joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180009a30
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp ecx, 3
jne 0x180009a9c
lea rcx, [0x1800015f0]
call fcn.180004a90
xor ebx, ebx
test rax, rax
je 0x180009a57
call fcn.180004a90
lea rcx, [rax + 1]
lea r8, [0x180001c10]
mov edx, 0x766
call qword [0x180029278]
mov cl, 1
call fcn.18000f7dc
mov rcx, qword [0x1800281a8]
add rcx, 5
call fcn.180005a44
mov rax, qword [0x1800281a8]
or byte [rax + 4], 2
add rax, 5
je 0x180009b23
xchg byte [rax], bl
jmp 0x180009b23
cmp ecx, 2
jne 0x180009aeb
lea rcx, [0x1800015f0]
call fcn.180004a90
test rax, rax
je 0x180009abb
call fcn.180004a90
lea rcx, [rax + 1]
lea r8, [0x180001c40]
mov edx, 0x76c
call qword [0x180029278]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x180009b23
cmp ecx, 1
jne 0x180009b23
lea rcx, [0x1800015f0]
call fcn.180004a90
test rax, rax
je 0x180009b0a
call fcn.180004a90
lea rcx, [rax + 1]
lea r8, [0x180001c70]
mov edx, 0x776
call qword [0x180029278]
mov cl, 1
call fcn.18000f7dc
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x180009cac
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x130
mov rcx, qword [0x180029068]
lea rdx, [0x180001bd8]
call fcn.18000c674
mov rdi, rax
test rax, rax
je 0x180009e76
cmp byte [rax], 8
jne 0x180009e76
mov r14d, dword [rax + 0x118]
test r14d, r14d
je 0x180009e76
call fcn.18000c198
xor esi, esi
mov r12, rax
test r14d, r14d
je 0x180009e71
xor r15d, r15d
lea r13, [0x1800015f0]
mov ecx, esi
or ecx, 1
bsr edx, ecx
mov rcx, qword [rdi + rdx*8 + 0x10]
lea rdx, [0x180001be0]
mov rcx, qword [r15 + rcx]
call fcn.18000c674
test rax, rax
je 0x180009d51
cmp byte [rax], 4
jne 0x180009d51
mov rbx, qword [rax + 0x10]
jmp 0x180009d58
lea rbx, [0x18000175a]
cmp byte [rbx], 0
je 0x180009e62
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180025ca4
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r11d, 0x104
lea r9, [rsp + 0x20]
mov r8d, r11d
lea rdx, [0x180001084]
lea rcx, [rsp + 0x20]
call fcn.1800049fc
lea r9, [rsp + 0x20]
mov r8d, r11d
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1800049fc
lea r9, [rsp + 0x20]
mov r8d, r11d
lea rdx, [0x180001be8]
lea rcx, [rsp + 0x20]
call fcn.1800049fc
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180009e16
mov rcx, r13
call fcn.180004a90
test rax, rax
je 0x180009df7
call fcn.180004a90
inc rax
jmp 0x180009dfa
mov rax, r13
lea r8, [0x180001ca0]
mov edx, 0x812
lea r9, [rsp + 0x20]
mov rcx, rax
call qword [0x180029278]
jmp 0x180009e62
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180009b2c
test eax, eax
jne 0x180009e4f
mov rcx, r13
call fcn.180004a90
test rax, rax
je 0x180009e3e
call fcn.180004a90
inc rax
jmp 0x180009e41
mov rax, r13
lea r8, [0x180001cc0]
mov edx, 0x818
jmp 0x180009e06
mov rcx, rbx
call fcn.18000bb7c
mov rdx, rax
mov rcx, r12
call fcn.18000bd44
inc esi
add r15, 8
cmp esi, r14d
jb 0x180009d24
mov rax, r12
jmp 0x180009e78
xor eax, eax
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180009e9c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov ebx, edx
mov rsi, r8
xor edx, edx
mov rdi, rcx
lea rcx, [rbp + 0x17]
lea r8d, [rdx + 0x40]
call fcn.180025ca4
mov rax, qword [0x180027080]
lea rcx, [rbp + 0x17]
mov r8d, ebx
mov rdx, rdi
call qword [rax + 0x200]
xor eax, eax
mov qword [rbp - 0x29], rax
xor ecx, ecx
mov qword [rbp - 0x21], rax
lea ebx, [rax + 0x10]
mov al, byte [rbp + rcx*4 + 0x18]
add al, byte [rbp + rcx*4 + 0x17]
xor al, byte [rbp + rcx*4 + 0x19]
rol al, 3
xor al, byte [rbp + rcx*4 + 0x1a]
mov byte [rbp + rcx - 0x29], al
inc rcx
cmp rcx, rbx
jl 0x180009ef4
xor edx, edx
lea rcx, [rbp - 0x19]
lea r8d, [rdx + 0x30]
call fcn.180025ca4
lea r9, [rbp - 0x29]
lea r8, [rbp - 0x19]
mov dl, byte [r9]
mov cl, dl
and dl, 0xf
shr cl, 4
cmp cl, 0xa
sbb al, al
and al, 0xf9
add al, 0x37
add al, cl
mov byte [r8], al
cmp dl, 0xa
lea r8, [r8 + 2]
sbb al, al
inc r9
and al, 0xf9
add al, 0x37
add al, dl
mov byte [r8 - 1], al
sub rbx, 1
jne 0x180009f2a
mov rdx, rsi
mov byte [r8], bl
lea rcx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x180009fac
lea rcx, [0x1800015f0]
call fcn.180004a90
test rax, rax
je 0x180009f8d
call fcn.180004a90
lea rcx, [rax + 1]
lea r9, [rbp - 0x19]
mov qword [rsp + 0x20], rsi
lea r8, [0x180001ce8]
mov edx, 0x832
call qword [0x180029278]
xor al, al
jmp 0x180009fae
mov al, 1
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18000cee4
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x140
movzx esi, dx
mov edi, r8d
mov rdx, rcx
mov r10d, 0x104
mov rbx, rcx
mov r8d, r10d
lea rcx, [rsp + 0x30]
call fcn.1800049c4
lea r9, [rsp + 0x30]
mov r8d, r10d
lea rdx, [0x180001d4c]
lea rcx, [rsp + 0x30]
call fcn.1800049fc
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18000cf42
mov al, 1
jmp 0x18000cfa4
mov rax, qword [0x180027080]
lea rcx, [rsp + 0x30]
mov r8d, edi
movzx edx, si
call qword [rax + pe_nt_image_headers64]
mov r8d, eax
test eax, eax
je 0x18000cfb9
lea rcx, [0x180001d90]
call fcn.180004a90
test rax, rax
je 0x18000cf7b
call fcn.180004a90
lea rcx, [rax + 1]
mov dword [rsp + 0x20], r8d
lea r9, [rsp + 0x30]
lea r8, [0x180001d58]
mov edx, 0x55
call qword [0x180029278]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov r8d, 1
lea rcx, [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x18000cfa2
mov rax, qword [0x180027080]
mov rcx, rbx
call qword [rax + 0x198]
jmp 0x18000cf3e
Function at 0x18000d580
Capabilities:
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
lea rcx, [0x180029259]
call fcn.180005a44
mov edx, dword [0x180029228]
lea r12, [0x180029120]
xor ebp, ebp
mov edi, ebp
lea r14d, [rbp + 1]
test edx, edx
je 0x18000d6cc
lea r15, [0x180001d90]
mov eax, edi
or eax, r14d
bsr ecx, eax
mov eax, ecx
mov dword [rsp + 0x70], ecx
mov ecx, edi
mov rax, qword [r12 + rax*8]
mov rbx, qword [rax + rcx*8]
cmp word [rbx + 2], 0xa
jb 0x18000d6c1
mov r8b, byte [rbx + 0xc]
cmp r8b, 3
jne 0x18000d654
movzx esi, bp
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
add si, r14w
cmp si, 0x78
jbe 0x18000d64a
mov rcx, r15
call fcn.180004a90
test rax, rax
je 0x18000d61a
call fcn.180004a90
lea rcx, [r14 + rax]
movzx eax, byte [rbx + 0xc]
lea r8, [0x180001ef8]
movzx r9d, word [rbx + 2]
mov edx, 0x10e
mov dword [rsp + 0x20], eax
call qword [0x180029278]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r8b, byte [rbx + 0xc]
cmp r8b, 3
je 0x18000d5ef
mov rcx, r15
call fcn.180004a90
test rax, rax
je 0x18000d66a
call fcn.180004a90
lea rcx, [r14 + rax]
movzx r9d, word [rbx + 2]
mov edx, 0x119
movzx eax, r8b
lea r8, [0x180001f20]
mov dword [rsp + 0x20], eax
call qword [0x180029278]
cmp qword [rbx + 0x18], rbp
je 0x18000d6bb
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18000d6bb
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x18000d6ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000d6b7
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x20], rbp
mov edx, dword [0x180029228]
add edi, r14d
cmp edi, edx
jb 0x18000d5bf
mov ebx, ebp
test edx, edx
je 0x18000d726
mov eax, ebx
or eax, r14d
bsr ecx, eax
mov eax, ecx
mov dword [rsp + 0x78], ecx
mov ecx, ebx
mov rax, qword [r12 + rax*8]
mov rdi, qword [rax + rcx*8]
mov qword [rsp + 0x80], rdi
cmp word [rdi + 2], 0xa
jb 0x18000d71f
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x18000d70c
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x18000d6f9
mov rcx, rdi
mov qword [rdi + 0x18], rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [0x180029228]
add ebx, r14d
cmp ebx, edx
jb 0x18000d6d2
mov rcx, r12
call fcn.180010a5c
mov eax, ebp
xchg byte [0x180029259], al
mov rbx, qword [0x180029260]
jmp 0x18000d74c
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbx, rbx
jne 0x18000d73f
mov rbx, qword [0x180029248]
jmp 0x18000d767
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbx, rbx
jne 0x18000d75a
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000f5ac
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x360
xor r8d, r8d
lea rcx, [rsp + 0x250]
call fcn.180005038
lea r8, [rsp + 0x250]
lea rdx, [0x180001f38]
lea rcx, [rsp + 0x140]
call fcn.18000542c
xor edx, edx
lea r8, [rsp + 0x140]
lea ebx, [rdx + 6]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov qword [0x180027098], rax
test rax, rax
jne 0x18000f671
mov edx, 0x50000
lea rcx, [rsp + 0x140]
call fcn.180004ab8
mov qword [0x180027098], rax
test rax, rax
jne 0x18000f628
lea eax, [rbx - 8]
jmp 0x18000f7d3
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [0x1800281a8], rax
mov rbx, rax
test rax, rax
je 0x18000f7ce
xor edx, edx
mov r8d, 0x50000
mov rcx, rax
call fcn.180025ca4
mov dword [rbx], 0x7766736e
mov byte [rbx + 7], 1
jmp 0x18000f70b
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, qword [0x180027098]
mov qword [0x1800281a8], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x180027098], 0
mov rbx, qword [0x1800281a8]
test rbx, rbx
je 0x18000f7ce
cmp dword [rbx], 0x7766736e
jne 0x18000f7ce
xor edx, edx
mov r8d, 0x50000
mov rcx, rbx
call fcn.180025ca4
lea rcx, [rbx + 5]
mov dword [rbx], 0x7766736e
mov byte [rbx + 7], 1
call fcn.180005a44
mov rcx, qword [0x1800281a8]
mov r8b, byte [rcx + 4]
lea rdx, [rcx + 5]
and r8b, 1
test rdx, rdx
je 0x18000f706
xor eax, eax
xchg byte [rdx], al
mov rcx, qword [0x1800281a8]
test r8b, r8b
je 0x18000f77c
xor ecx, ecx
call fcn.18000f7dc
mov rcx, qword [0x1800281a8]
add rcx, 5
call fcn.180005a44
mov rax, qword [0x1800281a8]
and byte [rax + 4], 0xfd
lea rcx, [rax + 5]
test rcx, rcx
je 0x18000f73a
xor eax, eax
xchg byte [rcx], al
lea r8, [rsp + 0x30]
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.180004fd8
lea r9, [rsp + 0x30]
mov r8d, 0x108
lea rdx, [0x180001d4c]
lea rcx, [rsp + 0x30]
call fcn.1800049fc
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [0x1800281a8]
add rcx, 5
call fcn.180005a44
mov rax, qword [0x1800281a8]
inc dword [rax + 8]
lea rcx, [rax + 5]
test rcx, rcx
je 0x18000f79c
xor eax, eax
xchg byte [rcx], al
and qword [0x180028210], 0
and qword [0x180028208], 0
and dword [0x180028218], 0
and qword [0x180028230], 0
and qword [0x180028228], 0
and dword [0x180028238], 0
xor eax, eax
jmp 0x18000f7d3
mov eax, 0xffffffec
add rsp, 0x360
pop rbx
ret
Function at 0x18000f81c
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information
Initialize winsock library

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r15
lea rbp, [rax - 0x318]
sub rsp, 0x400
mov dl, byte [rcx]
mov rdi, rcx
mov rax, rcx
jmp 0x18000f852
cmp dl, 0x3a
je 0x18000f858
inc rax
mov dl, byte [rax]
test dl, dl
jne 0x18000f848
xor eax, eax
or rbx, 0xffffffffffffffff
lea r15, [0x180028480]
test rax, rax
je 0x18000f872
call fcn.180005564
jmp 0x18000f963
mov r12d, 2
lea rdx, [rbp + 0x160]
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x18000f942
lea r8d, [r12 + 0xf]
mov edx, r12d
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp eax, ebx
je 0x18000f93c
xor eax, eax
mov dword [rbp + 0x320], reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov word [rsp + 0x30], r12w
mov qword [rsp + 0x38], rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov r8d, dword [rbp + 0x320]
lea rdx, [rsp + 0x30]
movsxd rdi, esi
mov rcx, rdi
mov dword [rsp + 0x34], eax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, ebx
je 0x18000f933
lea r8, [rbp + 0x320]
mov rcx, rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, ebx
je 0x18000f933
mov ecx, dword [rsp + 0x44]
lea esi, [r12 + 0x7e]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rcx, r15
sub rcx, rax
mov dl, byte [rax]
dec rsi
mov byte [rcx + rax], dl
inc rax
test dl, dl
je 0x18000f933
test rsi, rsi
jne 0x18000f91f
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
cmp byte [0x180028480], 0
je 0x18000f95e
lea rdx, [0x180001170]
mov rcx, r15
call fcn.180025cc8
test eax, eax
jne 0x18000f963
call fcn.1800054b0
xor r8d, r8d
mov byte [rbp + 0x60], 0
lea rcx, [rbp + 0x60]
mov byte [rsp + 0x50], 0
call fcn.180005038
lea r9, [0x180001f54]
lea r8, [rbp + 0x60]
lea rdx, [0x180001f58]
lea rcx, [rsp + 0x50]
call fcn.18000542c
cmp byte [0x180028480], 0
je 0x18000f9f1
inc rbx
cmp byte [r15 + rbx], 0
jne 0x18000f99d
and qword [rbp + 0x320], 0
lea r8, [rbp + 0x320]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x18000fa1d
lea rax, [rbp + 0x320]
mov r9d, ebx
mov r8, r15
mov qword [rsp + 0x20], rax
mov edx, 1
lea rcx, [0x1800021c0]
call fcn.180004be8
jmp 0x18000fa1d
lea rax, [rbp + 0x320]
mov dword [rbp + 0x320], 0x80
mov qword [rsp + 0x28], rax
lea r8, [0x1800021c0]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r15
call fcn.180004b30
lea rcx, [0x180001fb0]
call fcn.180004a90
test rax, rax
je 0x18000fa37
call fcn.180004a90
lea rcx, [rax + 1]
mov r9, r15
lea r8, [0x1800021c8]
mov edx, 0x3b4
call qword [0x180029278]
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r12
pop rbp
ret
Function at 0x18000fa6c
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x140
mov rsi, rcx
lea rcx, [0x1800021d8]
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x1800021e0]
mov rcx, rsi
call fcn.18000bc64
cmp byte [0x180028240], 0
lea rbx, [0x180001fb0]
jne 0x18000fb50
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.180025ca4
lea rdx, [rsp + 0x158]
mov dword [rsp + 0x158], 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x18000fb20
mov rcx, rbx
call fcn.180004a90
test rax, rax
je 0x18000faff
call fcn.180004a90
lea rdi, [rax + 1]
jmp 0x18000fb02
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x1800021e8]
mov edx, 0x3c8
mov r9d, eax
mov rcx, rdi
call qword [0x180029278]
lea rcx, [rsp + 0x30]
call fcn.180004ed8
mov r10, rax
test rax, rax
je 0x18000fb50
mov r8d, 0x104
lea rcx, [0x180028240]
mov rdx, rax
call fcn.1800049c4
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [0x180028480], 0
jne 0x18000fb88
mov rcx, qword [0x1800281b0]
lea rdx, [0x180002018]
call fcn.18000c674
test rax, rax
je 0x18000fb7c
cmp byte [rax], 4
jne 0x18000fb7c
mov rcx, qword [rax + 0x10]
jmp 0x18000fb83
lea rcx, [0x18000175a]
call fcn.18000f81c
cmp byte [0x1800281c0], 0
lea rdi, [0x1800281c0]
jne 0x18000fbff
lea rax, [rsp + 0x158]
mov dword [rsp + 0x158], 0x40
mov qword [rsp + 0x28], rax
lea r8, [0x180002210]
lea rdx, [0x180002218]
mov qword [rsp + 0x20], rdi
call fcn.180004b30
cmp byte [0x1800281c0], 0
je 0x18000fbff
mov rcx, rbx
call fcn.180004a90
test rax, rax
je 0x18000fbe7
call fcn.180004a90
lea rbx, [rax + 1]
mov r9, rdi
lea r8, [0x180002228]
mov edx, 0x3e3
mov rcx, rbx
call qword [0x180029278]
cmp qword [0x180027898], 0
jne 0x18000fc32
mov rcx, qword [0x180029060]
lea rdx, [0x18000223c]
call fcn.18000c674
lea rdx, [0x180001bb8]
mov rcx, rax
call fcn.18000c674
mov qword [0x180027898], rax
lea rcx, [0x180028240]
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x1800016b0]
mov rcx, rsi
call fcn.18000bc64
lea rcx, [0x180028480]
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x1800021c0]
mov rcx, rsi
call fcn.18000bc64
mov rcx, rdi
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180002240]
mov rcx, rsi
call fcn.18000bc64
lea rcx, [0x1800015b4]
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180002244]
mov rcx, rsi
call fcn.18000bc64
mov rcx, qword [0x180027898]
test rcx, rcx
je 0x18000fcca
cmp byte [rcx], 7
jne 0x18000fcca
add rcx, 0x10
lea rdx, [0x180018430]
mov r8, rsi
call fcn.18001100c
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800106b8
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
lea r8, [rbp + 0x30]
mov byte [rbp + 0x30], 0
xor edx, edx
lea rcx, [rbp + 0x30]
call fcn.180004fd8
mov r13d, 0x104
lea r9, [rbp + 0x30]
mov r8d, r13d
lea rdx, [0x180001d4c]
lea rcx, [rbp + 0x30]
call fcn.1800049fc
cmp byte [0x18002708a], 0
je 0x1800108a7
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1800108a7
mov edx, r13d
mov byte [rbp + 0x140], 0
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov rax, qword [0x180027080]
call qword [rax + 0xd8]
test al, al
je 0x1800108a7
and qword [rbp + 0x288], 0
lea r9, [rbp + 0x280]
and dword [rbp + 0x280], 0
lea r8, [rbp + 0x288]
lea rdx, [0x180001bf0]
lea rcx, [0x180001b88]
call fcn.18001ec54
test eax, eax
jne 0x1800108a7
mov rbx, qword [rbp + 0x288]
mov edx, dword [rbp + 0x280]
mov rcx, rbx
call fcn.18000ca54
mov r14, rax
test rbx, rbx
je 0x1800107b3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x180001bd8]
mov rcx, r14
call fcn.18000c674
mov rbx, rax
test rax, rax
je 0x18001089f
cmp byte [rax], 8
jne 0x18001089f
mov r15d, dword [rax + 0x118]
xor edi, edi
test r15d, r15d
je 0x18001089f
xor esi, esi
mov eax, edi
lea rdx, [0x180002240]
or eax, 1
bsr ecx, eax
mov rcx, qword [rbx + rcx*8 + 0x10]
mov rcx, qword [rsi + rcx]
call fcn.18000c674
test rax, rax
je 0x180010818
cmp byte [rax], 4
jne 0x180010818
mov r11, qword [rax + 0x10]
jmp 0x18001081f
lea r11, [0x18000175a]
cmp byte [r11], 0
je 0x180010890
mov r8, r13
mov byte [rsp + 0x20], 0
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x20]
call fcn.1800049c4
lea r9, [rsp + 0x20]
mov r8, r13
lea rdx, [0x180001084]
lea rcx, [rsp + 0x20]
call fcn.1800049fc
lea r9, [rsp + 0x20]
mov r8, r13
mov rdx, r11
lea rcx, [rsp + 0x20]
call fcn.1800049fc
lea r9, [rsp + 0x20]
mov r8, r13
lea rdx, [0x180001be8]
lea rcx, [rsp + 0x20]
call fcn.1800049fc
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
inc edi
add rsi, 8
cmp edi, r15d
jb 0x1800107eb
mov rcx, r14
call fcn.18000c1bc
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x180010b2c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea r10d, [r8 - 0x21524111]
mov r9, r8
mov ebx, r10d
mov edi, r10d
mov r11, rdx
cmp r8, 0xc
jbe 0x180010bdb
lea rcx, [r8 - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 3
inc rdx
imul rax, rdx, 0xfffffffffffffff4
add r9, rax
add r10d, dword [r11 + 8]
add ebx, dword [r11 + 4]
mov r8d, r10d
mov eax, dword [r11]
add r11, 0xc
sub eax, r10d
rol r8d, 4
add eax, edi
add r10d, ebx
xor r8d, eax
sub ebx, r8d
mov eax, r8d
add r8d, r10d
rol eax, 6
xor eax, ebx
sub r10d, eax
mov ecx, eax
rol ecx, 8
add eax, r8d
xor ecx, r10d
sub r8d, ecx
mov edi, ecx
add ecx, eax
rol edi, 0x10
xor edi, r8d
sub eax, edi
mov ebx, edi
ror ebx, 0xd
add edi, ecx
xor ebx, eax
sub ecx, ebx
mov r10d, ebx
rol r10d, 4
add ebx, edi
xor r10d, ecx
sub rdx, 1
jne 0x180010b72
cmp r9, 6
ja 0x180010c37
je 0x180010c8f
test r9, r9
je 0x180010cf0
sub r9, 1
je 0x180010c2f
sub r9, 1
je 0x180010c25
sub r9, 1
je 0x180010c1b
sub r9, 1
je 0x180010ca0
cmp r9, 1
je 0x180010c99
jmp 0x180010ca3
movzx eax, byte [r11 + 2]
shl eax, 0x10
add edi, eax
movzx eax, byte [r11 + 1]
shl eax, 8
add edi, eax
movzx eax, byte [r11]
add edi, eax
jmp 0x180010ca3
sub r9, 7
je 0x180010c85
sub r9, 1
je 0x180010c5f
sub r9, 1
je 0x180010c7b
sub r9, 1
je 0x180010c70
sub r9, 1
je 0x180010c65
cmp r9, 1
jne 0x180010ca3
add r10d, dword [r11 + 8]
add ebx, dword [r11 + 4]
jmp 0x180010ca0
movzx eax, byte [r11 + 0xa]
shl eax, 0x10
add r10d, eax
movzx eax, byte [r11 + 9]
shl eax, 8
add r10d, eax
movzx eax, byte [r11 + 8]
add r10d, eax
jmp 0x180010c5f
movzx eax, byte [r11 + 6]
shl eax, 0x10
add ebx, eax
movzx eax, byte [r11 + 5]
shl eax, 8
add ebx, eax
movzx eax, byte [r11 + 4]
add ebx, eax
add edi, dword [r11]
xor r10d, ebx
mov eax, ebx
rol eax, 0xe
sub r10d, eax
mov eax, r10d
mov edx, r10d
rol eax, 0xb
xor edx, edi
sub edx, eax
xor ebx, edx
mov eax, edx
ror eax, 7
sub ebx, eax
xor r10d, ebx
mov eax, ebx
rol eax, 0x10
sub r10d, eax
mov eax, r10d
mov ecx, r10d
rol eax, 4
xor ecx, edx
sub ecx, eax
xor ebx, ecx
mov eax, ecx
rol eax, 0xe
sub ebx, eax
mov eax, ebx
xor r10d, ebx
ror eax, 8
sub r10d, eax
mov rbx, qword [rsp + 8]
mov eax, r10d
mov rdi, qword [rsp + 0x10]
ret