joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400030d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400030fd
xor eax, eax
jmp 0x14000325a
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140003128
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140003128
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14000325a
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000324d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000316b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003196
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003252
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003205
sub eax, 1
je 0x140003205
cmp eax, 2
jne 0x14000324d
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003252
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140003233
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000324d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003252
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004390
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003750
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003823
cmp byte [rcx + 0x71], 0
je 0x140003823
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000381f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400037e4
sub eax, 1
je 0x1400037e8
cmp eax, 2
jne 0x14000381f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004390
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003816
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000381f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400037cc
xor al, al
jmp 0x1400037cc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004390
add rsp, 0x60
pop rbx
ret

Function at 0x140004d24
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004d6e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004d6e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004d6e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004d6e
cmp dword [rcx + 0x84], 0xe
jbe 0x140004d6e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004d70
xor al, al
add rsp, 0x28
ret
Function at 0x180001b00
Capabilities:
Hash data using sha1

Disassembly:
sub rsp, 0x18
xor eax, eax
mov dword [rcx], 0x67452301
cmp qword [0x18014e468], rax
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
jne 0x180001b7a
xor ecx, ecx
mov qword [rsp + 0x10], rbx
cpuid
cmp eax, 7
jl 0x180001b58
xor ecx, ecx
mov eax, 7
cpuid
shr ebx, 0x1d
and bl, 1
jmp 0x180001b5a
xor bl, bl
test bl, bl
lea rax, [0x180003350]
mov rbx, qword [rsp + 0x10]
lea rcx, [0x180001b80]
cmove rax, rcx
mov qword [0x18014e468], rax
add rsp, 0x18
ret
Function at 0x180016f90
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x248
mov rax, qword [0x1801483c0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor r15d, r15d
mov r14d, r9d
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x1800170a3
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], r15w
jne 0x180016fd1
inc rbx
lea rcx, [rbx + rbx]
call fcn.1800db928
mov qword [rdi + 8], rax
test rax, rax
jne 0x180016ffa
mov ebx, 0x1b5a
jmp 0x1800171bc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1800592e0
test rbp, rbp
je 0x18001716b
mov rcx, rbp
cmp dword [rbp], r15d
je 0x18001702f
nop word [rax + rax]
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
cmp dword [rcx], r15d
jne 0x180017020
sub rcx, rbp
lea rbx, [rcx + 8]
test rbx, rbx
je 0x18001716b
lfence
mov rcx, rbx
call fcn.1800db928
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x18001705d
mov ebx, 0x1b5a
jmp 0x1800171bc
lfence
mov r8, rbx
mov rdx, rbp
mov rcx, rax
call fcn.180100680
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x18001716b
mov eax, dword [rcx]
test eax, eax
je 0x18001716b
cmp eax, 2
je 0x180017164
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov eax, dword [rcx]
test eax, eax
jne 0x180017085
jmp 0x18001716b
mov ecx, 0x244
call fcn.1800db928
mov qword [rdi + 8], rax
mov rsi, rax
test rax, rax
je 0x1800171b7
mov rdx, rax
mov ecx, 0x122
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x121
ja 0x1800171aa
lea r9, [rsp + 0x20]
xor r8d, r8d
lea rdx, [0x180121170]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1800171aa
lea rax, [rsp + 0x20]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x180017104
mov edx, 0x122
lea r8, [rsp + 0x20]
mov rcx, rsi
cmp rbx, rdx
jae 0x180017127
call fcn.1800eb8b0
jmp 0x18001713a
mov r9d, 0x121
call fcn.1800eb918
mov word [rsi + 0x242], r15w
test r14b, 2
je 0x18001716b
mov ecx, 0x10
call fcn.1800db928
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x18001715a
mov ebx, 0x1b5a
jmp 0x1800171bc
movups xmm0, xmmword [reloc.OLEAUT32.dll_SysReAllocString]
movups xmmword [rax], xmm0
mov dword [rdi + 0x28], 1
bt r14d, 0xa
jae 0x180017179
mov dword [rdi + 0x2c], 1
bt r14d, 0xb
jae 0x180017187
mov dword [rdi + 0x40], 1
bt r14d, 0x10
jae 0x180017195
mov dword [rdi + 0x44], 1
mov rax, qword [rdi]
mov edx, r14d
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x18001b453.0]
jmp 0x1800171e2
mov rcx, qword [rdi + 8]
call fcn.1800db930
mov qword [rdi + 8], r15
mov ebx, 0x1b5e
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1800171ce
call fcn.1800db930
mov qword [rdi + 8], r15
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x1800171e0
call fcn.1800db930
mov qword [rdi + 0x10], r15
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800d5000
add rsp, 0x248
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180017520
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, r9
mov rbp, r8
mov rdi, rcx
cmp rdx, 0xffffffffffffffff
je 0x180017560
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x18001b453.0]
cmp rax, 0xffffffffffffffff
jne 0x180017560
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [rdi + 0x20]
lea r9, [rsp + 0x58]
mov r8d, r14d
mov qword [rsp + 0x50], rbx
mov rdx, rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rsi, 0xffffffffffffffff
test eax, eax
jne 0x1800175c0
mov rbx, rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180053690
cmp eax, 0x13
jne 0x1800175e0
mov r9, qword [rdi + 0x38]
mov r8, r14
mov rcx, qword [rdi + 0x20]
mov rdx, rbp
call fcn.180054bb0
mov rbx, rax
cmp rax, rsi
je 0x1800175e0
jmp 0x1800175c4
mov ebx, dword [rsp + 0x58]
add qword [rdi + 0x38], rbx
cmp dword [rdi + 0x28], 0
je 0x1800175e0
mov rdx, rbx
mov rcx, rbp
call fcn.18000afd0
cmp rbx, rax
cmovne rbx, rsi
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x180017600
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r14, r8
mov rsi, rcx
cmp rdx, 0xffffffffffffffff
je 0x18001763f
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x18001b453.0]
cmp rax, 0xffffffffffffffff
je 0x1800176ef
xor r15d, r15d
mov edi, r15d
test rbp, rbp
jne 0x180017665
mov rdx, qword [rsi + 0x38]
mov rcx, qword [rsi + 0x20]
call fcn.180054660
sub r15d, eax
neg r15d
sbb rax, rax
jmp 0x18001772e
cmp dword [rsi + 0x28], edi
je 0x1800176f8
mov r12d, 0x10000
cmp qword [rsi + 0x50], rdi
jne 0x180017690
mov ecx, r12d
call fcn.1800db928
mov qword [rsi + 0x50], rax
test rax, rax
je 0x1800176ef
nop dword [rax + rax]
mov rcx, qword [rsi + 0x50]
cmp rbp, r12
mov rbx, rbp
mov rdx, r14
cmovae rbx, r12
mov r8, rbx
call fcn.180100680
mov rcx, qword [rsi + 0x50]
mov rdx, rbx
call fcn.18000b280
cmp rbx, rax
jne 0x1800176ef
mov rdx, qword [rsi + 0x50]
lea r9, [rsp + 0x68]
mov rcx, qword [rsi + 0x20]
mov r8d, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800176ef
mov eax, dword [rsp + 0x68]
add rdi, rax
cmp rax, rbx
jne 0x180017721
add r14, rbx
sub rbp, rbx
jne 0x180017690
jmp 0x180017721
mov rax, 0xffffffffffffffff
jmp 0x18001772e
mov rcx, qword [rsi + 0x20]
lea r9, [rsp + 0x68]
mov r8d, ebp
mov qword [rsp + 0x20], r15
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, 0xffffffffffffffff
test eax, eax
je 0x180017721
mov edi, dword [rsp + 0x68]
cmp rdi, 0xffffffffffffffff
je 0x18001772b
add qword [rsi + 0x38], rdi
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1800177c0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 0x20]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov edi, ebx
test rax, rax
je 0x180017804
lea rdx, [rsp + 0x34]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x18001781e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18001781e
mov ebx, 0xffffffff
jmp 0x180017823
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x18001782a
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call fcn.1800548f0
mov ebx, eax
mov rdi, qword [rsp + 0x30]
mov rax, rdi
test ebx, ebx
je 0x180017831
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x180017bd0
Capabilities:
Set file attributes

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x58
mov rdi, qword [rcx + 8]
test rdi, rdi
je 0x180017ca8
mov ebx, 0xffffffff
test rdx, rdx
je 0x180017c9f
cmp r8, 0x20
jne 0x180017c9f
cmp dword [rdx], 0x4957494e
jne 0x180017c9f
mov rax, qword [rdx + 4]
xor r9d, r9d
mov qword [r11 - 0x28], rax
mov r8d, 3
mov rax, qword [rdx + 0xc]
mov rcx, rdi
mov qword [r11 + 0x10], rbp
mov ebp, dword [rdx + 0x1c]
mov qword [r11 - 0x38], 0
mov qword [r11 + 8], rax
mov rax, qword [rdx + 0x14]
mov edx, 0x100
mov dword [rsp + 0x28], 0x80
mov qword [r11 + 0x20], rax
mov qword [r11 - 0x18], rsi
mov dword [rsp + 0x20], 3
call qword [0x180148138]
mov rsi, rax
test rax, rax
je 0x180017c95
lea r9, [rsp + 0x70]
mov rcx, rax
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rsi
call qword [0x180148118]
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebx, ebx
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x78]
mov eax, ebx
add rsp, 0x58
pop rdi
pop rbx
ret
mov ecx, VariantTimeToDosDateTime
call fcn.180053cf0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xffffffff
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x180017f90
Capabilities:
Delete file
Move file

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x290
mov rax, qword [0x1801483c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r15d, r9d
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x180017fc6
mov eax, 0x1b62
jmp 0x180018125
cmp qword [rcx + 8], 0
jne 0x180017fd7
mov eax, 0x232e
jmp 0x180018125
mov rax, qword [rcx]
mov qword [rsp + 0x2c0], rbx
mov qword [rsp + 0x280], r14
mov rax, qword [rax + 0x20]
call qword [case.0x18001b453.0]
mov r14, qword [rsi + 8]
mov rbx, 0xffffffffffffffff
bt r15d, 9
jae 0x180018065
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x18001804c
mov eax, dword [rcx]
test eax, eax
je 0x18001804c
cmp eax, 1
je 0x18001802c
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov eax, dword [rcx]
test eax, eax
jne 0x180018015
jmp 0x18001804c
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.180016310
test al, al
jne 0x180018047
mov eax, 0x1388
jmp 0x180018115
lea r14, [rsp + 0x20]
mov r8d, 4
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
jmp 0x1800180c3
mov qword [rsp + 0x288], rbp
mov rdx, rdi
mov rcx, r14
mov ebp, ebx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x180018083
xor ebp, ebp
jmp 0x1800180b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800180b6
test r15b, 1
je 0x1800180b6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor ebp, ebp
mov ecx, ebx
test eax, eax
cmovne ecx, ebp
mov ebp, ecx
test ebp, ebp
mov rbp, qword [rsp + 0x288]
sete al
test al, al
je 0x180018101
mov rcx, qword [rsi + 8]
cmp rdi, rcx
je 0x1800180fd
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1800180d0
inc rbx
lea rdx, [rbx + rbx]
call fcn.1800dc220
test rax, rax
je 0x1800180fd
mov r8, rdi
mov qword [rsi + 8], rax
mov rdx, rbx
mov rcx, rax
call fcn.1800592e0
xor eax, eax
jmp 0x180018115
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180053690
mov ecx, eax
call fcn.180019980
mov rbx, qword [rsp + 0x2c0]
mov r14, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800d5000
add rsp, 0x290
pop r15
pop rdi
pop rsi
ret

Function at 0x180018150
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x180018179
mov ecx, 0xd
call fcn.180053cf0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xffffffff
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret
Function at 0x180018280
Capabilities:
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1801483c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rcx]
mov edi, edx
mov rbx, rcx
mov rax, qword [rax + 0x20]
call qword [case.0x18001b453.0]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800182ca
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0xb8]
call qword [case.0x18001b453.0]
movzx esi, al
bt edi, 9
jae 0x180018370
mov rcx, qword [rbx + 0x10]
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x180018334
mov edx, dword [rcx]
test edx, edx
je 0x180018334
nop dword [rax]
cmp edx, 1
je 0x180018317
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov edx, dword [rcx]
test edx, edx
jne 0x180018300
jmp 0x180018334
lea rdx, [rsp + 0x20]
mov rcx, r9
call fcn.180016310
test al, al
jne 0x18001832f
mov eax, 0x1388
jmp 0x18001834b
lea r9, [rsp + 0x20]
xor edx, edx
mov r8d, 4
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x180018389
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800d5000
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rbx]
mov edx, edi
mov rcx, rbx
mov rax, qword [rax + 0xa0]
call qword [case.0x18001b453.0]
test eax, eax
je 0x180018349
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180053690
mov ecx, eax
call fcn.180019980
lea ecx, [rax - 0x2332]
cmp ecx, 1
jbe 0x180018349
test sil, sil
mov ecx, 0x2337
cmovne eax, ecx
jmp 0x18001834b
Function at 0x180019d40
Capabilities:
Hash data using sha256

Disassembly:
bt edx, 0x13
jae 0x180019d4d
mov byte [rcx + 0x248], 1
jmp method.CTempStream.virtual_24
Function at 0x18001e4b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rcx, rbx
mov edx, 5
call fcn.180057bb0
mov r8d, 5
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x18001e50d
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8, qword [rsi + 0x28]
mov rcx, rdi
mov rdx, rax
call fcn.18001f2d0
mov rbx, qword [rsp + 0x40]
xor ecx, ecx
mov rsi, qword [rsp + 0x48]
test rax, rax
setne cl
mov eax, ecx
add rsp, 0x30
pop rdi
ret

Function at 0x18001e5c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0x20]
mov rbx, rcx
test eax, eax
je 0x18001e6b3
movzx ecx, ax
mov edx, 5
call fcn.180057bb0
movzx edx, word [rbx + 0x20]
mov r8d, 5
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x18001e6b3
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
mov esi, eax
call fcn.1800db928
mov rdi, rax
test rax, rax
je 0x18001e6b3
mov r8d, esi
mov rdx, r14
mov rcx, rax
call fcn.180100680
cmp qword [rbx + 0x28], 0
jne 0x18001e674
mov rcx, qword [0x18014efb8]
test rcx, rcx
jne 0x18001e668
xor eax, eax
jmp 0x18001e66c
mov rax, qword [rcx + 8]
mov rax, qword [rax + 8]
mov qword [rbx + 0x28], rax
mov rax, qword [rbx]
lea r8, [rdi + 8]
lea rdx, [rdi + 0xc]
mov rcx, rbx
mov rax, qword [rax + 0x80]
call qword [case.0x18001b453.0]
mov r8, qword [rbx + 0x28]
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call fcn.18001f1e0
mov rcx, rdi
mov rbx, rax
call fcn.1800db930
mov rax, rbx
jmp 0x18001e6ba
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x18001f790
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x18014e45c]
mov rbx, rcx
test eax, eax
je 0x18001f7b6
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x18014e45c]
cmp dword [0x18014e460], 0
jne 0x18001f80f
test eax, eax
jne 0x18001f7cc
call fcn.18001f5c0
test eax, eax
je 0x18001f7e0
mov rcx, qword [0x180148f98]
mov rdx, rbx
call qword [0x180148060]
test eax, eax
jne 0x18001f80f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, 1
jbe 0x18001f805
cmp eax, 0x78
je 0x18001f805
cmp eax, 1
je 0x18001f805
cmp eax, 0x32
je 0x18001f805
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [0x18014e460], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1800215c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r14
sub rsp, 0x30
movzx esi, r9b
mov rdi, r8
mov rbx, rdx
mov r14, rcx
xor eax, eax
mov dword [rsp + 0x20], eax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rdx, [rdi + rdi]
call fcn.18001bca0
mov r8, r14
cmp qword [r14 + 0x18], 7
jbe 0x180021623
mov r8, qword [r14]
test rdi, rdi
je 0x180021685
xor sil, 1
nop dword [rax]
movzx edx, byte [rbx]
shr edx, 4
movzx eax, sil
cmp edx, 0xa
jae 0x180021645
add dx, 0x30
jmp 0x180021653
movzx ecx, ax
shl cx, 5
add cx, 0x37
add dx, cx
mov word [r8], dx
movzx ecx, byte [rbx]
and ecx, 0xf
cmp ecx, 0xa
jae 0x180021668
add cx, 0x30
jmp 0x180021673
shl ax, 5
add cx, 0x37
add cx, ax
mov word [r8 + 2], cx
add r8, 4
inc rbx
sub rdi, 1
jne 0x180021630
mov rax, r14
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x180028010
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rax, vtable.FileIStream.0
mov qword [rcx], rax
lea rax, [0x1801491d8]
mov rcx, qword [0x1801491d8]
cmp rcx, rax
je 0x180028074
test byte [rcx + 0x1c], 0x10
je 0x180028074
cmp byte [rcx + 0x19], 0xb
jb 0x180028074
mov edx, VariantTimeToDosDateTime
mov eax, dword [rbx + 8]
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x180123200]
mov rcx, qword [rcx + 0x10]
call fcn.180027e90
lea rcx, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lfence
xor ebp, ebp
mov dword [rbx + 0x58], ebp
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x180028099
call qword [0x180148118]
mov qword [rbx + 0x60], rbp
lea rdi, [rbx + 0x10]
mov dword [rdi + 0x58], ebp
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1800280b3
call qword [0x180148118]
mov qword [rbx + 0x70], rbp
mov dword [rbx + 0x78], ebp
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x1800280cf
call qword [0x180148118]
mov qword [rbx + 0x80], rbp
mov dword [rbx + 0x88], ebp
mov rcx, qword [rbx + 0x90]
test rcx, rcx
je 0x1800280ee
call qword [0x180148118]
mov qword [rbx + 0x90], rbp
mov dword [rbx + 0x98], ebp
mov rcx, qword [rbx + 0xa0]
test rcx, rcx
je 0x18002810d
call qword [0x180148118]
mov qword [rbx + 0xa0], rbp
cmp qword [rbx + 0x20], rbp
je 0x18002813d
cmp byte [rbx + 0xd], bpl
je 0x18002812c
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x180028126
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rdi + 0x10], rbp
cmp qword [rdi + 0x18], 7
jbe 0x18002813a
mov rdi, qword [rdi]
mov word [rdi], bp
lea rcx, [rbx + 0x10]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
jmp fcn.180013d40