joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001ed00
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor esi, esi
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x20], esi
cmp rdx, rsi
jne 0x18001ed54
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], rsi
xor r8d, r8d
mov word [rcx + 8], si
lea rdx, [0x18006c858]
jmp 0x18001ee44
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jle 0x18001ed83
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rsi
xor r8d, r8d
mov word [rbx + 8], si
lea rdx, [0x18006c858]
jmp 0x18001ee41
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x40e
mov word [rsp + 0x30], si
call fcn.18004a190
xor r9d, r9d
lea rdx, [rsp + 0x30]
lea r8d, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [rsp + 0x30], si
je 0x18001ed64
lea rdx, str.projone
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, esi
je 0x18001edf5
xor r8d, r8d
lea rcx, [rsp + 0x30]
lea edx, [r8 + 6]
call fcn.1800377cc
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.180036e08
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rcx, [0x18006c858]
mov qword [rbx + 0x20], 7
cmp eax, esi
mov qword [rbx + 0x18], rsi
lea rdx, [rsp + 0x30]
cmove rdx, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov word [rbx + 8], si
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.180003158
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180047b20
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18001f21c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
lea rax, [r11 + 8]
lea r9, [r11 + 0x10]
lea r8, str.offlineMode
mov qword [r11 - 0x10], rax
lea rax, [r11 + 0x18]
lea rdx, [0x18006cf90]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [r11 - 0x18], rax
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ecx, ecx
cmp eax, ecx
jne 0x18001f26b
cmp dword [rsp + 0x48], 4
jne 0x18001f26b
mov ecx, dword [rsp + 0x50]
mov eax, ecx
add rsp, 0x38
ret
Function at 0x18001faa4
Capabilities:
Check if file exists

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x150
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
mov eax, InitCommonControls
mov qword [rsp + 0x70], rax
xor esi, esi
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x58], sil
mov qword [r11 - 0xc0], rax
mov qword [r11 - 0xc8], rsi
mov byte [rsp + 0x80], sil
mov qword [r11 - 0x98], rax
mov qword [r11 - 0xa0], rsi
mov byte [rsp + 0xa8], sil
mov qword [r11 - 0x70], rax
mov qword [r11 - 0x78], rsi
mov byte [rsp + 0xd0], sil
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x50], rsi
mov byte [r11 - 0x60], sil
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rsi
mov byte [r11 - 0x38], sil
lea rcx, [rsp + 0x28]
call fcn.18001f3c8
nop
cmp qword [rax + 0x20], 8
jb 0x18001fb57
mov rbx, qword [rax + 8]
jmp 0x18001fb5b
lea rbx, [rax + 8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, esi
jne 0x18001fb6f
mov ebx, 2
jmp 0x18001fb7e
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18001f41c
mov ebx, eax
cmp qword [rsp + 0x48], 8
jb 0x18001fb90
mov rcx, qword [rsp + 0x30]
call fcn.180048114
cmp ebx, esi
jne 0x18001fbac
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, rdi
call fcn.1800029c8
nop
lea rcx, [rsp + 0x50]
call fcn.18001fbe0
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180047b20
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180036968
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xae8
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rax, qword [rsp + 0xb30]
mov rdi, rcx
mov rcx, qword [rsp + 0xb38]
mov qword [rsp + 0x48], rcx
xor ecx, ecx
mov qword [rsp + 0x38], r9
mov rbp, r8
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x40], rax
cmp rdi, rcx
je 0x180036b84
cmp r8, rcx
jne 0x1800369c8
cmp rax, rcx
je 0x180036b84
cmp word [rdi + 2], 0x3a
je 0x180036a1f
cmp word [rdi + 2], 0x5c
je 0x180036a1f
mov word [rsp + 0x6c0], cx
lea rcx, [rsp + 0x6c2]
xor edx, edx
mov r8d, 0x40e
call fcn.18004a190
lea rdx, [rsp + 0x6c0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x6c0]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdi, [rsp + 0x6c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180036b84
test al, 0x10
je 0x180036b84
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x1800717f8]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180036b84
mov ebx, 1
lea rdx, [0x18006edac]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180036b5b
lea rdx, [0x1800717fc]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180036b5b
cmp dword [rsp + 0x50], 0xffffffff
je 0x180036b5b
lea rcx, [rsp + 0x2a0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [rsp + 0x50], 0x10
je 0x180036b43
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180036b10
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x2a0]
call rax
test eax, eax
je 0x180036b72
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x180036b5b
mov rdx, qword [rsp + 0x48]
mov r9, qword [rsp + 0x38]
mov r8, rbp
mov qword [rsp + 0x28], rdx
mov edx, ecx
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
call fcn.180036968
cmp eax, 2
jmp 0x180036b59
test rbp, rbp
je 0x180036b5b
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x2a0]
call rbp
test eax, eax
je 0x180036b72
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x180036b77
jmp 0x180036a84
mov ebx, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x180036b86
xor eax, eax
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.180047b20
add rsp, 0xae8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180036ba4
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0x740
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x730], rax
mov rbp, rdx
mov rbx, rcx
mov qword [r11 - 0x6c0], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
lea ecx, [r12 + 8]
call fcn.180048210
cmp rax, r12
je 0x180036c06
lea rcx, [rsp + 0x30]
mov qword [rax], rcx
jmp 0x180036c09
mov rax, r12
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.180013588
mov qword [rsp + 0x60], rax
mov byte [rax + 0x41], 1
mov rax, qword [rsp + 0x60]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rax], rax
mov rax, qword [rsp + 0x60]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x68], r12
cmp rbp, r12
jne 0x180036c6c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1800226f0
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
call fcn.180021cac
mov rax, rbx
jmp 0x180036ddd
mov rdx, rbp
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..________.dirty
lea rcx, [rsp + 0x520]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180036dbb
lea rdx, [0x18006edac]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x180036d98
lea rdx, [0x1800717fc]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x180036d98
cmp dword [rsp + 0xc0], 0xffffffff
je 0x180036d98
mov rdx, rbp
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xec]
lea rcx, [rsp + 0x310]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], r12
mov word [rsp + 0x78], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x310]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x70]
call fcn.180003158
nop
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x30]
call fcn.180022a80
nop
cmp qword [rsp + 0x90], 8
jb 0x180036d98
mov rcx, qword [rsp + 0x78]
call fcn.180048114
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r12d
jne 0x180036cb5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1800226f0
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
call fcn.180021cac
mov rax, rbx
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.180047b20
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180036e08
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor edi, edi
mov rbx, rcx
cmp rcx, rdi
je 0x180036f16
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x180036f16
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], di
call fcn.18004a190
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180037d7c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180036e87
shr eax, 4
not eax
and eax, 1
jmp 0x180036f18
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x250]
call fcn.180036f3c
cmp eax, edi
je 0x180036f16
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x180036ef4
mov ecx, 1
cmp rax, 0xffffffffffffffff
jne 0x180036ef6
mov ecx, edi
cmp cl, dil
mov ebx, edi
setne bl
cmp rax, 0xffffffffffffffff
je 0x180036f12
cmp rax, rdi
je 0x180036f12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x180036f18
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180047b20
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret
Function at 0x1800375d8
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2070
call fcn.18005d3b0
sub rsp, rax
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor esi, esi
mov rbx, rdx
mov rdi, rcx
cmp rcx, rsi
je 0x1800377a5
cmp rdx, rsi
je 0x1800377a5
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
jne 0x180037630
mov esi, 1
jmp 0x1800377a5
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov rdi, rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rdi, rsi
je 0x18003777d
cmp rdi, 0xffffffffffffffff
je 0x18003777d
cmp rax, rsi
je 0x18003777d
cmp rax, 0xffffffffffffffff
je 0x180037791
xor eax, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
je 0x1800376e8
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
je 0x1800376e8
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x50], rax
je 0x1800376f6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18003779c
mov dword [rsp + 0x40], esi
jmp 0x18003774c
mov r8d, dword [rsp + 0x40]
cmp r8d, esi
je 0x180037773
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x1060]
mov rcx, rbx
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
je 0x1800376e8
mov eax, dword [rsp + 0x40]
cmp eax, dword [rsp + 0x44]
jne 0x1800376e8
lea rdx, [rsp + 0x1060]
lea rcx, [rsp + 0x60]
mov r8, rax
call fcn.180053a60
cmp eax, esi
jne 0x1800376e8
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
jne 0x1800376fc
jmp 0x1800376e8
mov esi, 1
jmp 0x1800376e8
cmp rax, 0xffffffffffffffff
je 0x180037791
cmp rax, rsi
je 0x180037791
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 0xffffffffffffffff
je 0x1800377a5
cmp rdi, rsi
je 0x1800377a5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.180047b20
lea r11, [rsp + 0x2070]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800377cc
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov esi, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800377f2
xor eax, eax
jmp 0x180037803
or eax, esi
not edi
mov rcx, rbx
and eax, edi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800378dc
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov ebp, r8d
mov r12, rdx
mov rdi, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
test eax, eax
jne 0x180037915
xor edx, edx
mov rcx, rdi
call fcn.180036e08
test eax, eax
je 0x1800379c1
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x1800379a0
cmp rax, 0xffffffffffffffff
je 0x1800379a0
and dword [rsp + 0x78], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebp
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180037983
cmp dword [rsp + 0x78], ebp
jne 0x180037983
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1800379c3
test esi, esi
jne 0x1800379ad
mov rcx, rbx
or rbx, 0xffffffffffffffff
cmp rcx, rbx
je 0x1800379a4
test rcx, rcx
je 0x1800379a4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800379a4
test esi, esi
jne 0x1800379ad
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp rbx, 0xffffffffffffffff
je 0x1800379c1
test rbx, rbx
je 0x1800379c1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret

Function at 0x180037cec
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x21]
xor ebx, ebx
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], bl
call fcn.18004a190
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.180037bdc
mov r11d, 0x179b06cc
movzx edx, byte [rsp + rbx + 0x20]
movzx eax, r11b
mov ecx, r11d
xor rdx, rax
shr ecx, 8
lea rax, [0x18008cd80]
mov r11d, dword [rax + rdx*4]
inc rbx
xor r11d, ecx
cmp rbx, 0x24
jl 0x180037d34
not r11d
mov eax, r11d
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180047b20
add rsp, 0x140
pop rbx
ret
Function at 0x180037e68
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r12d, r12d
mov rsi, rdx
mov rdi, rcx
cmp rdx, r12
je 0x180037f4a
lea rdx, str.deviceMup_
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, rdi
jne 0x180037ed3
lea r8, [0x1800718ac]
lea rdx, str.deviceMup_
mov r9, rsi
mov rcx, rdi
call fcn.180039ae8
mov eax, 1
jmp 0x180037f4c
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, r12d
mov ebp, eax
bt ebp, ebx
jae 0x180037f43
lea ecx, [rbx + 0x61]
mov eax, 0x3a
xor edx, edx
mov word [rsp + 0x20], cx
mov word [rsp + 0x22], ax
xor eax, eax
lea rcx, [rsp + 0x32]
mov r8d, 0x206
mov word [rsp + 0x30], r12w
mov dword [rsp + 0x24], eax
call fcn.18004a190
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, r12d
jbe 0x180037f43
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rdi
call fcn.180039c14
cmp eax, r12d
jne 0x180037f74
inc ebx
cmp ebx, 0x1a
jl 0x180037ede
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180047b20
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
jmp 0x180037ec1

Function at 0x1800387f4
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov ebx, ecx
mov rdi, rdx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x434
call fcn.18004a190
mov edx, ebx
mov ecx, 8
mov dword [rsp + 0x20], 0x438
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
test rax, rax
je 0x18003887d
cmp rax, 0xffffffffffffffff
je 0x180038891
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
jmp 0x180038879
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.180039064
test eax, eax
je 0x18003887d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x18003885b
cmp rbx, 0xffffffffffffffff
je 0x180038891
test rbx, rbx
je 0x180038891
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180047b20
mov rbx, qword [rsp + 0x490]
add rsp, 0x470
pop rdi
ret
Function at 0x1800388b4
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18008a090]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x18003894f
cmp rax, 0xffffffffffffffff
je 0x18003894f
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.18004a190
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x18003894f
mov rdx, rsi
lea rcx, [rsp + 0x30]
call rdi
test eax, eax
je 0x18003894f
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180038930
cmp rbx, 0xffffffffffffffff
je 0x180038963
test rbx, rbx
je 0x180038963
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180047b20
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180038988
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
xor ebx, ebx
mov rdi, rcx
cmp rcx, rbx
jne 0x1800389a6
xor eax, eax
jmp 0x180038a30
xor edx, edx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x70], WSAGetLastError
lea r8d, [rdx + 0x60]
call fcn.18004a190
xor eax, eax
mov rcx, rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
call fcn.18003691c
xor r9d, r9d
xor r8d, r8d
mov rdi, rax
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
je 0x180038a25
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.180048828
mov rax, rbx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret
Function at 0x180038b78
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x110
mov rsi, rcx
call fcn.180038a44
xor edi, edi
lea rcx, [0x180038d44]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], edi
mov dword [rsp + 0x70], edi
cmp rcx, rdi
je 0x180038d2c
lea rdx, [rsp + 0x68]
call fcn.1800388b4
cmp dword [rsp + 0x70], edi
je 0x180038d2c
mov r8d, dword [rsp + 0x6c]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
cmp rax, rdi
je 0x180038d18
cmp rax, 0xffffffffffffffff
je 0x180038d2c
lea r8, [rsp + 0x60]
mov edx, 0xf01ff
mov rcx, rax
mov qword [rsp + 0x60], rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, edi
je 0x180038d0a
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x78], rdi
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
cmp eax, edi
je 0x180038cff
mov rcx, rsi
call fcn.18003691c
lea r8d, [rdi + 0x60]
lea rcx, [rsp + 0xa8]
xor edx, edx
mov dword [rsp + 0xa0], WSAGetLastError
mov rsi, rax
call fcn.18004a190
mov rcx, qword [rsp + 0x60]
lea eax, [rdi + 5]
mov word [rsp + 0xe0], ax
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xa0]
mov r8, rsi
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x420
xor edx, edx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0xdc], 1
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, edi
je 0x180038cec
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.180048828
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
jmp 0x180038d2e
cmp rax, 0xffffffffffffffff
je 0x180038d2c
cmp rax, rdi
je 0x180038d2c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret