joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800587b0
Capabilities:
Encode data using base64

Disassembly:
push rdi
push r14
push r15
mov r14, r9
mov r15, r8
mov edi, edx
mov r11, rcx
test edx, edx
je 0x18005893c
lea ecx, [rdx*8]
mov eax, 0x2aaaaaab
imul ecx
lea ecx, [rdi*8]
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 2
je 0x1800587fb
cmp ecx, 4
jne 0x1800587fe
add edx, 2
jmp 0x1800587fe
add edx, 3
inc edx
cmp dword [r9], edx
jge 0x180058813
mov dword [r9], edx
mov eax, 0xfffffff0
pop r15
pop r14
pop rdi
ret
mov qword [rsp + 0x20], rbx
mov eax, 0x55555556
imul edi
xor ebx, ebx
mov qword [rsp + 0x28], rbp
mov eax, edx
mov qword [rsp + 0x38], r12
shr eax, 0x1f
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_0123456789abcdef
add edx, eax
mov ebp, ebx
mov rcx, r15
lea edx, [rdx + rdx*2]
test edx, edx
jle 0x1800588c8
dec edx
mov qword [rsp + 0x30], rsi
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
mov esi, edx
lea ebp, [rdx + rdx*2]
movzx r10d, byte [r11 + 2]
movzx r9d, byte [r11 + 1]
movzx r8d, byte [r11]
mov edx, r9d
shr edx, 4
mov eax, r8d
shr rax, 2
add r11, 3
shl r8d, 4
add edx, r8d
and edx, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx], al
movzx eax, byte [rdx + r12]
mov byte [rcx + 1], al
mov eax, r10d
shr eax, 6
and r10d, 0x3f
lea edx, [rax + r9*4]
and edx, 0x3f
movzx eax, byte [rdx + r12]
mov byte [rcx + 2], al
movzx eax, byte [r10 + r12]
mov byte [rcx + 3], al
add rcx, 4
sub rsi, 1
jne 0x180058860
mov rsi, qword [rsp + 0x30]
cmp ebp, edi
jge 0x180058922
movzx r8d, byte [r11]
inc ebp
cmp ebp, edi
jge 0x1800588db
movzx ebx, byte [r11 + 1]
mov edx, ebx
mov rax, r8
shr edx, 4
shr rax, 2
shl r8d, 4
add edx, r8d
and edx, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx], al
movzx eax, byte [rdx + r12]
mov byte [rcx + 1], al
cmp ebp, edi
jge 0x180058914
and ebx, 0xf
shl ebx, 2
movzx eax, byte [rbx + r12]
mov byte [rcx + 2], al
jmp 0x180058918
mov byte [rcx + 2], 0x3d
add rcx, 3
mov byte [rcx], 0x3d
inc rcx
mov r12, qword [rsp + 0x38]
mov eax, ecx
mov rbp, qword [rsp + 0x28]
sub eax, r15d
mov rbx, qword [rsp + 0x20]
mov dword [r14], eax
mov byte [rcx], 0
xor eax, eax
pop r15
pop r14
pop rdi
ret
Function at 0x180058950
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
xor ebx, ebx
movsxd rbp, edx
xor r11d, r11d
xor r10d, r10d
mov r14, r9
mov r15, r8
mov rdi, rcx
test edx, edx
jle 0x180058a8c
mov rsi, rcx
lea r12, [0x18029c2b0]
neg rsi
mov rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x3d
jne 0x1800589a6
inc r11d
cmp r11d, 2
jg 0x1800589f9
cmp al, 0x7f
ja 0x1800589f9
movzx eax, al
movzx ecx, byte [rax + r12]
cmp cl, 0x7f
je 0x1800589f9
cmp cl, 0x40
jae 0x1800589c1
test r11d, r11d
jne 0x1800589f9
inc rdx
inc ebx
inc r10d
lea rax, [rsi + rdx]
cmp rax, rbp
jl 0x180058996
test ebx, ebx
je 0x180058a8c
lea eax, [rbx + rbx*2]
lea eax, [rax*2 + 7]
sar eax, 3
cmp dword [r9], eax
jge 0x180058a03
mov dword [r9], eax
mov eax, 0xfffffff0
jmp 0x180058a8e
mov eax, 0xffffffee
jmp 0x180058a8e
xor r8d, r8d
xor r11d, r11d
mov r9d, 3
mov rax, r15
test r10d, r10d
jle 0x180058a86
nop word [rax + rax]
movzx ecx, byte [rdi]
movzx edx, byte [rcx + r12]
xor ecx, ecx
cmp dl, 0x40
sete cl
and edx, 0x3f
sub r9d, ecx
inc r11d
mov ecx, r8d
mov r8d, edx
shl ecx, 6
or r8d, ecx
cmp r11d, 4
jne 0x180058a7b
xor r11d, r11d
test r9d, r9d
jle 0x180058a5e
mov ecx, r8d
shr ecx, 0x10
mov byte [rax], cl
inc rax
cmp r9d, 1
jle 0x180058a6f
mov ecx, r8d
shr ecx, 8
mov byte [rax], cl
inc rax
cmp r9d, 2
jle 0x180058a7b
mov byte [rax], r8b
inc rax
dec r10d
inc rdi
test r10d, r10d
jg 0x180058a20
sub eax, r15d
mov dword [r14], eax
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret

Function at 0x180058ac0
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov byte [rcx + 0x89], 0
xor eax, eax
mov qword [rcx + 0x10], rax
mov rbx, rcx
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x180058aff
mov rdx, qword [rdx]
call fcn.180058b10
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x18005e360
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x9a0]
sub rsp, 0xaa0
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x990], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.180233580
cmp qword [rdi + 0x58], 8
lea r8, [rdi + 0x40]
jb 0x18005e3ae
mov r8, qword [r8]
lea r9, [0x1802abd08]
lea rdx, [0x1802abd18]
lea rcx, [rsp + 0x40]
call fcn.18005c530
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18005e3df
lea rcx, [rsp + 0x40]
call fcn.1800675f0
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x208
call fcn.180233580
lea r9, str.UseVestige.ini
lea r8, [rsp + 0x40]
lea rdx, [0x1802abef8]
lea rcx, [rbp + 0x150]
call fcn.18005c530
xor ebx, ebx
cmp word [rbp + 0x150], bx
jne 0x18005e422
mov r8d, ebx
jmp 0x18005e43a
lea rax, [rbp + 0x150]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x18005e430
lea rcx, [rdi + 0xc0]
lea rdx, [rbp + 0x150]
call fcn.18005c660
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x208
call fcn.180233580
lea r9, str.Cache.ini
lea r8, [rsp + 0x40]
lea rdx, [0x1802abef8]
lea rcx, [rbp + 0x360]
call fcn.18005c530
cmp word [rbp + 0x360], bx
jne 0x18005e48e
mov r8, rbx
jmp 0x18005e4aa
lea rax, [rbp + 0x360]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x18005e4a0
lea rcx, [rdi + 0xe0]
lea rdx, [rbp + 0x360]
call fcn.18005c660
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x208
call fcn.180233580
lea rdx, str.ShxlPath
lea rcx, [rsp + 0x20]
call fcn.180067a80
cmp qword [rax + 0x18], 8
jb 0x18005e4ec
mov rax, qword [rax]
mov r8, rax
lea rdx, [0x1802abd74]
lea rcx, [rbp + 0x570]
call fcn.18005c530
mov r8, qword [rsp + 0x38]
cmp r8, 8
jb 0x18005e51f
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
inc r8
call fcn.18005cac0
lea rcx, [rbp + 0x570]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18005e53c
lea rcx, [rbp + 0x570]
call fcn.1800675f0
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x208
call fcn.180233580
lea r9, str.Cache.ini
lea r8, [rbp + 0x570]
lea rdx, [0x1802abef8]
lea rcx, [rbp + 0x780]
call fcn.18005c530
cmp word [rbp + 0x780], bx
je 0x18005e58f
lea rax, [rbp + 0x780]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18005e585
lea rcx, [rdi + 0x100]
mov r8, rbx
lea rdx, [rbp + 0x780]
call fcn.18005c660
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0xaa0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18005f4b0
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x880
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x8b0], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rdx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.180233580
lea rax, [rsi + 0xc0]
cmp qword [rax + 0x18], 8
jb 0x18005f512
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x70]
lea rbp, str.guanf
mov r8, rbp
lea rdx, str.Spreader
lea rcx, str.AppInfo
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
cmp qword [rdi + 0x18], 8
jb 0x18005f55a
mov rax, qword [rdi]
jmp 0x18005f55d
mov rax, rdi
mov word [rax], bx
cmp word [rsp + 0x70], bx
jne 0x18005f56c
mov r8, rbx
jmp 0x18005f57f
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x18005f575
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.18005c660
mov dword [rsp + 0x30], 1
cmp qword [rdi + 0x18], 8
jb 0x18005f5a0
mov rcx, qword [rdi]
jmp 0x18005f5b0
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx + rbx*2]
inc rbx
cmp ax, word [rbp + rbx*2 - 2]
jne 0x18005f619
cmp rbx, 6
jne 0x18005f5b0
mov qword [rsp + 0x20], rbp
lea r9, str.Spreader
lea r8, str.AppInfo
lea rdx, [rsp + 0x48]
cmp byte [rsi + 9], 0
je 0x18005f5ec
mov rcx, rsi
call fcn.18005f940
jmp 0x18005f5f1
call fcn.18005f900
mov rdx, rax
mov rcx, rdi
call fcn.18005bc10
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x18005f619
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.18005cac0
mov rax, rdi
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x8b0]
add rsp, 0x880
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005f640
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x790]
sub rsp, 0x890
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov edi, r9d
mov rbx, r8
mov rsi, rcx
lea r9, [rcx + 0xc0]
cmp qword [r9 + 0x18], 8
jb 0x18005f68a
mov r9, qword [r9]
mov r8d, edi
mov rdx, rbx
lea rcx, [0x1802abe90]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
jne 0x18005f80e
mov qword [rsp + 0x50], 7
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor r8d, r8d
lea rdx, [0x1802abc2c]
lea rcx, [rsp + 0x38]
call fcn.18005c660
nop
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call fcn.180233580
mov r8d, edi
lea rdx, [0x1802abc24]
lea rcx, [rbp - 0x80]
call fcn.18005c530
lea rax, [rbp - 0x80]
mov r9, rbx
lea r8, [0x1802abe90]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rax
cmp byte [rsi + 9], r14b
je 0x18005f769
mov rcx, rsi
call fcn.18005f940
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x18005f767
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x18005f745
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.18005cac0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.18005c590
nop
jmp 0x18005f7ba
call fcn.18005f900
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x18005f7ba
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x18005f798
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.18005cac0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.18005c590
nop
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x18005f7d7
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.18005cac0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.18023b52c
mov ebx, eax
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x18005f80c
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.18005cac0
mov eax, ebx
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x890
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180064870
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x660
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x650], rax
mov rdi, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call fcn.180233580
xor edx, edx
lea rcx, [rsp + 0x440]
mov r8d, 0x208
call fcn.180233580
lea rcx, [rsp + 0x230]
mov rdx, rsi
sub rcx, rsi
nop dword [rax]
movzx eax, word [rdx]
mov word [rcx + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x1800648d0
lea rdx, [rsp + 0x440]
mov rcx, rdi
sub rdx, rdi
nop
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1800648f0
lea rcx, [rsp + 0x230]
call fcn.18023b948
lea rcx, [rsp + 0x440]
call fcn.18023b948
lea rax, [rsp + 0x230]
lea r8, [rsp + 0x440]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180064944
add rax, 2
test ecx, ecx
jne 0x180064930
test edx, edx
je 0x180064a0b
mov qword [rsp + 0x680], rbx
xor ebx, ebx
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.180233580
lea rcx, [rsp + 0x20]
mov r8, rdi
test ebx, ebx
jne 0x18006498c
lea rdx, str._s.bak
call fcn.18005c530
jmp 0x18006499b
mov r9d, ebx
lea rdx, str._s.bak_d
call fcn.18005c530
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800649b5
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.18023b704
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 5]
test eax, eax
jne 0x1800649fd
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp ebx, 0xa
jge 0x180064a03
inc ebx
jmp 0x180064960
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rbx, qword [rsp + 0x680]
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.1802037a0
mov rsi, qword [rsp + 0x688]
add rsp, 0x660
pop rdi
ret
Function at 0x1800664a0
Capabilities:
Check if file exists

Disassembly:
push rdi
mov eax, 0x1270
call fcn.180204780
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x1290], rbx
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x1260], rax
mov rbx, rdx
mov edi, ecx
cmp qword [0x180341d30], 0
jne 0x1800665d0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.180233580
movups xmm0, xmmword [str.C:LogResLog64.dll]
movaps xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [0x1802ac248]
movaps xmmword [rsp + 0x60], xmm1
movsd xmm0, qword [0x1802ac258]
movsd qword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800665b9
lea r8, [0x180344568]
cmp qword [0x180344580], 8
cmovae r8, qword [0x180344568]
lea rdx, [rsp + 0x28]
call fcn.180066670
nop
mov r8d, 0xc
lea rdx, [0x1802ac1b8]
lea rcx, [rsp + 0x28]
call fcn.18005ffc0
lea rcx, [rsp + 0x28]
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x40]
cmp r8, 8
cmovae rcx, r9
lea rdx, [rsp + 0x50]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x180066590
cmp r8, 8
jb 0x1800665b9
inc r8
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.18005cac0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180341d30], rax
test rax, rax
je 0x18006663f
xor r8d, r8d
lea rdx, [0x1802abc2c]
mov rcx, rbx
call fcn.18005c660
mov r9d, 0x800
lea r8, [rsp + 0x260]
mov edx, edi
mov rcx, qword [0x180341d30]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x18006663f
cmp word [rsp + 0x260], 0
jne 0x180066613
xor r8d, r8d
jmp 0x18006662b
lea rax, [rsp + 0x260]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180066620
lea rdx, [rsp + 0x260]
mov rcx, rbx
call fcn.18005c660
mov al, 1
jmp 0x180066641
xor al, al
mov rcx, qword [rsp + 0x1260]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x1290]
add rsp, 0x1270
pop rdi
ret
Function at 0x180066a90
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push rsi
push rdi
mov eax, 0x2288
call fcn.180204780
sub rsp, rax
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x2270], rax
mov rdi, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.180233580
lea r8, [0x1802abf08]
lea rdx, str.C:log_s.log
lea rcx, [rsp + 0x60]
call fcn.18005c530
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180066c46
mov qword [rsp + 0x22b0], rbx
xor ecx, ecx
mov qword [rsp + 0x2280], rbp
call fcn.18023b61c
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.18023d344
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rbx]
lea rdx, str.__d__d__d__d__d__d___d_:_s
mov r9d, dword [rbx + 0x10]
mov r8d, dword [rbx + 0x14]
inc r9d
mov qword [rsp + 0x48], rdi
add r8d, 0x76c
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rbx + 4]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rbx + 8]
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x270]
mov dword [rsp + 0x20], eax
call fcn.180066cd0
mov rcx, rsi
xor edi, edi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebp, 1
lea rdx, [0x1802ac1d8]
test eax, eax
mov rcx, rsi
cmovne edi, ebp
call fcn.1802396d4
mov rbx, rax
test rax, rax
je 0x180066c36
test edi, edi
jne 0x180066bbf
mov eax, 0xfeff
lea r8d, [rbp + 1]
mov r9, rbx
mov word [rsp + 0x54], ax
mov edx, ebp
lea rcx, [rsp + 0x54]
call fcn.180239d64
lea rcx, [rsp + 0x270]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x180066bd0
add eax, eax
lea rcx, [rsp + 0x270]
movsxd r8, eax
mov r9, rbx
mov rdx, rbp
call fcn.180239d64
mov eax, 0xd
lea rcx, [rsp + 0x50]
mov r9, rbx
mov word [rsp + 0x50], ax
mov rdx, rbp
lea r8d, [rax - 0xb]
call fcn.180239d64
mov eax, 0xa
lea rcx, [rsp + 0x50]
mov r9, rbx
mov word [rsp + 0x50], ax
mov rdx, rbp
lea r8d, [rax - 8]
call fcn.180239d64
mov rcx, rbx
call fcn.180239ab8
mov rbx, qword [rsp + 0x22b0]
mov rbp, qword [rsp + 0x2280]
mov rcx, qword [rsp + 0x2270]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x2288
pop rdi
pop rsi
ret
Function at 0x1800675f0
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
or r8, 0xffffffffffffffff
mov rbx, rcx
mov rdi, r8
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x180067610
lea eax, [rdi + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.180203f3c
mov rsi, rax
sub rax, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x180067640
xor r14d, r14d
movsxd rdi, edi
mov ebx, r14d
lea ebp, [r14 + 1]
test rdi, rdi
js 0x1800676af
mov qword [rsp + 0x40], r15
mov r15d, 0x5c
nop dword [rax]
cmp word [rsi + rbx*2], r15w
jne 0x18006769d
mov rcx, rsi
mov word [rsi + rbx*2], r14w
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180067698
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1800676a7
mov word [rsi + rbx*2], r15w
inc rbx
cmp rbx, rdi
jle 0x180067670
jmp 0x1800676aa
mov ebp, r14d
mov r15, qword [rsp + 0x40]
mov rcx, rsi
call fcn.180085310
mov rbx, qword [rsp + 0x48]
mov eax, ebp
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1800679e0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
cmp qword [rcx + 0x18], 8
jb 0x180067a10
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180067a2f
cmp qword [rbx + 0x18], 8
jb 0x180067a26
mov rcx, qword [rbx]
jmp 0x180067a29
mov rcx, rbx
call fcn.180064120
nop
mov r8, qword [rbx + 0x18]
cmp r8, 8
jb 0x180067a47
inc r8
mov rdx, qword [rbx]
mov rcx, rbx
call fcn.18005cac0
xor eax, eax
mov qword [rbx + 0x18], 7
cmp qword [rbx + 0x18], 8
mov qword [rbx + 0x10], rax
jb 0x180067a5f
mov rbx, qword [rbx]
mov word [rbx], ax
mov eax, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x40
pop rbx
ret
Function at 0x180067eb0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x248
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x230], rax
movzx eax, byte [0x180344a51]
test al, al
jne 0x180067f62
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.180233580
mov r9d, 1
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x180067f5b
lea rcx, [rsp + 0x20]
call fcn.18023b948
lea rdx, [0x1802ac2c8]
lea rcx, [rsp + 0x20]
call fcn.180232988
test rax, rax
jne 0x180067f3b
lea rdx, str.documents_and_settingslocalservice
lea rcx, [rsp + 0x20]
call fcn.180232988
test rax, rax
je 0x180067f5b
mov al, 1
mov byte [0x180344a51], al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x248
ret
movzx eax, byte [0x180344a51]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1802037a0
add rsp, 0x248
ret

Function at 0x180067f80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov edi, r8d
mov rsi, rdx
xor bl, bl
call fcn.180067eb0
mov ebp, 1
test al, al
je 0x180067fff
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
call fcn.180068030
test al, al
je 0x180067fff
mov r8, qword [rsp + 0x40]
mov r9d, ebp
mov edx, edi
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmove ebx, ebp
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x180067fff
movzx eax, bl
jmp 0x18006801b
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
movzx ecx, bl
cmovne ecx, ebp
movzx eax, cl
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180068120
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
mov r8d, 0x1a
lea rdx, [rsp + 0x20]
mov rsi, rcx
call fcn.180067f80
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x180068166
test eax, eax
je 0x18006822a
lea rcx, [rsp + 0x20]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180068181
mov eax, dword [0x1802abc78]
lea rdx, [rsp + 0x20]
sub rdx, 2
mov dword [rcx], eax
nop dword [rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x1800681a0
xor r8d, r8d
nop
movzx ecx, word [rdi + r8*2]
mov word [rdx + r8*2], cx
lea r8, [r8 + 1]
test cx, cx
jne 0x1800681b0
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1800681d0
mov dword [rcx], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800681f6
lea rcx, [rsp + 0x20]
call fcn.1800675f0
cmp word [rsp + 0x20], 0
jne 0x180068202
xor ebx, ebx
jmp 0x18006821a
lea rax, [rsp + 0x20]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180068210
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.18005c660
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret