c73c8a10
mov dword [rbx], 0
mov qword [rbx + 8], rax
jmp 0x1c739c79d
mov rdx, rbx
mov rcx, rbp
call fcn.1c739c8b0
mov edx, dword [rbx]
test edx, edx
jne 0x1c739c7c3
cmp dil, 2
je 0x1c739c818
cmp al, 2
jne 0x1c739c79d
call fcn.1c73c8a20
mov dword [rbx], 0x14
mov qword [rbx + 8], rax
jmp 0x1c739c7c3
cmp al, 2
je 0x1c739c79d
call fcn.1c73c8a20
mov dword [rbx], 0x15
mov qword [rbx + 8], rax
jmp 0x1c739c7c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x1c739c865
call rdi
mov dword [rax], 5
call fcn.1c73c8a20
mov rsi, rax
call rdi
mov eax, dword [rax]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call rdi
mov dword [rax], 0xd
jmp 0x1c739c84a

Function at 0x1c73a4300
Capabilities:
Get disk size

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, qword [rsp + 0x90]
mov rdi, rdx
mov rbp, r8
mov rsi, r9
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x28]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1c73a4398
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1c73a435a
mov qword [rdi], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1c73a4368
mov qword [rbp], rax
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x1c73a4390
call fcn.1c73c8a10
xor esi, esi
mov dword [rbx], esi
mov qword [rbx + 8], rax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rsi], rax
jmp 0x1c73a4372
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.1c73c8a10
mov dword [rbx], esi
mov qword [rbx + 8], rax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1c73a92a0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1c73a92e8
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1c73a92ba
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1c73ebf40
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x1c73ebf98
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x1c73ebf70
and edx, 7
je 0x1c73ebfcd
sub edx, 1
movsxd rax, edx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r11 + rax]
shl rdx, 8
sub rax, 1
add rdx, rcx
test eax, eax
jns 0x1c73ebfa8
xor rdx, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rdx
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret
Function at 0x1c742a4a0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, rcx
call fcn.1c7421770
mov rax, qword [rbx - 0x10]
mov rcx, qword [rbx - 0x40]
mov rbp, qword [rbx - 0x18]
movsxd rsi, dword [rbx - 0x24]
mov qword [rsp + 0x30], rax
mov rdi, qword [rbx - 0x38]
call fcn.1c7309a30
mov rcx, rax
jmp 0x1c742a310
call fcn.1c7421770
call fcn.1c74219d0
mov rbx, qword [rax]
test byte [rbx + 0x50], 1
je 0x1c742a397
mov rbx, qword [rbx]
lea r12, [rsp + 0x20]
mov rdx, rbp
xor ecx, ecx
mov r8, r12
call fcn.1c7307ea0
mov rdx, qword [rbx - 0x90]
mov r9, rsi
mov r8, rbx
mov rcx, r12
call fcn.1c7307f90
test al, al
jne 0x1c742a3b5
lea rbx, [0x1c7445100]
mov r9, rsi
xor r8d, r8d
mov rcx, r12
mov rdx, rbx
call fcn.1c7307f90
test al, al
je 0x1c742a3ba
mov ecx, 8
call fcn.1c7421700
lea r8, [0x1c73afb20]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x1c743fdf0]
add rax, 0x10
mov qword [rcx], rax
call fcn.1c7421c90
add rbx, 0x90
jmp 0x1c742a326
call fcn.1c7421c40
mov rcx, rdi
call fcn.1c7309a10
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
mov rcx, rax
call fcn.1c7421770
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.1c7337b40
mov ecx, 8
call fcn.1c7421700
lea r8, [0x1c73377f0]
lea rdx, [0x1c7443810]
mov rcx, rax
lea rax, [0x1c7454f80]
mov qword [rcx], rax
call fcn.1c7421c90
call fcn.1c7337b70
mov rcx, qword [0x1c7431bc0]
mov rbx, rax
call fcn.1c72fdad2
test eax, eax
je 0x1c742a43c
call fcn.1c7337b70
mov rcx, rbx
call fcn.1c72eb120
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call fcn.1c7337b40
call fcn.1c7337b70
call fcn.1c7337ba0
nop
call fcn.1c7337b40
call fcn.1c7337b70
call fcn.1c7337ba0
nop
mov ecx, 8
call fcn.1c7421700
lea r8, [fcn.1c73ea950]
lea rdx, [0x1c7445e60]
mov rcx, rax
mov rax, qword [0x1c7440100]
add rax, 0x10
mov qword [rcx], rax
call fcn.1c7421c90
nop
nop
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1c742a51c
call fcn.1c7421770
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sub.msvcrt.dll_fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sub.msvcrt.dll_fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sub.msvcrt.dll_fputc
call fcn.1c74218a0
call sub.msvcrt.dll_abort
mov rcx, rdi
call fcn.1c72fb8c0
call fcn.1c7421c40
call fcn.1c7421770
call fcn.1c74218a0
jmp 0x1c742a50a