joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800096e0
Capabilities:
Compute adler32 checksum

Disassembly:
movzx r9d, cx
mov r11d, r8d
shr ecx, 0x10
mov r10, rdx
test rdx, rdx
jne 0x1800096f6
lea eax, [rdx + 1]
ret
test r8d, r8d
je 0x180009841
nop
mov edx, 0x15b0
cmp r11d, edx
cmovb edx, r11d
sub r11d, edx
cmp edx, 0x10
jl 0x1800097ed
mov r8d, edx
shr r8, 4
mov eax, r8d
neg eax
shl eax, 4
add edx, eax
nop dword [rax]
movzx eax, byte [r10]
add r9d, eax
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 8]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 9]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xa]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xb]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xc]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xd]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xe]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xf]
add ecx, r9d
add r10, 0x10
add r9d, eax
add ecx, r9d
sub r8, 1
jne 0x180009730
test edx, edx
je 0x180009812
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r10]
inc r10
add r9d, eax
add ecx, r9d
sub edx, 1
jne 0x180009800
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
test r11d, r11d
jne 0x180009700
shl ecx, 0x10
or ecx, r9d
mov eax, ecx
ret
Function at 0x18000eb30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CSettingsCE.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x10000
jae 0x1800f896f
cmp dword [rcx + 0xe8], 0
jne 0x1800f896f
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.1800ed608
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1800f8cf4
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180012bf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180012c65
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180012c65
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x180012c55
nop
cmp rbx, rcx
jae 0x180012c65
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x180012c40
cmp rbx, rcx
jae 0x180012c65
cmp word [rbx], 0
je 0x180012c65
mov rax, rbx
jmp 0x180012c67
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180014bf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x2d0], rbx
mov rsi, rdx
mov r14, rcx
mov dword [rbp + 0x1e8], 0
call fcn.1800fd458
mov rdx, rax
lea rcx, [rbp + 0x1e0]
call fcn.180038170
nop
cmp byte [0x1803cfad0], 0
jne 0x180014c50
mov ebx, 1
jmp 0x180014e2a
test r14, r14
jne 0x180014c5e
lea ebx, [r14 + 3]
jmp 0x180014e2a
call fcn.1800ed608
cmp qword [rax + 0x18], 0
je 0x180014c75
call fcn.1800ed608
mov rbx, qword [rax + 0x18]
jmp 0x180014c85
mov rbx, qword [0x1803cfb68]
call fcn.1800ed608
mov qword [rax + 0x18], rbx
mov edx, 0x64
lea r8d, [rdx - 0x5f]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
mov rdi, 0xffffffffffffffff
test rsi, rsi
je 0x180014cc8
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.18000d360
nop
lea ebx, [rdi + 2]
jmp 0x180014d5f
mov rcx, r14
call fcn.18002a920
lea rcx, [rax + 0x28]
mov r8d, 0x2da
lea rdx, [rsp + 0x40]
call fcn.18001fa20
nop
lea rcx, [rsp + 0x40]
call fcn.18001cd10
mov rbx, rax
call fcn.1800ed100
mov rcx, rax
test rax, rax
je 0x180014e4f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.18000e8d0
test al, al
jne 0x180014d4b
test rbx, rbx
jne 0x180014d2c
xor eax, eax
jmp 0x180014d3a
mov rax, rdi
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x180014d30
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180012730
nop
lea rcx, [rsp + 0x40]
call fcn.18001c780
lea rax, [rsp + 0x20]
mov ebx, 6
mov dword [rbp + 0x1e8], ebx
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.18000e9d0
add rax, 0x18
mov qword [rsp + 0x28], rax
test bl, 2
je 0x180014dac
and ebx, 0xfffffffd
mov dword [rbp + 0x1e8], ebx
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180014da6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, dword [rbp + 0x1e8]
test bl, 1
je 0x180014dcf
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180014dcf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r9d, r9d
lea r8, [rsp + 0x28]
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.180013200
nop
xor r8d, r8d
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.1800f9204
lea rcx, [rsp + 0x60]
call fcn.1800f8e38
xor ebx, ebx
lea rcx, [rsp + 0x60]
call fcn.1800133c0
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x180014e2a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rbp + 0x1e0]
call fcn.18000eb90
mov eax, ebx
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.18000def0
int3
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.180038d40
mov rcx, rax
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180014bf0
Function at 0x180014f70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x2d0], rbx
mov rsi, rdx
mov r14, rcx
mov dword [rbp + 0x1e8], 0
call fcn.1800fd458
mov rdx, rax
lea rcx, [rbp + 0x1e0]
call fcn.180038170
nop
cmp byte [0x1803cfad0], 0
jne 0x180014c50
mov ebx, 1
jmp 0x180014e2a
test r14, r14
jne 0x180014c5e
lea ebx, [r14 + 3]
jmp 0x180014e2a
call fcn.1800ed608
cmp qword [rax + 0x18], 0
je 0x180014c75
call fcn.1800ed608
mov rbx, qword [rax + 0x18]
jmp 0x180014c85
mov rbx, qword [0x1803cfb68]
call fcn.1800ed608
mov qword [rax + 0x18], rbx
mov edx, 0x64
lea r8d, [rdx - 0x5f]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
mov rdi, 0xffffffffffffffff
test rsi, rsi
je 0x180014cc8
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.18000d360
nop
lea ebx, [rdi + 2]
jmp 0x180014d5f
mov rcx, r14
call fcn.18002a920
lea rcx, [rax + 0x28]
mov r8d, 0x2da
lea rdx, [rsp + 0x40]
call fcn.18001fa20
nop
lea rcx, [rsp + 0x40]
call fcn.18001cd10
mov rbx, rax
call fcn.1800ed100
mov rcx, rax
test rax, rax
je 0x180014e4f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.18000e8d0
test al, al
jne 0x180014d4b
test rbx, rbx
jne 0x180014d2c
xor eax, eax
jmp 0x180014d3a
mov rax, rdi
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x180014d30
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180012730
nop
lea rcx, [rsp + 0x40]
call fcn.18001c780
lea rax, [rsp + 0x20]
mov ebx, 6
mov dword [rbp + 0x1e8], ebx
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.18000e9d0
add rax, 0x18
mov qword [rsp + 0x28], rax
test bl, 2
je 0x180014dac
and ebx, 0xfffffffd
mov dword [rbp + 0x1e8], ebx
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180014da6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, dword [rbp + 0x1e8]
test bl, 1
je 0x180014dcf
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180014dcf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r9d, r9d
lea r8, [rsp + 0x28]
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.180013200
nop
xor r8d, r8d
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.1800f9204
lea rcx, [rsp + 0x60]
call fcn.1800f8e38
xor ebx, ebx
lea rcx, [rsp + 0x60]
call fcn.1800133c0
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x180014e2a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rbp + 0x1e0]
call fcn.18000eb90
mov eax, ebx
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.18000def0
int3
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.180038d40
mov rcx, rax
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180014bf0
Function at 0x180038ca0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdx
test r8, r8
je 0x180038cdc
lea r11, section..data
nop
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx r9d, cx
shr r9, 8
xor r9, rax
movzx eax, cx
shl ax, 8
movzx edx, r9b
movzx ecx, word [r11 + rdx*2]
xor cx, ax
sub r8, 1
jne 0x180038cb0
movzx eax, cx
ret

Function at 0x18003dd40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x38
cmp dword [0x1804d0838], 0
je 0x1800038c2
mov qword [rsp + 0x50], rsi
mov rsi, qword [0x1804d0840]
test rsi, rsi
je 0x180003879
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call sub.WS2_32.dll_WSAGetLastError
mov ecx, dword [rsi]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call sub.WS2_32.dll_WSASetLastError
test rsi, rsi
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
je 0x180003879
cmp dword [rsi + 0x44], 1
jne 0x180003879
mov rcx, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
lea rdx, [rsp + 0x20]
mov qword [rdx], rcx
lea rcx, [rsp + 0x20]
mov qword [rdx + 8], rax
call fcn.1800034e0
mov rax, qword [0x1804d0840]
xor edx, edx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.1800033e0
mov rcx, qword [0x1804d0828]
mov rsi, qword [rsp + 0x50]
test rcx, rcx
je 0x1800038b0
lea rdx, str.QueueUserAPCEx_Fini
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800038a3
call rax
mov rcx, qword [0x1804d0828]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [0x1804d0830]
test rcx, rcx
je 0x1800038c2
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
add rsp, 0x38
ret
jmp 0x1800037e0
Function at 0x18006b780
Capabilities:
Get system information on windows

Disassembly:
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x1d8], rbx
mov rax, qword [0x1803c56a8]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rbx, rcx
lea rdx, str.System_information
lea rcx, [rsp + 0x40]
call fcn.18001c520
nop
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [rax + 0x18]
nop
lea rcx, [rsp + 0x40]
call fcn.18001c780
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
xor edx, edx
mov r8d, 0x11c
lea rcx, [rbp - 0x70]
call fcn.18027b320
mov dword [rbp - 0x70], 0x11c
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18006b91a
mov r10, qword [rbx]
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x64]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbp - 0x68]
mov r8d, dword [rbp - 0x6c]
lea rdx, str.Windows__d._d._d__d___s
mov rcx, rbx
call qword [r10 + LoadRegTypeLib]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x7c]
lea r9, str.IA64
sub eax, 0x182
je 0x18006b8ba
sub eax, 0x64
je 0x18006b8b1
sub eax, 0x64
je 0x18006b8a8
sub eax, 0x64e
je 0x18006b8a3
cmp eax, 0x1940
je 0x18006b89a
lea rdx, str.Unknown_processor
jmp 0x18006b8c1
lea rdx, str.AMD_X8664
jmp 0x18006b8c1
mov rdx, r9
jmp 0x18006b8c1
lea rdx, str.Pentium
jmp 0x18006b8c1
lea rdx, [0x1802d87e8]
jmp 0x18006b8c1
lea rdx, [0x1802d87e0]
movzx ecx, word [rsp + 0x58]
test ecx, ecx
je 0x18006b8f4
sub ecx, 6
je 0x18006b8fb
sub ecx, 3
je 0x18006b8eb
cmp ecx, 1
je 0x18006b8e2
lea r9, str.Unknown_architecture
jmp 0x18006b8fb
lea r9, str.IA32onWIN64
jmp 0x18006b8fb
lea r9, str.AMD64
jmp 0x18006b8fb
lea r9, str.IA32
mov rax, qword [rbx]
mov qword [rsp + 0x20], rdx
mov r8d, dword [rsp + 0x78]
lea rdx, str.Processor:__d_CPU_s___architecture:__s__processor_type:__s
mov rcx, rbx
call qword [rax + LoadRegTypeLib]
jmp 0x18006b945
lea rdx, str.Error_getting_OS_Version
lea rcx, [rsp + 0x40]
call fcn.18001c520
nop
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [rax + 0x68]
nop
lea rcx, [rsp + 0x40]
call fcn.18001c780
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.180277e00
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1c0
pop rbp
ret
Function at 0x180072100
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x490
mov rax, qword [0x1803c56a8]
xor rax, rsp
mov qword [rsp + 0x480], rax
lea rdx, [rsp + 0x20]
mov qword [r9 + 8], 0
mov rdi, r9
mov qword [r9], 0
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180072298
mov qword [rsp + 0x4b8], rbx
movzx edx, word [rsp + 0x4c]
cmp dx, word [0x1802d48a8]
movzx ecx, word [rsp + 0x4e]
jne 0x180072172
cmp cx, word [0x1802d48aa]
je 0x180072262
cmp dx, word [0x1802d48ac]
jne 0x180072196
cmp cx, word [0x1802d48ae]
jne 0x180072196
movzx eax, word [rsp + 0x50]
cmp ax, word [0x1802d48b0]
je 0x180072262
mov edx, 0x5c
mov rcx, rsi
call fcn.18027b544
mov rbx, rax
test rax, rax
je 0x180072202
sub rbx, rsi
lea rcx, [rsp + 0x270]
sar rbx, 1
mov rdx, rsi
lea r8, [rbx + 1]
call fcn.180281a68
lea rdx, [rsp + 0x4c]
lea rax, [rbx + rbx]
sub rax, rdx
lea rcx, [rsp + 0x4c]
lea rdx, [rsp + 0x272]
add rdx, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1800721f0
jmp 0x180072218
movzx ecx, word [rsp + rax + 0x4c]
mov word [rsp + rax + 0x270], cx
lea rax, [rax + 2]
test cx, cx
jne 0x180072202
mov rcx, qword [rdi]
lea rax, [rcx + 1]
mov qword [rdi], rax
lea rdx, [rcx*8 + 8]
mov rax, qword [rdi + 8]
test rax, rax
jne 0x18007223d
mov rcx, rdx
call fcn.1802834dc
jmp 0x180072245
mov rcx, rax
call fcn.18028bf24
lea rcx, [rsp + 0x270]
mov qword [rdi + 8], rax
call fcn.18028bea0
mov rdx, qword [rdi]
mov rcx, qword [rdi + 8]
mov qword [rcx + rdx*8 - 8], rax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180072152
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x4b8]
cmp eax, 0x12
jne 0x180072298
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x18007229d
mov eax, 1
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.180277e00
add rsp, 0x490
pop rdi
pop rsi
pop rbp
ret

Function at 0x180073c50
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
call fcn.18001cd10
mov rcx, rax
add rsp, 0x28
jmp 0x18028c4dc
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18028c4fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18027e60c
or eax, 0xffffffff
jmp 0x18028c500
xor eax, eax
add rsp, 0x28
ret

Function at 0x180073d40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, r8
mov rax, rdx
mov rdi, rcx
test r8, r8
jne 0x180073d65
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 8]
mov edx, 1
mov rcx, rax
mov qword [rsp + 0x30], rsi
call fcn.180289194
mov rsi, rax
cmp rax, rbx
je 0x180073d95
mov rcx, qword [rdi + 8]
call fcn.180288b8c
test eax, eax
mov eax, 0xffffffff
jne 0x180073d97
mov eax, esi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180074090
Capabilities:
Write file on windows

Disassembly:
mov rax, rdx
test r8, r8
jne 0x18007409b
xor eax, eax
ret
mov r9, qword [rcx + 8]
mov edx, 1
mov rcx, rax
jmp fcn.18028b65c
Function at 0x1800896e0
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
sub rsp, 0x20
mov r9, r8
mov r10, rdx
test rdx, rdx
jne 0x180089702
test r8, r8
jne case.0x1800898ad.265
mov al, 1
add rsp, 0x20
pop rbx
ret
test r9, r9
je case.0x1800898ad.265
movzx eax, word [rdx]
movzx r11d, word [r8]
cmp ax, r11w
jne case.0x1800898ad.265
movzx eax, ax
lea rbx, [0x180000000]
mov edx, 0x200
cmp eax, 0x100
ja 0x18008979c
je case.0x180089747.1
cmp eax, 9
ja case.0x1800898ad.265
mov ecx, dword [rbx + rax*4 + 0x89964]
add rcx, rbx
jmp rcx
movzx eax, word [r10 + 0x30]
lea r8d, [rax*8 + 0x38]
jmp 0x180089827
mov r8d, edx
jmp 0x180089827
mov r8d, dword [r10 + 0x108]
add r8d, 0x1b8
jmp 0x180089827
mov eax, dword [r10 + 0x14]
lea r8d, [rax*8 + 0x18]
jmp 0x180089827
mov r8d, dword [r10 + 0x48]
mov eax, dword [r10 + 0x4c]
add r8d, 0xa
lea r8d, [rax + r8*8]
jmp 0x180089827
sub eax, 0x101
cmp eax, 9
ja case.0x1800898ad.265
cdqe
mov ecx, dword [rbx + rax*4 + 0x8998c]
add rcx, rbx
jmp rcx
movzx r8d, byte [r10 + 0x13]
movzx ecx, word [r10 + 0x24]
add r8d, 0x29
add r8d, ecx
and r8d, 0xfffffffc
jmp 0x180089827
mov r8d, reloc.WS2_32.dll_gethostbyname
jmp 0x180089827
mov r8d, 0x24
jmp 0x180089827
mov r8d, dword [r10 + 0xa8]
add r8d, 0xb0
add r8d, dword [r10 + 0xac]
jmp 0x180089827
mov r8d, dword [r10 + 0xd0]
add r8d, 0xd8
add r8d, dword [r10 + 0xd4]
jmp 0x180089827
mov r8d, 0x18
jmp 0x180089827
mov r8d, dword [r10 + 0x24]
add r8d, 0x28
jmp 0x180089827
mov r8d, dword [r10 + 0x14]
add r8d, 0x18
movzx eax, r11w
cmp eax, 0x100
ja 0x180089893
je case.0x18008984b.1
cmp eax, 9
ja case.0x1800898ad.265
mov ecx, dword [rbx + rax*4 + 0x899b4]
add rcx, rbx
jmp rcx
movzx eax, word [r9 + 0x30]
lea edx, [rax*8 + 0x38]
jmp case.0x18008984b.1
mov edx, dword [r9 + 0x108]
add edx, 0x1b8
jmp case.0x18008984b.1
mov eax, dword [r9 + 0x14]
lea edx, [rax*8 + 0x18]
jmp case.0x18008984b.1
mov edx, dword [r9 + 0x48]
mov eax, dword [r9 + 0x4c]
add edx, 0xa
lea edx, [rax + rdx*8]
jmp case.0x18008984b.1
sub eax, 0x101
cmp eax, 9
ja case.0x1800898ad.265
cdqe
mov ecx, dword [rbx + rax*4 + 0x899dc]
add rcx, rbx
jmp rcx
movzx eax, byte [r9 + 0x13]
movzx ecx, word [r9 + 0x24]
lea edx, [rax + 0x29]
add edx, ecx
and edx, 0xfffffffc
jmp case.0x18008984b.1
mov edx, reloc.WS2_32.dll_gethostbyname
jmp case.0x18008984b.1
mov edx, 0x24
jmp case.0x18008984b.1
mov eax, dword [r9 + 0xa8]
lea edx, [rax + 0xb0]
add edx, dword [r9 + 0xac]
jmp case.0x18008984b.1
mov eax, dword [r9 + 0xd0]
lea edx, [rax + 0xd8]
add edx, dword [r9 + 0xd4]
jmp case.0x18008984b.1
mov edx, 0x18
jmp case.0x18008984b.1
mov edx, dword [r9 + 0x24]
add edx, 0x28
jmp case.0x18008984b.1
mov edx, dword [r9 + 0x14]
add edx, 0x18
cmp r8d, edx
jne case.0x1800898ad.265
movzx eax, word [r9 + 2]
cmp word [r10 + 2], ax
jne case.0x1800898ad.265
movzx eax, byte [r9 + 5]
cmp byte [r10 + 5], al
jne case.0x1800898ad.265
movzx eax, word [r9 + 6]
cmp word [r10 + 6], ax
jne case.0x1800898ad.265
sub r8, 0x10
lea rdx, [r9 + 0x10]
lea rcx, [r10 + 0x10]
call fcn.18027b6d0
test eax, eax
jne case.0x1800898ad.265
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x180089fa0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rdi, r8
mov rbx, rcx
mov rcx, qword [rcx + 0x30]
test rcx, rcx
jne 0x18008a010
mov rax, qword [rbx + 0x10]
mov r9d, dword [rax + 4]
mov eax, edx
imul r9, rax
mov qword [r11 + 8], r9
lea rdx, [r11 + 8]
mov rcx, qword [rbx + 0x18]
call fcn.18028b1bc
mov rax, qword [rbx + 0x10]
mov edx, dword [rax + 4]
mov r9, qword [rbx + 0x18]
mov r8d, 1
mov rcx, rdi
call fcn.180289194
cmp rax, 1
sete al
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], 0x800
mov rax, qword [rcx]
mov r8d, 1
lea r9, [rsp + 0x28]
call qword [rax + 0xd8]
test al, al
je 0x18008a046
mov al, 1
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
call qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.180042690
movzx eax, byte [0x1803c2274]
cmp byte [rsp + 0x80], al
jne 0x18008a08f
movzx eax, byte [0x1803c2275]
cmp byte [rsp + 0x81], al
jne 0x18008a08f
movzx eax, byte [0x1803c2276]
cmp byte [rsp + 0x82], al
je 0x18008a09f
xor al, al
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.18001c5f0
nop
mov rcx, qword [rbx + 0x30]
call fcn.180053ce0
mov edx, eax
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.180042670
lea rdx, [0x1803bb358]
lea rcx, [rsp + 0x50]
call fcn.18027b5f8
int3

Function at 0x18008a0e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov edi, r8d
mov rcx, qword [rcx + 0x30]
mov rsi, r9
test rcx, rcx
jne 0x18008a148
mov rax, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov r10d, dword [rax + 4]
mov eax, edx
lea rdx, [rsp + 0x40]
imul r10, rax
mov qword [rsp + 0x40], r10
call fcn.18028b1bc
mov rax, qword [rbx + 0x10]
mov r8d, edi
mov r9, qword [rbx + 0x18]
mov rcx, rsi
mov edx, dword [rax + 4]
call fcn.180289194
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x20]
mov rax, rdi
movzx r8d, di
shl rax, 0xb
mov qword [rsp + 0x28], rax
mov rax, qword [rcx]
call qword [rax + 0xd8]
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
mov rsi, qword [rsp + 0x50]
test al, al
cmovne ecx, edi
mov eax, ecx
add rsp, 0x30
pop rdi
ret