joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180033f60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x180112440]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x60], rdx
mov rdx, qword [rdx]
add rdx, 8
lea rcx, [rsp + 0x68]
call fcn.1800170b0
nop
lea rdx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0x10
cmovae rdx, qword [rsp + 0x68]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x180033ff3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180033fe0
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0xf0]
call fcn.1800394f0
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x180034019
mov rcx, qword [rsi + 0xf8]
lea r8, [rsp + 0x68]
cmp rcx, qword [rsi + 0xf8]
jne 0x180034102
lea rdx, [rsp + 0x40]
lea rcx, [rsi + 0xf0]
call fcn.180038fe0
mov rcx, qword [rax]
add rcx, 0x30
mov rdx, rdi
call fcn.180025160
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x180034088
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180034083
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800340fc
call fcn.180085560
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0xf
mov byte [rsp + 0x68], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1800340d7
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1800340d7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1800340d7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180085510
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1800a889c
nop
lea rdx, str.logger_with_name_
lea rcx, [rsp + 0x20]
call fcn.180007520
nop
lea r8, str._already_exists
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180007c70
mov rcx, rax
call fcn.180016690
int3
Function at 0x180039b90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x180112440]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rbx, rdx
mov rdi, rcx
mov rsi, qword [rdx + 0x18]
mov r14, qword [rcx + 0x90]
cmp rsi, r14
jl 0x180039ca9
movabs rax, 0xd6bf94d5e57a42bd
imul rsi
add rdx, rsi
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x70], rdx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.1800ada98
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x58], xmm1
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x68], eax
lea rdx, [rdi + 0x68]
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.1800345a0
nop
lea rcx, [rdi + 0x98]
movzx r8d, byte [rdi + 0xc8]
lea rdx, [rsp + 0x78]
call fcn.1800341c0
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.18003e480
mov rcx, qword [rax]
mov qword [rdi + 0x90], rcx
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180039ca9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039ca4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039d92
call fcn.180085560
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp - 0x60]
call fcn.1800a40a0
mov qword [rbp - 0x50], 0
lea r15, vtable.fmt::v7::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rbp - 0x60], r15
lea rax, [rbp - 0x40]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0xfa
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
lea r8, [rbp - 0x60]
mov rdx, rbx
call qword [rax + 8]
mov rbx, qword [rbp - 0x50]
mov r9, qword [rdi + 0xa0]
mov r8, rbx
mov edx, 1
mov rcx, qword [rbp - 0x58]
call fcn.1800b2868
cmp rax, rbx
jne 0x180039d98
cmp rsi, r14
jl 0x180039d2b
cmp word [rdi + 0xca], 0
jbe 0x180039d2b
mov rcx, rdi
call fcn.18003e240
nop
mov qword [rbp - 0x60], r15
lea rax, [rbp - 0x40]
mov rcx, qword [rbp - 0x58]
cmp rcx, rax
je 0x180039d66
mov rdx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039d61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039d8c
call fcn.180085560
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.180085510
mov rbx, qword [rsp + 0x210]
add rsp, 0x1d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1800a889c
int3
call fcn.1800a889c
nop
call fcn.1800adba4
nop
mov ebx, dword [rax]
lea rdx, [rdi + 0xa8]
lea rcx, [rsp + 0x78]
call fcn.180031120
nop
mov r8, rax
lea rdx, str.Failed_writing_to_file
lea rcx, [rsp + 0x20]
call fcn.180007390
nop
mov edx, ebx
mov rcx, rax
call fcn.180031060
int3
Function at 0x18003e240
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x180112440]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rcx
lea rdx, [rcx + 0xa8]
lea rcx, [rsp + 0x80]
call fcn.180006ec0
nop
lea rbx, [rdi + 0xd0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x18003e36a
mov rax, qword [rbx + 0x10]
inc rax
xor edx, edx
div rcx
cmp rdx, qword [rbx + 8]
jne 0x18003e36a
mov rax, qword [rdi + 0xd8]
shl rax, 5
add rax, qword [rdi + 0xf0]
xor ecx, ecx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rcx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 7
mov word [rax], cx
mov rax, qword [rbx + 8]
inc rax
xor edx, edx
div qword [rbx]
mov qword [rbx + 8], rdx
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18003e328
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
call fcn.1800b35d4
test eax, eax
jne 0x18003e420
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18003e36a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003e365
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003e46f
call fcn.180085560
cmp qword [rbx], 0
jbe 0x18003e3b5
mov rcx, qword [rbx + 0x10]
shl rcx, 5
add rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x80]
call fcn.180025060
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
inc rax
xor edx, edx
div rcx
mov qword [rbx + 0x10], rdx
mov rax, qword [rbx + 8]
cmp rdx, rax
jne 0x18003e3b5
inc rax
xor edx, edx
div rcx
mov qword [rbx + 8], rdx
inc qword [rbx + 0x18]
mov rdx, qword [rsp + 0x98]
cmp rdx, 8
jb 0x18003e3f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003e3f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003e41a
call fcn.180085560
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180085510
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
call fcn.1800a889c
nop
lea rcx, [rsp + 0x80]
call fcn.1800034e0
mov rdx, rax
mov rcx, rbx
call fcn.18003e9c0
call fcn.1800adba4
mov ebx, dword [rax]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.180031120
nop
mov r8, rax
lea rdx, str.Failed_removing_daily_file
lea rcx, [rsp + 0x40]
call fcn.180007390
nop
mov edx, ebx
mov rcx, rax
call fcn.180031060
nop
call fcn.1800a889c
int3
Function at 0x18003e570
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18003e6fe
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180035db0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18003e6c7
mov qword [rsp + 0x58], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
movzx r10d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
mov eax, r10d
mov rdx, qword [rdx]
xor rax, rdi
imul rax, rbp
and r11, rax
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18003e636
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x18003e6b6
mov rax, qword [r11 + 8]
cmp r10b, byte [rax + 0x10]
jne 0x18003e66f
mov r10, qword [rax]
cmp r10, rcx
je 0x18003e669
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x18003e6b6
mov r8, rax
cmp r9, rax
je 0x18003e692
nop word [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r10b, byte [rax + 0x10]
je 0x18003e6d8
cmp r9, rax
jne 0x18003e680
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x18003e601
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x18003e6b6
lea rcx, str.invalid_hash_bucket_count
call fcn.18005bebc
int3
Function at 0x180040e70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180112440]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, r9
mov rsi, r8
mov rbx, rcx
mov qword [rbp - 0x18], rcx
mov r15, qword [rbp + 0x60]
xor r12d, r12d
mov dword [rbp - 0x18], r12d
mov r8, r9
cmp qword [r9 + 0x18], 8
jb 0x180040eb8
mov r8, qword [r9]
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180040ec5
mov rdx, qword [rsi]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov rcx, 0xffffffff80000002
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x180040eff
mov rdx, r15
mov rcx, rbx
call fcn.180006ec0
jmp 0x180041097
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r12w
mov edx, dword [rbp - 0x18]
shr rdx, 1
jne 0x180040f24
mov qword [rbp - 0x28], rdx
mov word [rbp + rdx*2 - 0x38], r12w
jmp 0x180040f5b
cmp rdx, 7
ja 0x180040f44
mov qword [rbp - 0x28], rdx
movzx eax, r12w
lea rdi, [rbp - 0x38]
mov rcx, rdx
rep stosw word [rdi], ax
mov word [rbp + rdx*2 - 0x38], r12w
jmp 0x180040f5b
mov word [rsp + 0x20], r12w
mov r9, rdx
movzx r8d, byte [rbp - 0x40]
lea rcx, [rbp - 0x38]
call fcn.180041300
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rax, qword [rbp - 0x38]
cmp qword [r14 + 0x18], 8
jb 0x180040f73
mov r14, qword [r14]
cmp qword [rsi + 0x18], 8
jb 0x180040f7d
mov rsi, qword [rsi]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 2
mov r8, r14
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x180041002
mov rdx, r15
mov rcx, rbx
call fcn.180006ec0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x180041097
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180040ff8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800410b8
call fcn.180085560
jmp 0x180041097
mov ecx, dword [rbp - 0x18]
shr rcx, 1
dec rcx
mov r8, qword [rbp - 0x28]
cmp rcx, r8
ja 0x18004102d
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rax, qword [rbp - 0x38]
mov qword [rbp - 0x28], rcx
mov word [rax + rcx*2], r12w
jmp 0x180041088
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp - 0x20]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x180041071
mov qword [rbp - 0x28], rcx
lea r9, [rbp - 0x38]
cmp rdi, 8
cmovae r9, qword [rbp - 0x38]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x180041066
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r12w
jmp 0x180041088
mov word [rsp + 0x20], r12w
mov r9, rdx
movzx r8d, byte [rbp - 0x40]
lea rcx, [rbp - 0x38]
call fcn.180041300
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180085510
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800a889c
int3
Function at 0x180042580
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1800425a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18004261c
mov rdi, r14
mov rcx, rbx
call fcn.1800436b0
test rax, rax
jle 0x1800425f4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1800a3c90
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18004260c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180042614
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1800425b6
sub r14, rdi
jmp 0x180042709
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180042633
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180042635
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18004266a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1800a3c90
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180042706
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x1800426a5
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x1800426e1
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1800b4678
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x18004271f
cmp rbp, rax
ja 0x1800426b1
mov r8, rdi
test rdi, rdi
je 0x180042706
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1800b4678
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x180042709
Function at 0x180042b50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180112440]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180042b7d
xor eax, eax
jmp 0x180042cc3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180042bb7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180042bb7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180042cc3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180042cb6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180042bfa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180042c09
movsx ecx, dil
jmp 0x180042c5d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x180042cb6
cmp eax, 1
jle 0x180042c77
cmp eax, 3
jne 0x180042cb6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1800b24f4
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180042cbb
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180042ca4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.1800b2868
cmp rsi, rax
jne 0x180042cb6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x180042cbb
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180085510
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18005d6a4
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbp, rcx
and esi, 0xf
xor r15d, r15d
cmp esi, 2
je 0x18005d861
lea r8d, [r15 + 1]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18005d6f4
mov byte [rsp + 0x88], 1
mov dword [rsp + 0x8c], r15d
jmp 0x18005d709
mov byte [rsp + 0x88], r15b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x8c], eax
mov rax, qword [rsp + 0x88]
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x50
jne 0x18005d8a3
test esi, esi
je 0x18005d8a3
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea edi, [rcx - 0x4d]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [rcx + 0x31]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18005d76c
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18005d76c
mov byte [rsp + 0x88], r15b
jmp 0x18005d894
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x82
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18005d7d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18005d7d0
mov byte [rsp + 0x88], r15b
mov dword [rsp + 0x8c], eax
cmp rbx, 0xffffffffffffffff
je 0x18005d89b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18005d8bd
jmp 0x18005d89b
cmp esi, 1
jne 0x18005d7fe
mov dword [rsp + 0x8c], r15d
mov byte [rsp + 0x88], r15b
cmp rdi, 0xffffffffffffffff
je 0x18005d7b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18005d8bd
jmp 0x18005d7b0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.18005d3bc
test eax, eax
je 0x18005d818
mov dword [rsp + 0x8c], eax
jmp 0x18005d7dd
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.18005d3bc
test eax, eax
jne 0x18005d80f
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0x40], rax
jle 0x18005d7d5
cmp rdi, 0xffffffffffffffff
je 0x18005d84e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18005d8bd
cmp rbx, 0xffffffffffffffff
je 0x18005d861
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18005d8bd
xor r8d, r8d
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x18005d886
mov byte [rsp + 0x88], 1
mov dword [rsp + 0x8c], r15d
jmp 0x18005d89b
mov byte [rsp + 0x88], r15b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x8c], eax
mov rax, qword [rsp + 0x88]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.1800b28ec
int3
Function at 0x18007b394
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x180065d7a
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x180065d5d
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x180065d48

Function at 0x180084fa4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180119690]
mov ebx, r9d
mov rdi, r8
mov esi, edx
test rax, rax
je 0x180084fcf
call qword [case.0x18008fb0a.0]
jmp 0x180084fe4
call fcn.180084f70
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180089064
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180089077
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.180092ed8
lea rdx, [0x18010f768]
lea rcx, [rsp + 0x20]
call fcn.1800a3bb4
int3

Function at 0x18009384c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x18011a080]
xor edx, edx
jmp fcn.180089064

Function at 0x1800941c4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x18011a080]
jmp fcn.180089064

Function at 0x18009f954
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x18009fa10]
mov r9, qword [r9 + 8]
jmp fcn.180091084

Function at 0x18009f9e8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x18009fa20]
mov r9, qword [r9 + 8]
jmp fcn.180091084

Function at 0x1800b35d4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800b35f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800adb34
or eax, 0xffffffff
jmp 0x1800b35f6
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800d0c10
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
lea r14, [0x1800f1238]
mov rdi, r8
mov rax, rdx
mov rbx, rcx
test r8, r8
je 0x1800d0c45
mov dword [r8], 0
mov byte [r8 + 4], 0
mov qword [r8 + 8], r14
test rax, rax
je 0x1800d0c6f
cmp qword [rcx + 0x18], 8
mov rdx, rbx
jb 0x1800d0c57
mov rdx, qword [rcx]
cmp qword [rax + 0x18], 8
jb 0x1800d0c61
mov rax, qword [rax]
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
jmp 0x1800d0c81
cmp qword [rcx + 0x18], 8
jb 0x1800d0c79
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1800d0c98
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov qword [rsp + 0x40], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov rdx, rbx
mov byte [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], r14
mov esi, eax
call fcn.1800d11c0
cmp dword [rax], 3
je 0x1800d0ce2
lea r9, str.boost::filesystem::create_directory
mov r8, rdi
mov rdx, rbx
mov ecx, esi
call fcn.1800d1e70
mov rsi, qword [rsp + 0x40]
xor al, al
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret