joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e1a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000e3ce
mov word [rbp + 0x50], 0x6142
mov word [rbp + 0x58], 0x6142
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000e254
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000e240
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000e285
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000e270
cmp rdi, rbx
jne 0x14000e3a2
mov r13, rsi
mov word [rbp - 0x50], 0x6142
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000e2c6
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000e2b2
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000e3c8
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x610023
call fcn.140002490
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000e338
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x610038
call fcn.140002490
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000e338
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x610023
mov dword [rbp - 0x42], 0x610003
call fcn.140002490
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x610023
call fcn.140002490
movzx eax, word [rax]
cmp edi, eax
jl 0x14000e395
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x610038
call fcn.140002490
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000e395
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x610023
mov dword [rbp - 0x32], 0x610003
call fcn.140002490
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000e3a2
inc r14
jmp 0x14000e2a0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000e3ce
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000e210
mov rax, qword [rbp - 8]
jmp 0x14000e3d0
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ebc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000bb32
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000eca0
test al, al
jne 0x14000bb44
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000bb00
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x61
mov dword [rbp - 0x20], 0x240009
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], bx
mov dword [rbp - 0x1c], 0x3a0020
mov dword [rbp - 0x18], 0x28004c
mov dword [rbp - 0x14], 0x2f003b
mov dword [rbp - 0x10], 0x210032
call fcn.140004fd0
mov rcx, rax
call 0x14000bad0
lea rcx, [rbp - 0x20]
mov qword [0x1400191b8], rax
mov dword [rbp - 0x20], 0x240009
mov dword [rbp - 0x1c], 0x3a0020
mov dword [rbp - 0x18], 0x28004c
mov dword [rbp - 0x14], 0x5c004a
mov word [rbp - 0x10], bx
call fcn.1400022a0
mov rcx, rax
call 0x14000bad0
lea rcx, [rbp - 0x20]
mov qword [0x1400191a8], rax
mov dword [rbp - 0x20], 0x15002c
mov dword [rbp - 0x1c], 0x180016
mov dword [rbp - 0x18], 0x640065
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp 0x14000bad0
Function at 0x180005680
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x180075010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x24], edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.18003aac0
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rcx, vtable.CVolObject.0
mov qword [rbx], rcx
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
lea rdx, vtable.CWString.0
mov qword [rbx], rdx
lea rax, [rbx + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rax], rcx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
lea rcx, vtable.CVolMem.0
mov qword [rax], rcx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x28], rdi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x30], 0x40
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x50], 0xfe
mov qword [rbx], rdx
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.18002b590
nop
mov dword [rsp + 0x24], 1
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180038940
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret

Function at 0x180005770
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x180075010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x24], edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.18003aac0
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.DLL_GetComputerNameW]
lea rcx, vtable.CVolObject.0
mov qword [rbx], rcx
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
lea rdx, vtable.CWString.0
mov qword [rbx], rdx
lea rax, [rbx + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rax], rcx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
lea rcx, vtable.CVolMem.0
mov qword [rax], rcx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x28], rdi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x30], 0x40
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x50], 0xfe
mov qword [rbx], rdx
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.18002b590
nop
mov dword [rsp + 0x24], 1
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180038940
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
Function at 0x180006480
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov r12, rdx
mov rsi, rcx
xor r13d, r13d
mov dword [rbp - 0x49], r13d
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x39], rcx
lea rdi, vtable.CVolObject.0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x29], r13
lea rax, vtable.CWString.0
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], r13
lea rbx, vtable.CVolMem.0
mov qword [rbp - 0x19], rbx
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp + 0x17], 0x40
mov qword [rbp - 0x21], r13
mov qword [rbp + 0x17], 0xfe
mov rcx, rdx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r14d, eax
test eax, eax
jne 0x18000658a
mov rax, qword [rbp - 0x21]
test rax, rax
jne 0x180006543
lea rax, [0x18005ec08]
cmp qword [rbp + 0xf], r13
cmovne rax, qword [rbp - 1]
mov rdx, rax
mov rcx, rsi
call fcn.180003960
mov dword [rbp - 0x49], 1
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
mov qword [rbp - 0x19], rbx
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x180006575
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x19], rdi
jmp 0x180006677
inc r14d
movsxd r15, r14d
mov eax, 2
mul r15
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180038fb0
mov rbx, rax
test r14d, r14d
je 0x1800065c7
movzx eax, r13w
mov rdi, rbx
mov rcx, r15
rep stosw word [rdi], ax
lea rdi, vtable.CVolObject.0
mov r8d, r14d
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov qword [rbp - 0x21], r13
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x1800065ee
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
cmp word [rbx], 0
je 0x18000660c
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.18002a2f0
mov rcx, rbx
call fcn.180038f7c
mov rax, qword [rbp - 0x21]
test rax, rax
jne 0x18000662e
lea rax, [0x18005ec08]
cmp qword [rbp + 0xf], 0
cmovne rax, qword [rbp - 1]
mov rdx, rax
mov rcx, rsi
call fcn.180003960
mov dword [rbp - 0x49], 1
lea rax, [rbp - 0x19]
mov qword [rbp + 0x6f], rax
lea rax, vtable.CVolMem.0
mov qword [rbp - 0x19], rax
mov rdx, qword [rbp - 1]
test rdx, rdx
je 0x180006667
lea rcx, [rbp - 0x19]
mov rax, qword [rbp - 0x19]
call qword [rax + 0x18]
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 7], r13
mov qword [rbp - 0x19], rdi
mov qword [rbp - 0x39], rdi
mov rax, rsi
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180010920
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, qword [0x180078a18]
mov rsi, rdx
call qword [0x180075b70]
xor edx, edx
mov ecx, 0x1f0fff
mov r8, rax
call qword [0x180075b28]
movsxd r8, dword [rsi + 0x28]
mov r9d, 0x40
mov rbp, rax
mov rdx, r14
lea rax, [rsp + 0x50]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
cmp eax, 1
mov r15d, 0xffffffff
mov rax, qword [rsi + 0x28]
cmove r15d, dword [rsp + 0x50]
xor edi, edi
mov r8d, edi
test rax, rax
je 0x1800109a1
mov r8, qword [rsi + 0x18]
movsxd r9, eax
mov rdx, r14
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call qword [0x180075b88]
movsxd r8, dword [rsi + 0x28]
mov r9d, r15d
mov rbx, rax
mov rdx, r14
lea rax, [rsp + 0x50]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
mov rcx, rbp
call qword [0x180075b10]
mov rbp, qword [rsp + 0x60]
test rbx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
setne dil
mov eax, edi
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1800165b0
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x68
mov rax, qword [0x180075010]
xor rax, rsp
mov qword [rsp + 0x58], rax
call fcn.18003e498
add ax, 0x40
lea r9, [rsp + 0x40]
mov word [rsp + 0x50], ax
lea rcx, [rsp + 0x50]
mov eax, dword [0x1800623b8]
xor r8d, r8d
mov dword [rsp + 0x52], eax
xor edx, edx
movzx eax, word [0x1800623bc]
mov word [rsp + 0x56], ax
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
mov ecx, 0xffffffff
cmovne ecx, dword [rsp + 0x40]
mov eax, ecx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180038940
add rsp, 0x68
ret

Function at 0x180020280
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, rdx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov rdx, qword [rcx + 0x18]
mov rdi, qword [rdx + 0x80]
mov rdi, qword [rdi]
test rdi, rdi
je 0x180020373
call fcn.1800017a0
mov rcx, rax
test rax, rax
je 0x1800203a9
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebp, [rax + 1]
test ebp, ebp
js 0x18002039e
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, ebp
or eax, ecx
jge 0x18002030f
mov edx, ebp
lea rcx, [rsp + 0x50]
call fcn.1800212f0
mov rbx, qword [rsp + 0x50]
mov r8d, ebp
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x18002032f
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.18003e834
test eax, eax
js 0x18002039e
cmp eax, dword [rbx - 0xc]
jg 0x18002039e
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
mov rdx, rbx
mov rcx, rsi
call fcn.180003960
mov dword [rsp + 0x20], 1
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180020388
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x180020388
add rdx, 0x10
mov rcx, rsi
call fcn.180001c70
nop
mov dword [rsp + 0x20], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.18001e280
nop
mov ecx, 0x80004005
call fcn.18001e280
int3
Function at 0x180021350
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
test edi, edi
js 0x1800213ed
mov rdx, qword [rbx]
mov r8d, 1
mov eax, dword [rdx - 0xc]
sub r8d, dword [rdx - 8]
sub eax, edi
or r8d, eax
jge 0x180021399
mov edx, edi
mov rcx, rbx
call fcn.1800212f0
mov rdx, qword [rbx]
mov rcx, qword [rsi]
mov r8d, edi
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor esi, esi
mov edi, eax
cmp eax, 0xffffffff
jne 0x1800213c3
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1800213ba
mov eax, esi
jmp 0x1800213c7
movsxd rdx, dword [rcx - 0xc]
call fcn.18003e834
test eax, eax
js 0x1800213ed
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1800213ed
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov word [rax + rcx*2], si
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.18001e280
int3
Function at 0x1800275b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, r9
mov qword [r8 + 0x28], rsi
mov rbx, r8
mov rbp, rdx
test rdx, rdx
jne 0x1800275e2
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
mov rax, qword [rcx]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r15
call qword [rax]
movzx edx, bp
mov r8, r14
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_FindResourceW]
mov r15, rax
test rax, rax
je 0x1800276d7
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_LoadResource]
mov rbp, rax
test rax, rax
je 0x1800276d7
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LockResource]
mov r14, rax
test rax, rax
je 0x1800276ce
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
mov qword [rbx + 0x28], rsi
cmp qword [rbx + 0x20], rdi
jl 0x1800276ac
cmp rdi, 1
jne 0x18002766a
movzx ecx, byte [r14]
mov rax, qword [rbx + 0x18]
mov byte [rax], cl
inc qword [rbx + 0x28]
jmp 0x1800276c9
cmp rdi, 2
jne 0x180027681
movzx ecx, word [r14]
mov rax, qword [rbx + 0x18]
mov word [rax], cx
add qword [rbx + 0x28], rdi
jmp 0x1800276c9
cmp rdi, 4
jne 0x180027696
mov ecx, dword [r14]
mov rax, qword [rbx + 0x18]
mov dword [rax], ecx
add qword [rbx + 0x28], rdi
jmp 0x1800276c9
cmp rdi, 8
jne 0x1800276ac
mov rcx, qword [r14]
mov rax, qword [rbx + 0x18]
mov qword [rax], rcx
add qword [rbx + 0x28], rdi
jmp 0x1800276c9
test eax, eax
je 0x1800276c9
mov rdx, rdi
mov rcx, rbx
call fcn.18002a210
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.18003a6b0
mov esi, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_FreeResource]
mov r15, qword [rsp + 0x48]
mov rax, rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
Function at 0x180028c10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
test rcx, rcx
je 0x180028d4f
cmp word [rcx], 0
je 0x180028d4f
lea rdx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rbp - 0x60], rdx
lea rsi, vtable.CVolObject.0
mov qword [rbp - 0x60], rsi
xor edi, edi
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
lea rax, vtable.CWString.0
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
lea r14, vtable.CVolMem.0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], 0x40
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x10], 0xfe
cmp word [rcx], di
je 0x180028d06
cmp word [rcx + 2], di
je 0x180028d06
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rcx + r8*2], 0
jne 0x180028cc0
cmp word [rcx + r8*2 - 2], 0x5c
jne 0x180028d06
cmp word [rcx + r8*2 - 4], 0x3a
je 0x180028d06
dec r8
mov rdx, rcx
lea rcx, [rbp - 0x60]
call fcn.18002b6b0
mov rcx, qword [rbp - 0x48]
test rcx, rcx
jne 0x180028d06
lea rcx, [0x18005ec08]
cmp qword [rbp - 0x18], 0
cmovne rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov rbx, rdi
cmp eax, 0xffffffff
setne bl
lea rax, [rbp - 0x40]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x180028d36
lea rcx, [rbp - 0x40]
mov r8, qword [rbp - 0x40]
call qword [r8 + 0x18]
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x60], rsi
mov rax, rbx
jmp 0x180028d51
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180028d70
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x180075010]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rcx
test rcx, rcx
je 0x180028f5f
cmp word [rcx], 0
je 0x180028f5f
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x20], rcx
lea r14, vtable.CVolObject.0
mov qword [rsp + 0x20], r14
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
lea rax, vtable.CWString.0
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
lea r15, vtable.CVolMem.0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], 0x40
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x70], 0xfe
mov ebx, esi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
movzx eax, word [rdi]
cmp ax, 0x5c
je 0x180028e6b
test ax, ax
je 0x180028eaa
cmp word [rdi + 2], 0x3a
jne 0x180028eaa
cmp word [rdi + 4], 0x5c
jne 0x180028eaa
mov edx, 0x5c
mov rcx, rdi
call fcn.18003a260
test rax, rax
je 0x180028ea5
cmp rax, rdi
jbe 0x180028e8e
lea rcx, [rax - 2]
cmp word [rcx], 0x3a
cmovne rax, rcx
sub rax, rdi
lea r8, [rax + 2]
sar r8, 1
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.18002b6b0
mov rbx, qword [rsp + 0x38]
test rbx, rbx
jne 0x180028ec9
cmp qword [rsp + 0x68], rbx
jne 0x180028ebf
lea rbx, [0x18005ec08]
jmp 0x180028ec9
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x180028f10
cmp word [rbx], 0
je 0x180028f10
lea rdx, [rbp - 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
test eax, eax
je 0x180028f10
cmp word [rbx], 0
je 0x180028ef1
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov rbx, rax
cmp word [rbp - 0x70], 0
je 0x180028f1c
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
jmp 0x180028f1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov rbx, rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], r15
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x180028f41
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0x40]
call qword [rax + 0x18]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x20], r14
mov rax, rbx
jmp 0x180028f61
xor eax, eax
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.180038940
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret