joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800591ac
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
test rcx, rcx
je 0x18005920a
mov r9d, 0x218
mov dword [rsp + 0x20], 9
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x18005920a
mov ecx, dword [rsp + 0x40]
lea eax, [rbx + 1]
shr ecx, 1
sub ecx, eax
cmp word [rsp + rcx*2 + 0x44], 0x5c
cmove ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180024680
add rsp, 0x270
pop rbx
ret

Function at 0x18005a17c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
and qword [rbp - 9], 0
mov rsi, rdx
mov rdx, rcx
mov ebx, r9d
lea rcx, [rbp - 1]
mov rdi, r8
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
and qword [rsp + 0x30], 0
lea rax, [rbp - 1]
and dword [rsp + 0x28], 0
lea r8, [rbp + 0x1f]
and qword [rbp + 0x27], 0
lea rcx, [rbp - 9]
and qword [rsp + 0x20], 0
xorps xmm0, xmm0
xor r9d, r9d
mov qword [rbp + 0x2f], rax
mov edx, 0x2001f
mov dword [rbp + 0x1f], 0x30
movdqu xmmword [rbp + 0x3f], xmm0
mov dword [rbp + 0x37], 0x40
call qword [sym.imp.ntdll.dll_NtCreateKey]
nop dword [rax + rax]
test eax, eax
js 0x18005a26d
mov rdx, rsi
lea rcx, [rbp + 0xf]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbp - 9]
lea rdx, [rbp + 0xf]
mov r9d, 7
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18005a25b
mov rcx, qword [rbp - 9]
call qword [sym.imp.ntdll.dll_NtFlushKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, ebx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18005a520
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
xor r15d, r15d
mov rdi, r9
mov dword [rbp + 0x28], r15d
mov rsi, r8
mov ebx, r15d
test edx, edx
jne 0x18005a70f
cmp ecx, 2
ja 0x18005a70f
test ecx, ecx
je 0x18005a6a7
sub ecx, 1
je 0x18005a689
cmp ecx, 1
jne 0x18005a6ac
test r9, r9
je 0x18005a6ac
test r8, r8
jne 0x18005a58d
cmp dword [r9], r15d
ja 0x18005a6ac
mov eax, dword [r9]
mov dword [rbp + 0x28], eax
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8d, dword [rdi]
add r8, r8
mov edx, dword [rax]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x18005a5d0
lea ebx, [rax + 8]
jmp 0x18005a70b
lea r8, [rbp + 0x28]
mov rdx, r14
mov ecx, 7
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
jne 0x18005a627
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18005a627
mov esi, 0xea
cmp eax, esi
jne 0x18005a666
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], r15d
xor ecx, ecx
call fcn.180059830
mov ecx, dword [rbp + 0x28]
test eax, eax
mov ebx, eax
cmove ebx, esi
add ecx, dword [rbp - 0x10]
mov dword [rdi], ecx
jmp 0x18005a666
mov eax, dword [rdi]
lea rdx, [rbp - 0x10]
sub eax, dword [rbp + 0x28]
dec eax
mov dword [rbp - 0x10], eax
mov eax, dword [rbp + 0x28]
inc rax
lea rcx, [r14 + rax*2]
call fcn.180059830
mov ebx, eax
mov eax, dword [rbp - 0x10]
inc eax
add eax, dword [rbp + 0x28]
mov dword [rdi], eax
test ebx, ebx
jne 0x18005a666
lea r8d, [rax + 1]
mov rdx, r14
add r8, r8
mov rcx, rsi
call sub.ntdll.dll_memcpy
mov rcx, qword gs:[0x60]
mov r8, r14
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
jmp 0x18005a70b
test rdi, rdi
je 0x18005a6ac
test rsi, rsi
jne 0x18005a698
cmp dword [r9], r15d
ja 0x18005a6ac
mov rdx, rdi
mov rcx, rsi
call fcn.180059830
mov ebx, eax
jmp 0x18005a70b
test rdi, rdi
jne 0x18005a6b3
mov ebx, 0x57
jmp 0x18005a70b
mov eax, dword [r9]
lea r8, [rbp + 0x28]
mov rdx, rsi
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, 7
mov dword [rbp + 0x28], eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
jne 0x18005a6ee
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x18005a704
test rsi, rsi
je 0x18005a6ff
mov eax, dword [rbp + 0x28]
inc eax
mov word [rsi + rax*2], r15w
jmp 0x18005a704
mov ebx, 0x1f
mov eax, dword [rbp + 0x28]
inc eax
mov dword [rdi], eax
mov eax, ebx
jmp 0x18005a714
mov eax, 0x57
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x18005adfc
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov ebx, r15d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstVolumeW]
nop dword [rax + rax]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18005ae66
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x18005afb3
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x18005ae6f
jmp 0x18005af62
mov r8d, 0x104
mov word [rsp + rax + 0x30], r15w
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_QueryDosDeviceW]
nop dword [rax + rax]
test ax, ax
je 0x18005af96
xorps xmm0, xmm0
lea rax, [rbp + 0x140]
movups xmmword [rsp + 0x20], xmm0
mov edx, 0x7fff
mov r9d, 2
cmp word [rax], r15w
je 0x18005aed4
add rax, r9
sub rdx, 1
jne 0x18005aec5
mov ecx, 0x7fff
mov rax, rdx
sub rcx, rdx
neg rax
sbb r8, r8
and r8, rcx
test rdx, rdx
je 0x18005afa4
add r8w, r8w
lea rax, [rbp + 0x140]
mov word [rsp + 0x20], r8w
add r8w, r9w
mov word [rsp + 0x22], r8w
mov qword [rsp + 0x28], rax
test rdx, rdx
je 0x18005afa4
mov rdx, r14
lea rcx, [rsp + 0x20]
mov rax, rsi
call qword [case.0x1800532bc.0]
mov ebx, eax
test eax, eax
jne 0x18005afa4
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextVolumeW]
nop dword [rax + rax]
test eax, eax
je 0x18005af7f
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x18005af58
movzx eax, ax
lea rax, [rax*2 - 2]
cmp rax, 0x208
jb 0x18005ae7e
call fcn.180024840
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x12
mov ebx, eax
cmove ebx, r15d
jmp 0x18005afa4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindVolumeClose]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x460
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005bbd0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov r15, rcx
lea rdx, [rbp - 0x2c]
mov esi, 0x1000
xor dil, dil
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
nop dword [rax + rax]
mov dword [rbp - 0x30], eax
cmp eax, 0xffffffff
jne 0x18005bc37
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
je 0x18005bc37
xor eax, eax
jmp 0x18005bd96
mov rax, qword [rbp - 0x30]
mov r13d, 1
and qword [rbp - 0x18], 0
mov qword [rbp - 0x10], rax
mov edx, esi
lea rcx, [rbx + 0x438]
call fcn.18005e508
test eax, eax
je 0x18005bd3a
mov ecx, dword [rbx + 0x448]
mov eax, esi
and qword [rbp - 0x20], 0
sub eax, ecx
add rcx, qword [rbx + 0x440]
xor r9d, r9d
mov dword [rsp + 0x48], eax
xor r8d, r8d
mov qword [rsp + 0x40], rcx
lea rax, [rbp - 0x18]
mov dword [rsp + 0x38], 0x10
xor edx, edx
mov qword [rsp + 0x30], rax
mov rcx, r15
lea rax, [rbp - 0x28]
mov dword [rsp + 0x28], 0x940cf
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtFsControlFile]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x30]
mov r9d, eax
mov eax, 0x80000000
lea edx, [r9 + rax]
test eax, edx
jne 0x18005bcd5
cmp r9d, 0x80000005
jne 0x18005bd16
mov rax, qword [rbp - 0x20]
test eax, eax
jne 0x18005bcf4
test r9d, r9d
js 0x18005bcf4
cmp qword [rbp - 0x18], 0
jne 0x18005bcf4
test rcx, rcx
movzx edi, dil
cmovg edi, r13d
add dword [rbx + 0x448], eax
mov r8d, dword [rbx + 0x448]
mov rdx, qword [rbx + 0x440]
mov rax, qword [r8 + rdx - 8]
add rax, qword [r8 + rdx - 0x10]
mov qword [rbp - 0x18], rax
mov r8d, dword [rbx + 0x448]
mov eax, esi
lea rdx, [r8 + 0x10]
cmp rdx, rax
jbe 0x18005bd33
add esi, 0x1000
jmp 0x18005bc4a
test r9d, r9d
jns 0x18005bd48
jmp 0x18005bd3e
mov rcx, qword [rbp - 0x30]
and dword [rbx + 0x448], 0
xor r8d, r8d
test dil, dil
jne 0x18005bd53
cmp r8d, 0x10
jb 0x18005bd6b
mov rax, qword [rbx + 0x440]
test dil, dil
jne 0x18005bd77
cmp qword [rax], 0
jne 0x18005bd77
cmp qword [rax + 8], rcx
jne 0x18005bd77
and dword [rbx + 0x448], 0
jmp 0x18005bc30
lea edx, [r8 + 0x10]
mov dword [rbx + 0x448], edx
and qword [rdx + rax - 8], 0
mov qword [rdx + rax - 0x10], rcx
mov eax, r13d
mov byte [rbx + 0x450], r13b
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180024680
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x18005c480
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rdx + 0x469], 0
mov rbx, rdx
mov rdi, rcx
je 0x18005c583
mov eax, dword [rdx + 0x46c]
bt eax, 0xe
jb 0x18005c57c
test al, 0x10
jne 0x18005c57c
lea rdx, [rsp + 0x3c]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
nop dword [rax + rax]
mov dword [rsp + 0x38], eax
cmp qword [rsp + 0x38], 0
je 0x18005c57c
cmp eax, 0xffffffff
jne 0x18005c4f2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
je 0x18005c4f2
xor eax, eax
jmp 0x18005c588
mov eax, dword [rbx + 0x46c]
and dword [rbx + 4], 0
and eax, 0x400200
and dword [rbx + 0x10], 0
and dword [rbx + 0x448], 0
and dword [rbx + 0x44c], 0
mov dword [rbx], 1
mov dword [rbx + 0x42c], 0x14
mov byte [rbx + 0x469], 0
mov byte [rbx + 0x450], 0
cmp eax, 0x200
jne 0x18005c555
mov rdx, rbx
mov rcx, rdi
call fcn.18005bbd0
test eax, eax
je 0x18005c555
and qword [rbx + 8], 0
mov dword [rbx + 4], 8
jmp 0x18005c57c
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x3c]
and dword [rsp + 0x3c], 0
xor r9d, r9d
mov qword [rbx + 8], rcx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov eax, 1
jmp 0x18005c588
call fcn.18005ccb4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18005c59c
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
cmp byte [rdx + 0x469], 0
mov rbx, rdx
mov rsi, rcx
je 0x18005c697
lea rdi, [rdx + 0x438]
mov r9d, dword [rdi]
lea rdx, [rsp + 0x50]
mov r8, qword [rbx + 0x440]
mov rcx, rsi
mov byte [rsp + 0x40], 1
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtQueryEaFile]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
js 0x18005c60e
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x18005c670
cmp ecx, 0x80000005
je 0x18005c622
cmp ecx, 0xc0000023
jne 0x18005c6b1
mov r9d, 4
mov dword [rsp + 0x20], 7
lea r8, [rsp + 0x78]
mov rcx, rsi
lea rdx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x18005c6b1
mov eax, dword [rsp + 0x78]
mov rcx, rdi
lea edx, [rax + rax*4]
shr edx, 2
call fcn.18005e508
test eax, eax
jne 0x18005c5c5
mov byte [rbx + 0x46b], 1
jmp 0x18005c6b6
and dword [rbx + 4], 0
and dword [rbx + 0x10], 0
mov word [rbx + 0x468], 1
mov dword [rbx], 2
mov dword [rbx + 0x42c], 0x14
mov qword [rbx + 8], rax
jmp 0x18005c6b1
mov ecx, dword [rdx + 0x42c]
cmp qword [rdx + 0x420], rcx
jl 0x18005c6b1
mov rdx, r8
mov rcx, rbx
call fcn.18005c3fc
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18005c6d0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rsp + 0x78], rax
cmp byte [rdx + 0x469], 0
mov rax, r8
mov rbx, rdx
mov rbp, rcx
je 0x18005c83e
mov eax, dword [rdx + 0x46c]
mov edi, 0x1000
and eax, 0x10
test al, al
jne 0x18005c859
lea rdx, [rsp + 0x54]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
nop dword [rax + rax]
mov dword [rsp + 0x50], eax
cmp eax, 0xffffffff
jne 0x18005c74b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
je 0x18005c74b
xor eax, eax
jmp 0x18005c85e
mov rax, qword [rsp + 0x50]
and qword [rsp + 0x68], 0
mov qword [rsp + 0x70], rax
mov edx, edi
lea rcx, [rbx + 0x438]
call fcn.18005e508
test eax, eax
je 0x18005c832
mov rax, qword [rbx + 0x440]
xor r9d, r9d
and qword [rsp + 0x60], 0
xor r8d, r8d
mov dword [rsp + 0x48], edi
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, rbp
mov dword [rsp + 0x38], 0x10
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 0x903b0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtFsControlFile]
nop dword [rax + rax]
cmp eax, 0x80000005
jne 0x18005c7cd
add edi, edi
jmp 0x18005c75b
cmp eax, 0xc0000010
je 0x18005c859
cmp eax, 0xc0000002
je 0x18005c859
cmp eax, 0xc00000bb
je 0x18005c859
test eax, eax
jns 0x18005c7f6
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
jmp 0x18005c744
mov rax, qword [rbx + 0x440]
cmp dword [rax + 4], 0
je 0x18005c859
mov rax, qword [rsp + 0x60]
and dword [rbx + 0x10], 0
mov qword [rbx + 8], rax
mov word [rbx + 0x468], 1
mov dword [rbx], 0xb
mov dword [rbx + 4], 0x10
mov dword [rbx + 0x42c], 0x14
jmp 0x18005c859
mov byte [rbx + 0x46b], 1
jmp 0x18005c744
mov r8d, dword [rdx + 0x42c]
cmp qword [rdx + 0x420], r8
jl 0x18005c859
mov rdx, rax
mov rcx, rbx
call fcn.18005c3fc
mov eax, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005ccb4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
cmp byte [rdx + 0x450], 0
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
je 0x18005cd59
mov ebx, dword [rdx + 0x44c]
lea r8, [rsp + 0x4c]
add rbx, qword [rdx + 0x440]
xor r9d, r9d
mov rax, qword [rbx + 8]
and dword [rdx + 0x10], 0
add rax, 8
mov qword [rdx + 8], rax
mov dword [rdx], 9
mov dword [rdx + 4], 8
mov dword [rdx + 0x42c], 0x1c
mov rax, qword [rbx]
mov qword [rdx + 0x418], rax
mov qword [rdx + 0x14], rax
mov byte [rdx + 0x450], 0
mov eax, dword [rbx + 4]
mov dword [rsp + 0x4c], eax
mov edx, dword [rbx]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov dword [rsp + 0x48], eax
mov rax, qword [rbx]
cmp qword [rsp + 0x48], rax
je 0x18005cd68
mov byte [rdi + 0x46b], 1
jmp 0x18005cde4
mov eax, dword [rdx + 0x42c]
cmp qword [rdx + 0x420], rax
jge 0x18005cd6f
mov eax, 1
jmp 0x18005cde6
mov edx, dword [rbx + 0x10]
lea r8, [rsp + 0x48]
mov rcx, rdi
call fcn.18005e3f8
test eax, eax
je 0x18005cde4
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x58]
mov rdx, qword [rbx]
mov rcx, rbp
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
mov r8d, dword [rsp + 0x58]
test r8d, r8d
je 0x18005cdc8
mov rcx, qword [rbx + 8]
mov edx, r8d
add qword [rdi + 0x420], rdx
sub dword [rbx + 0x10], r8d
add dword [rcx], edx
add qword [rbx], rdx
jmp 0x18005cde6
test eax, eax
je 0x18005cde6
cmp dword [rsp + 0x48], 0
je 0x18005cde6
mov ecx, 0x45d
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18005e0d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp byte [rdx + 0x450], 0
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
je 0x18005e16a
cmp byte [rdx + 0x451], 0
mov rax, qword [rdx + 0x14]
mov qword [rdx + 0x418], rax
mov qword [rsp + 0x30], rax
je 0x18005e111
mov rcx, qword [rdx + 0x430]
mov edx, dword [rsp + 0x30]
lea r8, [rsp + 0x34]
xor r9d, r9d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
mov rax, qword [rbx + 0x418]
cmp qword [rsp + 0x30], rax
jne 0x18005e17e
cmp qword [rbx + 8], 8
jne 0x18005e163
cmp byte [rbx + 0x451], 0
je 0x18005e154
mov rcx, qword [rbx + 0x430]
jmp 0x18005e157
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
nop dword [rax + rax]
mov byte [rbx + 0x450], 0
mov edx, dword [rsi + 0x10]
lea r8, [rsp + 0x58]
mov rcx, rbx
call fcn.18005e3f8
test eax, eax
jne 0x18005e182
xor eax, eax
jmp 0x18005e1cb
cmp byte [rbx + 0x451], 0
je 0x18005e192
mov rdi, qword [rbx + 0x430]
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x68]
mov rdx, qword [rsi]
mov rcx, rdi
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
mov edx, dword [rsp + 0x68]
add qword [rbx + 0x420], rdx
mov rcx, qword [rsi + 8]
sub dword [rsi + 0x10], edx
add dword [rcx], edx
add qword [rsi], rdx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x18005e1e4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x60
cmp byte [rdx + 0x469], 0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
je 0x18005e29c
test byte [rdx + 4], 8
je 0x18005e248
and dword [rax - 0x20], 0
xor r9d, r9d
and qword [rax - 0x28], 0
xor r8d, r8d
and dword [rax - 0x30], 0
xor edx, edx
and qword [rax - 0x38], 0
mov dword [rax - 0x40], 0x900c4
lea rax, [rax - 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtFsControlFile]
nop dword [rax + rax]
jmp 0x18005e295
mov rax, qword [rdx + 8]
lea r8, [rsp + 0x7c]
mov edx, eax
mov qword [rsp + 0x78], rax
xor r9d, r9d
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetEndOfFile]
nop dword [rax + rax]
and qword [rsp + 0x78], 0
lea r8, [rsp + 0x7c]
xor r9d, r9d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFilePointer]
nop dword [rax + rax]
mov byte [rbx + 0x469], 0
mov edx, dword [rdi + 0x10]
lea r8, [rsp + 0x78]
mov rcx, rbx
call fcn.18005e3f8
test eax, eax
je 0x18005e2ef
mov r8d, dword [rsp + 0x78]
lea r9, [rsp + 0x80]
mov rdx, qword [rdi]
mov rcx, rsi
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
nop dword [rax + rax]
mov edx, dword [rsp + 0x80]
add qword [rbx + 0x420], rdx
mov rcx, qword [rdi + 8]
sub dword [rdi + 0x10], edx
add dword [rcx], edx
add qword [rdi], rdx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18005e740
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x40], 0x30
lea r8, [r11 - 0x58]
mov qword [r11 - 0x50], rcx
xorps xmm0, xmm0
mov dword [rsp + 0x58], 0x40
lea rcx, [r11 - 0x68]
mov qword [r11 - 0x48], rdx
mov edx, 0x80000000
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
xor edi, edi
test eax, eax
js 0x18005e7eb
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x20], 0x10
xor edx, edx
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
cmp eax, 0x80000005
mov ebx, eax
cmove ebx, edi
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180024680
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret
Function at 0x180061210
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r14, r8
mov r15, rdx
mov r12, rcx
mov rdi, qword [rsp + 0x80]
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800612b9
call qword [sym.imp.ntdll.dll_RtlGetCurrentTransaction]
nop dword [rax + rax]
xor ebx, ebx
test rax, rax
je 0x18006126d
mov ecx, 0x1a45
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x1800612cc
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
nop
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, r14
mov rdx, r15
mov rcx, r12
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_CopyFileExW]
nop dword [rax + rax]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
jmp 0x1800612cc
mov ecx, 0x1a2c
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x180061cd0
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov r15, r9
mov rsi, r8
mov r14, rdx
mov rdi, rcx
xor ebx, ebx
lea rax, [r9 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180061d69
call qword [sym.imp.ntdll.dll_RtlGetCurrentTransaction]
nop dword [rax + rax]
test rax, rax
je 0x180061d19
mov ecx, 0x1a45
jmp 0x180061d6e
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
nop
test rdi, rdi
je 0x180061d45
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_CreateDirectoryExW]
nop dword [rax + rax]
jmp 0x180061d57
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
nop dword [rax + rax]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
jmp 0x180061d7a
mov ecx, 0x1a2c
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x180061dc0
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
lea rax, [rdx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180061e36
call qword [sym.imp.ntdll.dll_RtlGetCurrentTransaction]
nop dword [rax + rax]
xor ebx, ebx
test rax, rax
je 0x180061e05
mov ecx, 0x1a45
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x180061e49
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
nop
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_RemoveDirectoryW]
nop dword [rax + rax]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlSetCurrentTransaction]
nop dword [rax + rax]
jmp 0x180061e49
mov ecx, 0x1a2c
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor ebx, ebx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret