joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800372d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, r9d
mov rdi, rdx
cmp rax, r9
je 0x1800372ec
mov eax, 0x80070057
jmp 0x18003735a
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x28], r9d
mov r9d, r8d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x180037358
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x180037342
test byte [rcx + 0x1c], 1
je 0x180037342
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078208]
mov edx, 0x18
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1800013c4
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
test eax, eax
jns 0x180037358
lfence
jmp 0x18003735a
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180038240
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x18003825d
xor eax, eax
jmp 0x1800382ba
call fcn.180035b20
mov ebx, eax
cmp eax, 0x800700b7
je 0x1800382a4
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x1800382a0
test byte [rcx + 0x1c], 1
je 0x1800382a0
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078320]
mov edx, 0x1e
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1800013c4
mov eax, ebx
jmp 0x1800382ba
mov rcx, rdi
call fcn.180038828
test eax, eax
jns 0x1800382b5
lfence
jmp 0x1800382ba
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800385ac
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2f]
sub rsp, 0xe0
xor r13d, r13d
mov r12d, r8d
cmp word [rdx], 0x22
mov ebx, r13d
mov qword [rbp + 0x4f], rbx
mov rsi, rdx
mov r15, rcx
je 0x180038682
lea edx, [r13 + 0x2e]
mov rcx, rsi
call fcn.180062e6c
mov rdi, rax
test rax, rax
je 0x180038692
movzx eax, word [rsi]
mov r14, rsi
jmp 0x180038624
movzx ecx, ax
call fcn.180053d50
test eax, eax
jne 0x180038629
add r14, 2
movzx eax, word [r14]
test ax, ax
jne 0x180038610
cmp r14, rdi
ja 0x180038692
jmp 0x180038640
movzx ecx, ax
call fcn.180053d50
test eax, eax
jne 0x180038648
add rdi, 2
movzx eax, word [rdi]
test ax, ax
jne 0x180038630
mov rax, rdi
sub rax, rsi
sar rax, 1
test eax, eax
jns 0x18003865c
mov edi, 0x80070057
jmp 0x1800386bd
lfence
mov r9, rsi
mov qword [rsp + 0x20], rdi
mov r8d, eax
lea rdx, str.__.ls__ls
lea rcx, [rbp + 0x4f]
call fcn.1800363e0
mov rbx, qword [rbp + 0x4f]
mov edi, eax
jmp 0x180038685
mov edi, r13d
test edi, edi
js 0x18003877d
test rbx, rbx
jne 0x1800386ba
lfence
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rsi + rdx*2], r13w
jne 0x180038699
inc rdx
lea rcx, [rbp + 0x4f]
mov r8, rsi
call fcn.1800131a4
mov rbx, qword [rbp + 0x4f]
mov edi, eax
jmp 0x1800386bd
mov edi, r13d
test edi, edi
js 0x18003877d
xor eax, eax
lea rcx, [rbp - 0x65]
xorps xmm0, xmm0
mov qword [rbp - 0x79], rax
xor edx, edx
movups xmmword [rsp + 0x50], xmm0
lea r8d, [rax + 0x64]
call fcn.180042350
lea rax, [rsp + 0x50]
mov dword [rbp - 0x69], 0x68
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x69]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rdx, rbx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x180038763
call fcn.180035b20
mov edi, eax
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x18003877d
test byte [rcx + 0x1c], 1
je 0x18003877d
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078320]
mov edx, 0x1f
mov dword [rsp + 0x20], edi
mov r9, rbx
call fcn.1800013c4
jmp 0x18003877d
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180038772
call fcn.180035c64
mov rax, qword [rsp + 0x50]
mov edi, r13d
mov qword [r15], rax
test rbx, rbx
je 0x18003878a
mov rcx, rbx
call fcn.180040d20
lea r11, [rsp + 0xe0]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800388a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, dword [rdx]
mov rdi, r8
mov rsi, rdx
mov r8d, ebx
mov rdx, rdi
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov r9d, eax
test eax, eax
jne 0x180038914
call fcn.180035b20
mov ebx, eax
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x180038910
test byte [rcx + 0x1c], 1
je 0x180038910
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078320]
mov edx, 0x29
mov dword [rsp + 0x20], ebx
mov r9, rbp
call fcn.1800013c4
mov eax, ebx
jmp 0x180038936
cmp r9d, ebx
ja 0x18003892a
lea eax, [r9 - 1]
cmp word [rdi + rax*2], dx
je 0x180038931
mov eax, 0x8000ffff
jmp 0x180038936
test ebx, ebx
je 0x180038931
mov word [rdi], dx
mov qword [rsi], r9
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180038a78
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x180038ae8
call fcn.180035b20
mov ebx, eax
test rdi, rdi
jne 0x180038aaa
cmp eax, 0x800700cb
je 0x180038ae8
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x180038ae4
test byte [rcx + 0x1c], 1
je 0x180038ae4
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078320]
mov edx, 0x2b
mov dword [rsp + 0x28], ebx
mov r9, rsi
mov qword [rsp + 0x20], rdi
call fcn.18001f938
mov eax, ebx
jmp 0x180038aea
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180038afc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov esi, dword [rdx]
xor ecx, ecx
mov r14, r8
mov r15, rdx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, esi
lea rcx, str.__COMPAT_LAYER
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ebp, ebp
mov ebx, eax
test eax, eax
jne 0x180038ba8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x180038ba8
mov eax, 0x800700cb
lfence
cmp edi, eax
je 0x180038bcf
mov rax, qword [0x18008d218]
lea rcx, [0x18008d218]
cmp rax, rcx
je 0x180038ba4
test byte [rax + 0x1c], 1
je 0x180038ba4
lfence
mov rcx, qword [0x18008d218]
lea edx, [rbp + 0x2c]
lea r9, str.__COMPAT_LAYER
mov dword [rsp + 0x20], edi
lea r8, [0x180078320]
mov rcx, qword [rcx + 0x10]
call fcn.1800013c4
mov eax, edi
jmp 0x180038bcf
cmp ebx, esi
jae 0x180038bba
cmp word [r14 + rbx*2], bp
je 0x180038bba
mov eax, 0x8000ffff
jmp 0x180038bcf
inc ebx
cmp ebx, esi
jbe 0x180038bc8
test esi, esi
je 0x180038bc8
mov word [r14], bp
mov eax, ebx
mov qword [r15], rax
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180038f44
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180038fad
call fcn.180035b20
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x180038fa9
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x180038fa9
test byte [rcx + 0x1c], 1
je 0x180038fa9
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078320]
mov edx, 0x2e
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1800013c4
mov eax, ebx
jmp 0x180038fb1
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180038fbc
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edx, 0x80
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x180039020
call fcn.180035b20
mov ebx, eax
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x18003901c
test byte [rcx + 0x1c], 1
je 0x18003901c
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078320]
mov edx, 0x2f
mov dword [rsp + 0x28], ebx
mov r9, rdi
mov dword [rsp + 0x20], 0x80
call fcn.180035b64
mov eax, ebx
jmp 0x180039022
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180039030
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x18003904b
xor eax, eax
jmp 0x180039094
call fcn.180035b20
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x180039092
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x180039092
test byte [rcx + 0x1c], 1
je 0x180039092
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078320]
mov edx, 0x30
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1800013c4
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call 0x180039030
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x18003914c
cmp eax, 0x80070005
jne 0x180039151
mov rcx, rbx
call fcn.180038fbc
lfence
test eax, eax
js 0x180039151
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180039030
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1800390a0
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x1800390bb
xor eax, eax
jmp 0x180039104
call fcn.180035b20
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x180039102
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x180039102
test byte [rcx + 0x1c], 1
je 0x180039102
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078320]
mov edx, 0x31
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1800013c4
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call 0x1800390a0
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x180039194
cmp eax, 0x80070005
jne 0x180039199
mov rcx, rbx
call fcn.180038fbc
lfence
test eax, eax
js 0x180039199
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800390a0
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x180039110
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x18003904b
xor eax, eax
jmp 0x180039094
call fcn.180035b20
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x180039092
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x180039092
test byte [rcx + 0x1c], 1
je 0x180039092
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078320]
mov edx, 0x30
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1800013c4
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call 0x180039030
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x18003914c
cmp eax, 0x80070005
jne 0x180039151
mov rcx, rbx
call fcn.180038fbc
lfence
test eax, eax
js 0x180039151
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180039030
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x180039158
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x1800390bb
xor eax, eax
jmp 0x180039104
call fcn.180035b20
mov ebx, eax
lea ecx, [rax + 0x7ff8fffe]
cmp ecx, 1
jbe 0x180039102
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x180039102
test byte [rcx + 0x1c], 1
je 0x180039102
mov rcx, qword [rcx + 0x10]
lea r8, [0x180078320]
mov edx, 0x31
mov dword [rsp + 0x20], ebx
mov r9, rdi
call fcn.1800013c4
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call 0x1800390a0
lea edx, [rax + 0x7ff8fffe]
cmp edx, 1
jbe 0x180039194
cmp eax, 0x80070005
jne 0x180039199
mov rcx, rbx
call fcn.180038fbc
lfence
test eax, eax
js 0x180039199
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800390a0
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x18003b254
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r13
push r14
sub rsp, 0x20
xor ebx, ebx
mov rdi, r9
mov rbp, rdx
test r9, r9
je 0x18003b27d
or dword [r9], 0xffffffff
test rbp, rbp
je 0x18003b3e2
test rdi, rdi
je 0x18003b3e2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r8d, r8d
mov r13d, 0x1b7740
mov r9d, r13d
mov rdx, rbp
mov r14d, eax
lea ecx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
jb 0x18003b38e
lfence
cmp eax, 0x80
je 0x18003b38e
cmp eax, 0x102
je 0x18003b39b
cmp eax, 0xffffffff
jne 0x18003b3db
call fcn.180035b20
mov ecx, eax
mov esi, eax
call fcn.180035a0c
test eax, eax
je 0x18003b3a6
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x18003b323
test byte [rcx + 0x1c], 1
je 0x18003b323
mov rcx, qword [rcx + 0x10]
lea r8, [0x180079220]
mov edx, 0x10
mov r9d, esi
call fcn.180001330
mov r8, rdi
mov rdx, rbp
call fcn.18003ecf8
test eax, eax
js 0x18003b3a2
cmp dword [rdi], 0xffffffff
jne 0x18003b3e7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r14d
cmp eax, r13d
jae 0x18003b39b
mov ecx, r13d
sub ecx, eax
cmp ecx, 0xfa
jb 0x18003b392
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r14d
cmp eax, r13d
jae 0x18003b39b
xor r8d, r8d
mov r9d, r13d
sub r9d, eax
mov rdx, rbp
lea ecx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
jae 0x18003b2bd
mov dword [rdi], eax
jmp 0x18003b3e7
lfence
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 0x80070102
jmp 0x18003b3e7
mov ebx, eax
jmp 0x18003b3e7
mov rcx, qword [0x18008d218]
lea rax, [0x18008d218]
cmp rcx, rax
je 0x18003b3d7
test byte [rcx + 0x1c], 1
je 0x18003b3d7
mov rcx, qword [rcx + 0x10]
lea r8, [0x180079220]
mov edx, 0xf
mov r9d, esi
call fcn.180001330
mov ebx, esi
jmp 0x18003b3e7
mov ebx, 0x8000ffff
jmp 0x18003b3e7
mov ebx, 0x80070057
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop r13
pop rdi
ret
Function at 0x18003f2e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
lea r15, [rcx + 0x10]
mov rdi, rcx
mov rcx, r15
mov esi, r8d
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rdi + 0x90], 0
mov ebp, 1
je 0x18003f33a
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rbx + 0x18]
mov rcx, rbx
xor bpl, bpl
call qword [case.0x180062b2e.0]
jmp 0x18003f403
lea r14, [rdi + 0x78]
mov rax, qword [r14]
cmp qword [rdi + 0x80], rax
jae 0x18003f381
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rdi + 0x9c]
cmp ecx, 0x249f0
jb 0x18003f381
mov rcx, qword [rdi + 0x70]
mov r8, r14
mov rdx, qword [rdi + 0x80]
mov dword [rdi + 0x9c], eax
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x180062b2e.0]
lea rdx, [rdi + 0x38]
cmp qword [rbx], rbx
jne 0x18003f3c7
sub esi, ebp
je 0x18003f3ad
cmp esi, 8
je 0x18003f3a7
mov rax, qword [rdx + 8]
mov qword [rbx], rdx
mov qword [rbx + 8], rax
mov qword [rax], rbx
mov qword [rdx + 8], rbx
jmp 0x18003f3c3
lea rcx, [rdx + 0x20]
jmp 0x18003f3b1
lea rcx, [rdx + 0x10]
mov rax, qword [rcx + 8]
mov qword [rbx], rcx
mov qword [rbx + 8], rax
mov qword [rax], rbx
mov qword [rcx + 8], rbx
add qword [rdx + 0x30], rbp
mov rax, qword [rdi + 0x88]
cmp qword [r14], rax
jae 0x18003f40a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add qword [r14], rbp
mov rcx, r15
mov dword [rdi + 0x9c], eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rdi + 0x70]
xor bpl, bpl
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x180062b2e.0]
test al, al
jne 0x18003f40a
mov ebx, 0x800703e3
jmp 0x18003f40c
xor ebx, ebx
test bpl, bpl
je 0x18003f41a
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180040530
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and qword [rdx], 0
lea rbp, [rcx + 0x28]
mov r14, rdx
mov rsi, rcx
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x180040587
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180040583
call fcn.180035b20
mov edi, eax
cmp eax, 0x80070012
jne 0x180040602
and qword [r14], 0
xor eax, eax
jmp 0x180040648
xor edi, edi
jmp 0x180040602
mov r9, qword [rsi + 0x20]
lea rdx, [0x180073150]
mov r8, qword [rsi + 0x18]
lea rcx, [rsp + 0x40]
and qword [rsp + 0x40], 0
call fcn.1800363e0
mov ebx, eax
test eax, eax
js 0x180040634
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1800405ca
cmp rcx, 0xffffffffffffffff
je 0x1800405c5
call qword [sym.imp.KERNEL32.dll_FindClose]
and qword [rsi + 0x10], 0
mov rbx, qword [rsp + 0x40]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x1800405ef
call fcn.180035b20
mov edi, eax
add eax, 0x7ff8fffe
jmp 0x1800405f5
mov qword [rsi + 0x10], rax
xor edi, edi
test rbx, rbx
je 0x180040602
mov rcx, rbx
call fcn.180040d20
cmp edi, 0x80070012
je 0x180040578
test edi, edi
js 0x18004062d
test byte [rsi + 0x280], 2
je 0x180040625
test byte [rbp], 0x10
jne 0x180040550
mov qword [r14], rbp
jmp 0x18004057c
lfence
mov eax, edi
jmp 0x180040648
lfence
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180040646
call fcn.180040d20
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1800413c8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x180090170], eax
call fcn.1800411fc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180090170], 0
jne 0x18004140b
mov ecx, 1
call fcn.1800411fc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x180061034
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
movsxd r13, ecx
mov rsi, rdx
mov rdi, r13
lea rcx, [0x1800908b0]
and edi, 0x3f
mov r15, r13
sar r15, 6
mov r11d, 0xa
shl rdi, 6
mov rax, qword [rcx + r15*8]
mov r10, qword [rdi + rax + 0x28]
mov qword [rsp + 0x98], r10
test r8, r8
je 0x18006108c
cmp word [rdx], r11w
jne 0x18006108c
or byte [rdi + rax + 0x38], 4
jmp 0x180061091
and byte [rdi + rax + 0x38], 0xfb
lea rbp, [rdx + r8*2]
mov r14, rsi
mov rbx, rsi
cmp rsi, rbp
jae 0x180061262
mov edx, 0xd
lea r8d, [rdx + 0xd]
movzx eax, word [r14]
cmp ax, r8w
je 0x18006123f
lea rcx, [r14 + 2]
cmp ax, dx
je 0x1800610d3
mov word [rbx], ax
mov r14, rcx
add rbx, 2
jmp 0x1800611d1
cmp rcx, rbp
jae 0x1800610fd
cmp word [rcx], r11w
jne 0x1800610e9
movzx eax, r11w
mov ecx, 4
jmp 0x1800610ee
mov ecx, 2
add r14, rcx
mov word [rbx], ax
add rbx, 2
jmp 0x1800611cc
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r14, rcx
lea rdx, [rsp + 0x80]
mov rcx, r10
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180061237
cmp dword [rsp + 0x90], 0
je 0x180061237
mov r8, r13
lea rax, [0x1800908b0]
and r8d, 0x3f
mov r9, r13
sar r9, 6
mov r11d, 0xa
shl r8, 6
mov rax, qword [rax + r9*8]
test byte [rax + r8 + 0x38], 0x48
je 0x1800611df
movzx eax, word [rsp + 0x80]
lea r10, [rbx + 2]
cmp ax, r11w
jne 0x18006117e
mov word [rbx], r11w
jmp 0x1800611bb
mov ecx, 0xd
mov word [rsp + 0x88], ax
mov word [rbx], cx
xor edx, edx
lea rbx, [0x1800908b0]
mov rcx, qword [rbx + r9*8]
mov al, byte [rsp + rdx + 0x88]
add rcx, r8
mov byte [rcx + rdx + 0x3a], al
inc rdx
cmp rdx, 2
jl 0x180061197
mov rax, qword [rbx + r9*8]
mov byte [rax + r8 + 0x3c], r11b
mov rbx, r10
mov r10, qword [rsp + 0x98]
mov r8d, 0x1a
mov edx, 0xd
cmp r14, rbp
jb 0x1800610ad
jmp 0x180061262
cmp word [rsp + 0x80], r11w
jne 0x1800611f9
cmp rbx, rsi
jne 0x1800611f9
mov word [rbx], r11w
add rbx, 2
jmp 0x1800611be
mov rdx, 0xfffffffffffffffe
mov ecx, r13d
lea r8d, [rdx + 3]
call fcn.1800606b0
mov r11d, 0xa
cmp word [rsp + 0x80], r11w
je 0x1800611be
mov r10, qword [rsp + 0x98]
mov edx, 0xd
mov word [rbx], dx
add rbx, 2
lea r8d, [rdx + 0xd]
jmp 0x1800611d1
mov r11d, 0xa
jmp 0x18006121d
lea rax, [0x1800908b0]
mov rcx, qword [rax + r15*8]
mov al, byte [rdi + rcx + 0x38]
test al, 0x40
jne 0x18006125a
or al, 2
mov byte [rdi + rcx + 0x38], al
jmp 0x180061262
mov word [rbx], r8w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret