joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c22d0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push r12
sub rsp, 0x260
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r12, rcx
test rcx, rcx
jne 0x1800c22fa
xor eax, eax
jmp 0x1800c24b3
mov qword [rsp + 0x278], rbx
mov qword [rsp + 0x280], rbp
mov qword [rsp + 0x258], rsi
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x248], r13
lea rcx, [rsp + 0x22]
mov qword [rsp + 0x240], r14
xor r14d, r14d
xor edx, edx
mov r8d, 0x206
mov ebx, 1
mov word [rsp + 0x20], r14w
call fcn.18004a760
lea rcx, [rsp + 0x20]
mov r8d, 0x103
mov rdx, r12
call fcn.18004a580
mov r13d, 0x5c
lea rcx, [rsp + 0x20]
mov edx, r13d
call fcn.18004ba34
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov rsi, rax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x1800c23c2
cmp word [rsp + 0x20], r13w
jne 0x1800c23c2
cmp word [rsp + 0x22], r13w
jne 0x1800c23c2
lea rcx, [rsp + 0x24]
mov edx, r13d
call fcn.18004ba34
test rax, rax
je 0x1800c2441
lea rcx, [rax + 2]
mov edx, r13d
call fcn.18004ba34
mov rsi, rax
test rsi, rsi
je 0x1800c2441
nop word [rax + rax]
lea rcx, [rsp + 0x20]
mov word [rsi], r14w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
mov edi, eax
and ebp, 0x10
jne 0x1800c240d
test al, 1
je 0x1800c23fc
mov edx, eax
lea rcx, [rsp + 0x20]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
je 0x1800c2481
cmp edi, 0xffffffff
je 0x1800c2416
test ebp, ebp
jne 0x1800c2425
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x1800c2481
lea rcx, [rsi + 2]
mov edx, r13d
mov word [rsi], r13w
call fcn.18004ba34
mov rsi, rax
test rax, rax
jne 0x1800c23d0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800c2474
test al, 0x10
jne 0x1800c2481
test al, 1
je 0x1800c2465
and eax, 0xfffffffe
mov rcx, r12
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
je 0x1800c2481
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
mov r14, qword [rsp + 0x240]
mov r13, qword [rsp + 0x248]
mov rdi, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x258]
mov rbp, qword [rsp + 0x280]
mov eax, ebx
mov rbx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x260
pop r12
ret
Function at 0x1800c24d0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x1800c2504
lea ecx, [rbx + 0x57]
mov dword [0x180157be0], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1800c252a
test al, 0x10
jne 0x1800c256a
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1800c256a
mov rcx, rbx
call fcn.1800c2100
test eax, eax
jne 0x1800c256a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180157be0], eax
test eax, eax
je 0x1800c255d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x1800c2579
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800c2590
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x1800c25c4
lea ecx, [rbx + 0x57]
mov dword [0x180157be0], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800c25ea
test al, 0x10
jne 0x1800c262a
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800c262a
mov rcx, rbx
call fcn.1800c22d0
test eax, eax
jne 0x1800c262a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180157be0], eax
test eax, eax
je 0x1800c261d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x1800c2639
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800c49e0
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1800c4a09
lea ecx, [rbx + 0x57]
mov dword [0x180157be0], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x1800c4860]
lea edx, [r9 + 0x20]
call fcn.1800c2b50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebx, eax
test eax, eax
jne 0x1800c4a5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180157be0], eax
test eax, eax
je 0x1800c4a5a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800c4a70
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1800c4a99
lea ecx, [rbx + 0x57]
mov dword [0x180157be0], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x1800c4920]
lea edx, [r9 + 0x20]
call fcn.1800c2cc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
test eax, eax
jne 0x1800c4aea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180157be0], eax
test eax, eax
je 0x1800c4aea
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800c6200
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18004a760
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1800bf664
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.1800bf330
jmp 0x1800bf66a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180157be0], eax
test eax, eax
je 0x1800bf67e
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x1800bf600
Function at 0x1800c6550
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.180078ab0
test eax, eax
je 0x1800bfb2d
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.1800bf9a0
jmp 0x1800bfba4
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18004a760
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1800bfb83
lea rdx, [0x1800f5fb0]
lea rcx, [rsp + 0x20]
mov r8d, 0x103
call fcn.1800cb880
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.1800bf330
jmp 0x1800bfb89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180157be0], eax
test eax, eax
je 0x1800bfb9d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x1800bfaf0

Function at 0x1800c67d0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18004a760
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x1800c68e6
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x1800c6856
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.1800bf0f0
test eax, eax
je 0x1800c68d2
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.18004a760
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800c5d50
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800c68d2
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18004a5e0
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.1800bf330
jmp 0x1800c68ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x180157be0], eax
test eax, eax
je 0x1800c6902
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800c67d0
Function at 0x1800c76c0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18004a760
lea rdx, [rsp + 0x20]
lea rcx, [0x18010dd08]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800c77cc
lea rcx, [rsp + 0x20]
call fcn.1800bf0f0
test eax, eax
je 0x1800c77b3
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18004a760
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800c5d50
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800c77ab
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18004a5e0
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800bf330
mov eax, 1
jmp 0x1800c77ce
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800c76c0

Function at 0x1800c7930
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18004a760
lea rdx, [rsp + 0x20]
lea rcx, [0x18010dd38]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800c7a3c
lea rcx, [rsp + 0x20]
call fcn.1800bf0f0
test eax, eax
je 0x1800c7a23
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18004a760
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800c5d50
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800c7a1b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18004a5e0
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800bf330
mov eax, 1
jmp 0x1800c7a3e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800c7930
Function at 0x1800c9540
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18004a760
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x1800c68e6
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x1800c6856
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.1800bf0f0
test eax, eax
je 0x1800c68d2
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.18004a760
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800c5d50
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800c68d2
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18004a5e0
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.1800bf330
jmp 0x1800c68ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x180157be0], eax
test eax, eax
je 0x1800c6902
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800c67d0

Function at 0x1800c99c0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18004a760
lea rdx, [rsp + 0x20]
lea rcx, [0x18010dd08]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800c77cc
lea rcx, [rsp + 0x20]
call fcn.1800bf0f0
test eax, eax
je 0x1800c77b3
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18004a760
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800c5d50
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800c77ab
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18004a5e0
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800bf330
mov eax, 1
jmp 0x1800c77ce
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800c76c0
Function at 0x1800c9a80
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18004a760
lea rdx, [rsp + 0x20]
lea rcx, [0x18010dd38]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800c7a3c
lea rcx, [rsp + 0x20]
call fcn.1800bf0f0
test eax, eax
je 0x1800c7a23
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18004a760
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800c5d50
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800c7a1b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18004a5e0
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800bf330
mov eax, 1
jmp 0x1800c7a3e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800c7930
Function at 0x1800c9e80
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x180157d3c]
test ecx, ecx
jne 0x1800ca040
mov eax, dword [0x180157d38]
cmp eax, 3
ja 0x1800ca040
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x180157d38], eax
call fcn.180078b30
test eax, eax
je 0x1800c9ec6
lea rcx, str.wtsapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1800c9ed3
lea rcx, [0x18010e1b8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800c9ee5
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.WTSOpenServerA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSOpenServerW
mov rcx, rbx
mov qword [0x180157cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSCloseServer
mov rcx, rbx
mov qword [0x180157cd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSFreeMemory
mov rcx, rbx
mov qword [0x180157cd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSEnumerateSessionsA
mov rcx, rbx
mov qword [0x180157ce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSEnumerateSessionsW
mov rcx, rbx
mov qword [0x180157ce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSTerminateProcess
mov rcx, rbx
mov qword [0x180157cf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSEnumerateProcessesA
mov rcx, rbx
mov qword [0x180157cf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSEnumerateProcessesW
mov rcx, rbx
mov qword [0x180157d00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSSendMessageA
mov rcx, rbx
mov qword [0x180157d08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSSendMessageW
mov rcx, rbx
mov qword [0x180157d10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSQuerySessionInformationA
mov rcx, rbx
mov qword [0x180157d18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSQuerySessionInformationW
mov rcx, rbx
mov qword [0x180157d20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTSWaitSystemEvent
mov rcx, rbx
mov qword [0x180157d28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x180157d30], rax
mov dword [0x180157d3c], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1800ca1a0
Capabilities:
Get disk information

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
cmp eax, 1
jne 0x1800ca305
test rbx, rbx
je 0x1800ca305
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x280], rdi
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
cmp ecx, 2
jle 0x1800ca2fd
movzx eax, word [rbx + 2]
cmp ax, 0x3a
jne 0x1800ca232
movabs rax, 0x5c003a0041
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
movzx eax, word [rbx]
mov word [rsp + 0x20], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
jmp 0x1800ca2fd
cmp word [rbx], 0x5c
jne 0x1800ca2fd
cmp ax, 0x5c
jne 0x1800ca2fd
mov qword [rsp + 0x278], rbp
mov qword [rsp + 0x250], r12
mov r12d, 0x5c
lea rcx, [rbx + 4]
mov edx, r12d
call fcn.18004ba34
mov rbp, rax
test rax, rax
je 0x1800ca2ed
xor eax, eax
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], ax
call fcn.18004a760
lea rcx, [rbp + 2]
mov edx, r12d
call fcn.18004ba34
test rax, rax
je 0x1800ca2bd
sub rax, rbx
sar rax, 1
lea ecx, [rax + 1]
cmp ecx, 0x104
jge 0x1800ca2ed
movsxd r8, ecx
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.18004a580
jmp 0x1800ca2e0
lea eax, [rdi + 1]
cmp eax, 0x104
jge 0x1800ca2ed
movsxd rdi, edi
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, rdi
call fcn.18004a580
mov word [rsp + rdi*2 + 0x30], r12w
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
mov rbp, qword [rsp + 0x278]
mov r12, qword [rsp + 0x250]
mov rdi, qword [rsp + 0x280]
mov eax, esi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18004ac60
add rsp, 0x258
pop rsi
pop rbx
ret

Function at 0x1800ca3e0
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x48
xor eax, eax
mov dword [rdx], eax
test rcx, rcx
je 0x1800ca40e
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov r9, rdx
mov qword [rsp + 0x28], rax
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add rsp, 0x48
ret

Function at 0x1800ca680
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x180132920]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.18003ce00
test rbx, rbx
je 0x1800ca711
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], 0
call fcn.18004a760
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov ebx, eax
call fcn.1800395f0
mov eax, ebx
jmp 0x1800ca713
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18004ac60
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret