joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004e10
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1801eef68]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ebx, dword [rsp + 0x20]
lea ebp, [rdx + 0x249]
mov r14, r8
mov edi, edx
mov rsi, rcx
cmp edx, ebp
jae 0x180004f4a
nop
mov eax, edi
sub eax, 0x2e
je 0x180004ea1
sub eax, 0x44
je 0x180004e6a
cmp eax, 0x7f
je 0x180004f4a
jmp 0x180004f3c
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x30], 0x40
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
movzx eax, word [r14]
mov word [rsi + 8], ax
jmp 0x180004f3c
mov r10, qword [rsi]
mov rax, qword [r10 + 0x2d0]
mov ecx, dword [r10 + 0x30c]
mov r9, qword [r10 + 0x358]
mov rdx, qword [rax + 0x70]
mov eax, dword [r10 + 0x304]
imul ecx, dword [rdx + 0x4a4]
imul eax, dword [rdx + 0x4a8]
add rcx, rax
movzx eax, byte [r10 + 0x9f1]
add rcx, qword [rdx + 0x4b0]
test al, 0xfb
je 0x180004f24
cmp al, 1
jne 0x180004f3a
mov eax, dword [r10 + 0x314]
xor r8d, r8d
lea edx, [rax + rax*2]
test edx, edx
jle 0x180004f3a
nop dword [rax]
movzx eax, byte [r9]
inc r8d
add byte [rcx], al
lea rcx, [rcx + 1]
mov rax, qword [rsi]
lea r9, [r9 + 1]
mov edx, dword [rax + 0x314]
lea eax, [rdx + rdx*2]
cmp r8d, eax
jl 0x180004f00
jmp 0x180004f3a
mov eax, dword [r10 + 0x314]
mov rdx, r9
lea r8d, [rax + rax*2]
movsxd r8, r8d
call sub.VCRUNTIME140.dll_memcpy
xor ebx, ebx
add edi, 0xc3
cmp edi, ebp
jb 0x180004e50
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800d7250
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18000cd80
Capabilities:
Set current directory

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1801eef68]
xor rax, rsp
mov qword [rsp + 0x60], rax
imul ebp, edx, 0x29c
mov r15, r8
mov esi, edx
mov qword [rsp + 0x38], 0xffffffffffffffff
mov r14, rcx
mov dword [rsp + 0x40], 0
mov edi, edx
cmp edx, ebp
ja 0x18000cfbc
mov qword [rsp + 0xa8], rbx
nop dword [rax]
mov eax, edi
sub eax, 0x58
je 0x18000ce1e
sub eax, 0x4b
je 0x18000cdf7
sub eax, 0x391d
je 0x18000cf97
cmp eax, 0x3138
je 0x18000cf97
jmp 0x18000cf87
mov edx, dword [r15]
mov r8d, 1
mov ecx, edx
shr rdx, 3
and ecx, 7
shl r8d, cl
movzx eax, byte [rdx + r14]
and r8d, eax
mov dword [rsp + 0x30], r8d
jmp 0x18000cf87
lea r8, [rsp + 0x38]
mov edx, 0x7f
xor ecx, ecx
call fcn.180013f00
test al, al
jne 0x18000cf50
mov ebx, 0x95
nop dword [rax]
cmp ebx, 0xe552
ja 0x18000cefb
je 0x18000cedd
cmp ebx, 0x95
je 0x18000ce99
cmp ebx, 0x4cd4
je 0x18000ce8f
cmp ebx, 0x9913
jne 0x18000cf3e
movzx eax, word [0x1801df30a]
mov word [rsp + 0x53], ax
movzx eax, byte [0x1801df30c]
mov byte [rsp + 0x55], al
mov byte [rsp + 0x52], 0x61
jmp 0x18000cf3e
mov byte [rsp + 0x51], 0x76
jmp 0x18000cf3e
mov r8d, 3
mov dword [rsp + 0x48], 0x656b616d
lea rdx, [0x1801df26d]
mov byte [rsp + 0x4c], 0
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x1801df2ce]
lea rcx, [rsp + 0x4f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rsp + 0x51], 0
jmp 0x18000cf3e
movzx eax, word [0x1801df333]
mov word [rsp + 0x56], ax
movzx eax, byte [0x1801df335]
mov byte [rsp + 0x58], al
mov byte [rsp + 0x59], 0
jmp 0x18000cf3e
cmp ebx, 0x13191
je 0x18000cf11
cmp ebx, 0x17dd0
je 0x18000cf97
jmp 0x18000cf3e
mov r8d, 1
lea rdx, [0x1801df2f4]
lea rcx, [rsp + 0x59]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rcx, [rsp + 0x48]
mov byte [rsp + 0x5a], 0
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov byte [rsp + 0x30], 0
add ebx, 0x4c3f
cmp ebx, 0x1c97a
jbe 0x18000ce40
lea rax, [rsp + 0x38]
mov r9, r15
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0xce
mov rcx, r14
call fcn.18004df20
mov r9d, 0x21
lea r8, [rsp + 0x38]
xor edx, edx
xor ecx, ecx
mov ebx, eax
call fcn.180020210
mov byte [rsp + 0x30], bl
imul eax, esi, 0xa7
add edi, eax
cmp edi, ebp
jbe 0x18000cdd0
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800d7250
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rsp + 0x30]
jmp 0x18000cfa3
Function at 0x18003e2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov eax, dword [rsp + 0x68]
lea r12d, [rdx + 9]
mov r14, r8
mov r13, rcx
cmp edx, r12d
jae case.0x18003e335.3
mov rdi, qword [rsp + 0x78]
lea r15d, [rdx - 6]
mov rsi, qword [rsp + 0x78]
lea r8, [0x180000000]
movzx ebx, byte [rsp + 0x68]
movzx ebp, byte [rsp + 0x68]
nop word [rax + rax]
cmp r15d, 0x15
ja case.0x18003e335.4
mov edx, dword [r8 + r15*4 + 0x3e4d4]
add rdx, r8
jmp rdx
xor eax, eax
jmp case.0x18003e335.4
mov r9, qword [r14]
mov rcx, qword [r9 + 0x9e8]
mov esi, dword [r9 + 0x9fc]
movsxd rdi, dword [r9 + 0x330]
add rdi, qword [r9 + 0x348]
mov r10, qword [rcx + 0x70]
mov ecx, dword [r9 + 0xa00]
mov edx, dword [r10 + 0x4a4]
mov r8d, dword [r10 + 0x4a8]
imul esi, edx
imul edx, dword [r9 + 0x30c]
imul ecx, r8d
add rsi, rcx
add rsi, rdx
mov edx, dword [r9 + 0x304]
imul edx, r8d
lea r8, [0x180000000]
add rsi, rdx
add rsi, qword [r10 + 0x4b0]
jmp case.0x18003e335.4
mov rcx, qword [r14]
xor edx, edx
cmp byte [rcx + 0x9f1], 4
jne 0x18003e3fe
cmp dword [rcx + 0x314], edx
jle 0x18003e440
movzx ecx, bl
test bl, bl
jne 0x18003e3ce
movzx ebp, byte [rdi]
mov bl, 0x80
test cl, cl
lea rax, [rdi + 1]
cmovne rax, rdi
test bl, bpl
mov rdi, rax
setne al
shr bl, 1
mov byte [rsi], al
inc edx
mov rcx, qword [r14]
movsxd rax, dword [rcx + 0x310]
add rsi, rax
cmp edx, dword [rcx + 0x314]
jl 0x18003e3c2
jmp 0x18003e440
cmp dword [rcx + 0x314], edx
jle 0x18003e440
movzx ecx, bl
test bl, bl
jne 0x18003e412
movzx ebp, byte [rdi]
mov bl, 0x80
test cl, cl
lea rax, [rdi + 1]
cmovne rax, rdi
mov rdi, rax
test bl, bpl
je 0x18003e427
xor byte [rsi], 1
mov rcx, qword [r14]
inc edx
shr bl, 1
movsxd rax, dword [rcx + 0x310]
add rsi, rax
cmp edx, dword [rcx + 0x314]
jl 0x18003e406
mov qword [rsp + 0x78], rcx
lea r8, [rsp + 0x78]
mov ecx, pe_nt_image_headers64
xor edx, edx
call fcn.18007cda0
lea r8, [0x180000000]
jmp case.0x18003e335.4
xor bl, bl
xor bpl, bpl
jmp case.0x18003e335.4
mov rcx, qword [r14]
cmp dword [rcx], 0x7f2bb70c
je case.0x18003e335.4
mov eax, 0x7f2bb70c
jmp case.0x18003e335.3
mov rdx, qword [r14]
mov rcx, qword [rdx + 0x18]
test rcx, rcx
je 0x18003e49d
dec rcx
mov qword [rdx + 0x18], rcx
inc r15d
lea ecx, [r15 + 6]
cmp ecx, r12d
jb 0x18003e320
jmp case.0x18003e335.3
mov eax, 0x7f2bb76a
jmp case.0x18003e335.3
mov rcx, qword [r13]
test rcx, rcx
je 0x18003e4bb
mov rax, qword [r14]
mov edx, 0x58
call qword [rax + reloc.SHELL32.dll_SHSetInstanceExplorer]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004d3f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea r12d, [r8 + 0x1bd]
mov rbx, r9
mov esi, r8d
mov r15, rdx
mov r14, rcx
cmp r8d, r12d
jae 0x18004d5d5
mov ebp, dword [rsp + 0x90]
xor r13d, r13d
mov eax, esi
sub eax, 0x68
je 0x18004d5c6
sub eax, 0x59
je 0x18004d4cd
sub eax, 0x59
je 0x18004d492
sub eax, 5
je 0x18004d45e
cmp eax, 0x54
je 0x18004d5c2
jmp 0x18004d5c9
mov rax, qword [0x1801ef0d0]
movsxd rcx, dword [rbx]
mov rcx, qword [rax + rcx*8]
mov dword [rcx + 0x88], 1
mov rax, qword [0x1801ef0d0]
movsxd rcx, dword [rbx]
mov rdx, qword [rax + rcx*8]
mov eax, dword [r15]
mov dword [rdx + 0x8c], eax
jmp 0x18004d5c9
mov rax, qword [rbx]
mov rdi, qword [rax + 0x108]
test r14, r14
je 0x18004d4b5
cmp r14, rdi
je 0x18004d4b5
mov r8d, dword [rax + 0x28]
mov rdx, rdi
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rdi], 0x4d4d50
je 0x18004d5c9
mov ebp, 0x7f2bb78a
mov eax, ebp
jmp 0x18004d5dc
mov rcx, qword [rbx]
mov r8, qword [r15]
mov rdx, qword [rcx + 0x20]
mov eax, dword [rdx + 0x14]
cmp r8, rax
jbe 0x18004d603
mov eax, dword [rdx + 4]
cmp r8, rax
jae 0x18004d603
cmp dword [rcx + 0x110], r13d
jg 0x18004d522
mov rcx, qword [rcx + 0x18]
mov edx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__open]
mov ecx, eax
mov rax, qword [rbx]
mov dword [rax + 0x110], ecx
mov rcx, qword [rbx]
cmp dword [rcx + 0x110], r13d
jl 0x18004d5fa
cmp qword [rcx + 0x108], r13
jne 0x18004d59b
mov eax, dword [rcx + 0x110]
lea r8, [rsp + 0x90]
xor ecx, ecx
mov dword [rsp + 0x90], eax
mov r9d, 0x5d
xor edx, edx
call fcn.180047f60
mov r8, qword [rbx]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x90], eax
xor edx, edx
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov eax, dword [r8 + 0x28]
add r8, 0x108
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x90]
mov dword [rsp + 0x28], 0x8b
mov qword [rsp + 0x20], rax
call fcn.180047500
mov ebp, eax
test eax, eax
jne 0x18004d5dc
mov rcx, qword [rbx]
mov r8d, dword [rcx + 0x28]
mov rdx, qword [rcx + 0x108]
mov ecx, dword [rcx + 0x110]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov rcx, qword [rbx]
cmp eax, dword [rcx + 0x28]
je 0x18004d5c9
mov ebp, 0x7f2bb724
mov eax, ebp
jmp 0x18004d5dc
mov ebp, r13d
add esi, 0x59
cmp esi, r12d
jb 0x18004d432
mov eax, dword [rsp + 0x90]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ebp, 0x7f2bb790
mov eax, ebp
jmp 0x18004d5dc
mov eax, 0x7f2bb78d
jmp 0x18004d5dc
Function at 0x180060da0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push rbx
push r12
sub rsp, 0x18
lea r12d, [rdx - 5]
mov rbx, r8
mov r11d, edx
cmp edx, r12d
jbe 0x180060ec0
mov r10d, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x38]
mov qword [rsp + 0x30], rbp
mov ebp, dword [rsp + 0x38]
mov qword [rsp + 0x40], rsi
mov esi, dword [rsp + 0x38]
mov qword [rsp + 0x10], rdi
mov edi, dword [rsp + 0x38]
mov qword [rsp + 8], r14
mov r14d, dword [rsp + 0x38]
mov qword [rsp], r15
mov r15d, dword [rsp + 0x38]
nop word [rax + rax]
mov eax, r11d
sub eax, 0xbc
je 0x180060e98
sub eax, 1
je 0x180060e93
sub eax, 1
je 0x180060e50
sub eax, 1
je 0x180060e34
cmp eax, 1
jne 0x180060e9c
mov r8d, dword [r9]
xor r10d, r10d
mov edx, dword [r9 + 4]
mov esi, dword [rbx]
jmp 0x180060e9c
mov ebp, dword [rbx + 4]
mov edi, reloc.SHELL32.dll_ILFindLastID
mov r14d, dword [rbx + 8]
mov r15d, dword [rbx + 0xc]
jmp 0x180060e9c
add r10d, 0x9e3779b9
mov ecx, edx
shr ecx, 5
mov eax, edx
add ecx, ebp
shl eax, 4
add eax, esi
xor ecx, eax
lea eax, [rdx + r10]
xor ecx, eax
add r8d, ecx
mov ecx, r8d
mov eax, r8d
shr ecx, 5
shl eax, 4
add ecx, r15d
add eax, r14d
xor ecx, eax
lea eax, [r8 + r10]
xor ecx, eax
add edx, ecx
sub edi, 1
jne 0x180060e50
jmp 0x180060e9c
add dword [r9], r8d
jmp 0x180060e9c
add dword [r9 + 4], edx
dec r11d
cmp r11d, r12d
ja 0x180060e00
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
add rsp, 0x18
pop r12
pop rbx
ret
Function at 0x18007dc00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov eax, dword [rsp + 0x58]
lea esi, [rdx + 0xa0]
mov r14, r8
mov rdi, rcx
cmp edx, esi
jae case.0x18007dc60.5
mov rbp, qword [rsp + 0x68]
lea ebx, [rdx - 0x48]
mov edx, dword [rsp + 0x58]
lea r15, [0x180000000]
mov r11, qword [rsp + 0x68]
cmp ebx, 0x90
ja case.0x18007dc60.8
movzx ecx, byte [r15 + rbx + 0x7dd94]
mov r8d, dword [r15 + rcx*4 + 0x7dd70]
add r8, r15
jmp r8
mov rbp, qword [r14]
jmp case.0x18007dc60.8
xor edx, edx
lea r11, [rdi + 0x10]
jmp case.0x18007dc60.8
movzx ecx, byte [rdi]
test cl, cl
je 0x18007dca0
mov r9d, ecx
mov r8d, edx
mov ecx, edx
shl ecx, 5
shr r8d, 0x1b
mov edx, r8d
xor edx, ecx
movsx ecx, byte [r11]
xor edx, ecx
inc r11
sub r9, 1
jne 0x18007dc80
cmp dword [rdi + 4], 0
jne case.0x18007dc60.8
mov r10d, dword [rdi + 8]
test r10d, r10d
je case.0x18007dc60.8
add r10d, 3
mov r9, r14
shr r10d, 2
test r10d, r10d
je case.0x18007dc60.8
nop
mov r8d, edx
lea r9, [r9 + 4]
mov ecx, edx
shr r8d, 0x10
shl ecx, 0x10
mov edx, r8d
xor edx, ecx
xor edx, dword [r9 - 4]
sub r10d, 1
jne 0x18007dcc0
jmp case.0x18007dc60.8
mov eax, edx
jmp case.0x18007dc60.8
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rcx
add ebx, 0x14
lea ecx, [rbx + 0x48]
cmp ecx, esi
jb 0x18007dc40
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [r14]
test rcx, rcx
je 0x18007dd5b
mov edx, 0x38
jmp 0x18007dd52
mov eax, dword [rbp + 0x3c]
test eax, eax
je 0x18007dd45
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x18007dd45
mov r8, qword [rdi]
lea rdx, [rax + rax*8]
shl rdx, 2
call qword [r8 + reloc.SHELL32.dll_SHSetInstanceExplorer]
mov rcx, qword [r14]
test rcx, rcx
je 0x18007dd5b
mov edx, PathYetAnotherMakeUniqueName
mov rax, qword [rdi]
call qword [rax + reloc.SHELL32.dll_SHSetInstanceExplorer]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18007f930
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rsp + 0x50]
lea r12d, [rcx + rcx*4]
shl r12d, 8
mov rbp, r8
mov r14, rdx
mov r15d, ecx
mov esi, ecx
cmp ecx, r12d
ja 0x18007f99c
mov edi, dword [rsp + 0x50]
nop word [rax + rax]
cmp esi, 0x5588
ja 0x18007fa1a
je 0x18007f99c
mov eax, esi
sub eax, 0x60
je 0x18007f9ff
sub eax, 0x28
je 0x18007f9e4
sub eax, 0x94
je 0x18007f9b5
cmp eax, 0x3b44
jne 0x18007fa54
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp dword [rbp], 2
jl 0x18007fa6b
mov r8, qword [r14 + 8]
lea r9, [rsp + 0x50]
mov edx, 0x11c
mov dword [rsp + 0x50], 0x400
lea rcx, [rsp + 0x68]
call fcn.1800b5920
mov rdi, rax
jmp 0x18007fa54
mov rcx, qword [r14]
test rcx, rcx
je 0x18007f9fb
mov rax, qword [rbp]
mov edx, PathYetAnotherMakeUniqueName
call qword [rax + reloc.SHELL32.dll_SHSetInstanceExplorer]
xor ebx, ebx
jmp 0x18007fa54
mov rcx, qword [r14]
test rcx, rcx
je 0x18007f9fb
mov rax, qword [rbp]
mov edx, 0x248
call qword [rax + reloc.SHELL32.dll_SHSetInstanceExplorer]
xor ebx, ebx
jmp 0x18007fa54
cmp esi, 0xb29c
je 0x18007fa50
cmp esi, 0x1641c
je 0x18007fa39
cmp esi, 0x2159c
jne 0x18007fa54
xor eax, eax
jmp 0x18007f99e
mov r8d, dword [rsp + 0x68]
lea rcx, str.__builtin_neon_vqshrns_n_s32
mov rdx, qword [r14 + 8]
call fcn.1800d6920
jmp 0x18007fa54
test edi, edi
jne 0x18007fa94
lea eax, [r15 + r15*4]
shl eax, 5
add esi, eax
cmp esi, r12d
jbe 0x18007f970
jmp 0x18007f99c
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [r14]
lea rdx, str._bxanthi_b
mov rcx, rax
call fcn.1800d6850
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x180088f40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea ebp, [r9 + 0x1d1]
mov esi, r9d
mov r12, r8
mov r14, rdx
mov r15, rcx
cmp r9d, ebp
jae 0x1800890f2
mov edi, dword [rsp + 0x98]
lea r13, [0x1801ef150]
xor ebx, ebx
nop dword [rax + rax]
mov eax, esi
sub eax, 0xb5
je 0x1800890d1
sub eax, 0x15
je 0x1800890c4
sub eax, 0x48
je 0x180089117
sub eax, 0x15
je 0x18008907c
cmp eax, 0x5d
jne 0x1800890e7
lea r9, [0x1801ef950]
mov r10d, 0x100
nop
mov edx, dword [r9 - 0x800]
lea r9, [r9 + 4]
movzx ecx, dl
shr edx, 8
mov r8d, dword [r13 + rcx*4]
xor r8d, edx
mov dword [r9 - 0x404], r8d
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r13 + rcx*4]
xor edx, r8d
mov dword [r9 - 4], edx
movzx ecx, dl
shr edx, 8
mov r8d, dword [r13 + rcx*4]
xor r8d, edx
mov dword [r9 + 0x3fc], r8d
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r13 + rcx*4]
xor edx, r8d
mov dword [r9 + 0x7fc], edx
movzx ecx, dl
shr edx, 8
mov r8d, dword [r13 + rcx*4]
xor r8d, edx
mov dword [r9 + 0xbfc], r8d
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r13 + rcx*4]
xor edx, r8d
mov dword [r9 + 0xffc], edx
movzx ecx, dl
shr edx, 8
mov edi, dword [r13 + rcx*4]
xor edi, edx
mov dword [r9 + 0x13fc], edi
sub r10, 1
jne 0x180088fd0
jmp 0x1800890e7
mov r9d, 0x80
mov eax, edi
lea r10d, [r9 + r9]
and al, 1
neg al
mov eax, edi
sbb ecx, ecx
shr eax, 1
and ecx, 0x82f63b78
mov edi, ecx
xor edi, eax
mov eax, ebx
nop
mov ecx, eax
mov r8d, dword [r13 + rcx*4]
lea ecx, [rax + r9]
xor r8d, edi
add eax, r10d
mov dword [r13 + rcx*4], r8d
cmp eax, 0x100
jb 0x1800890a0
shr r9d, 1
jne 0x180089082
jmp 0x1800890e7
mov edi, 1
mov dword [0x1801ef150], ebx
jmp 0x1800890e7
mov rax, qword [r15]
mov ecx, 0x50
call qword [rax + 0xa8]
mov qword [r14], rax
test rax, rax
je 0x180089140
add esi, 0x5d
cmp esi, ebp
jb 0x180088f90
mov eax, dword [rsp + 0x98]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [r12]
mov rcx, qword [r14]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
mov eax, ebx
movups xmmword [rcx + 0x30], xmm1
jmp 0x1800890f9
mov rax, qword [r15]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x30]
lea rax, [rsp + 0x98]
mov dword [rsp + 0x98], ebx
mov r9d, 0x75
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x38], 1
call fcn.180063bc0
mov eax, 1
jmp 0x1800890f9
Function at 0x1800af5f0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov ebx, dword [rsp + 0x90]
lea eax, [rcx + 0x2ee]
mov dword [rsp + 0x38], eax
mov rsi, r8
mov r12, rdx
mov ebp, ecx
cmp ecx, eax
jae 0x1800af66d
mov r15, qword [rsp + 0x40]
mov r14d, dword [rsp + 0x90]
mov r13, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xa8]
nop
mov eax, ebp
sub eax, 0x1b
je 0x1800af723
sub eax, 0x96
je 0x1800af794
sub eax, 0xc
je 0x1800af6d0
sub eax, 0x96
je 0x1800af687
cmp eax, 0x96
jne 0x1800af739
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test r14d, r14d
je 0x1800af74e
mov eax, dword [r12]
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0x40]
mov dword [rsp + 0xa8], eax
mov edx, 0xea
mov dword [rsp + 0x30], r14d
lea rcx, [rsp + 0x30]
call fcn.180068330
mov rcx, r15
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800af739
movzx eax, byte [rsi]
cmp al, 0x20
je 0x1800af6db
cmp al, 9
jne 0x1800af6e0
inc rsi
jmp 0x1800af6d0
movsxd rcx, dword [r12]
cmp al, 0x21
je 0x1800af75e
mov dword [rsp + 0xa8], ecx
lea r8, [rsp + 0xa8]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov edx, 0xa6
call fcn.18006ebd0
mov r14d, dword [rsp + 0x90]
mov r15, rax
mov qword [rsp + 0x40], rax
jmp 0x1800af739
mov rdi, qword [r12]
mov rax, qword [rdi + 0x2e0]
mov rdi, qword [rdi + 0x358]
mov r13, qword [rax + 0x70]
add ebp, 0x96
cmp ebp, dword [rsp + 0x38]
jb 0x1800af640
jmp 0x1800af66d
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x1800af66f
mov rax, qword [0x1801ef0d0]
mov rcx, qword [rax + rcx*8]
test byte [rcx + 0x50], 1
je 0x1800af779
mov eax, 0xb6d0a
jmp 0x1800af66f
lea rcx, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jns 0x1800af757
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
jmp 0x1800af66f
mov rcx, qword [r12]
xor eax, eax
mov r9d, eax
mov r8d, dword [rcx + 0x304]
imul r8d, dword [r13 + 0x4a8]
add r8, qword [r13 + 0x4b0]
cmp dword [rcx + 0x314], eax
jle 0x1800af66f
nop
mov edx, 0xc1
mov ecx, edx
sub ecx, 0xc1
je 0x1800af7de
cmp ecx, 1
jne 0x1800af7f2
add r8, 2
add rdi, 4
jmp 0x1800af7f2
movzx ecx, byte [r8]
mov byte [rdi], cl
mov byte [rdi + 1], cl
mov byte [rdi + 2], cl
movzx ecx, byte [r8 + 1]
mov byte [rdi + 3], cl
inc edx
cmp edx, 0xc3
jb 0x1800af7c5
mov rcx, qword [r12]
inc r9d
cmp r9d, dword [rcx + 0x314]
jl 0x1800af7c0
jmp 0x1800af66f
Function at 0x1800b3670
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x1801eef68]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea ebx, [rdx + 0x13b]
mov r13d, edx
mov dword [rsp + 0x30], ebx
mov r15, rcx
cmp edx, ebx
jae case.0x1800b36ff.8
mov rbx, qword [rsp + 0x50]
lea esi, [rdx - 0xd1]
mov r12, qword [rsp + 0x50]
lea r8, [0x1801f3dc8]
mov eax, dword [rsp + 0x30]
xor ebp, ebp
mov dword [rsp + 0x34], esi
lea rdx, [0x180000000]
cmp esi, 0xed
ja case.default.0x1800b36ff
movzx eax, byte [rdx + rsi + 0xb3908]
mov ecx, dword [rdx + rax*4 + 0xb38e0]
add rcx, rdx
jmp rcx
mov byte [0x1801f3df8], 0
mov dword [rsp + 0x48], 0x36
jmp case.0x1800b36ff.9
mov rbx, qword [r15]
mov rbx, qword [rbx + 0x358]
jmp case.0x1800b36ff.9
mov rax, qword [r15]
mov r14d, ebp
cmp dword [rax + 0x314], 0
mov rdi, qword [rax + 0x358]
jle case.0x1800b36ff.9
nop
mov esi, 5
lea ebp, [rsi + 1]
cmp esi, 5
ja case.default.0x1800b3759
mov eax, esi
mov ecx, dword [rdx + rax*4 + 0xb39f8]
add rcx, rdx
jmp rcx
add rbx, 2
jmp case.default.0x1800b3759
add rbx, 2
lea rcx, [rsp + 0x40]
mov r9d, 0x6a
mov qword [rsp + 0x40], rbx
xor r8d, r8d
xor edx, edx
call fcn.180006190
shr ax, 8
mov byte [rdi], al
jmp 0x1800b37af
inc rdi
jmp case.default.0x1800b3759
mov r9d, 0x6a
mov qword [rsp + 0x40], rbx
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.180006190
shr ax, 8
mov byte [rdi], al
inc rdi
lea rdx, [0x180000000]
dec esi
sub rbp, 1
jne 0x1800b3748
mov rax, qword [r15]
inc r14d
cmp r14d, dword [rax + 0x314]
jl 0x1800b3740
mov esi, dword [rsp + 0x34]
lea r8, [0x1801f3dc8]
jmp case.0x1800b36ff.9
mov r12d, 6
jmp case.0x1800b36ff.9
mov rdi, rbp
test r12, r12
je 0x1800b383c
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r15]
lea rsi, [rdi + 1]
mov rcx, rsi
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
mov edx, 0x116
call fcn.18005a000
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rdi*8], rax
test rax, rax
je 0x1800b38d5
mov rdi, rsi
cmp rsi, r12
jb 0x1800b3800
mov esi, dword [rsp + 0x34]
mov r8, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov edx, dword [rsp + 0x48]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
mov byte [0x1801f3df8], 1
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirA]
lea r8, [0x1801f3dc8]
mov byte [rsp + 0x38], 1
jmp case.0x1800b36ff.9
mov qword [rsp + 0x58], rbp
jmp case.0x1800b36ff.9
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rbp
mov eax, dword [rsp + 0x30]
add esi, 0x23
add r13d, 0x23
mov dword [rsp + 0x34], esi
cmp r13d, eax
jb 0x1800b36da
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1800d7250
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov byte [rsp + 0x38], 0
jmp case.0x1800b36ff.8
mov eax, ebp
jmp 0x1800b38a4