joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000cab0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
mov rbx, rdx
repne scasw ax, word [rdi]
mov eax, 0x1f3
not rcx
dec rcx
sub eax, ecx
mov rdi, rcx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
mov qword [rsp + 0x28], rax
cmp rax, 0xffffffffffffffff
jne 0x18000cb13
lea eax, [rcx + 2]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
movsxd rdi, edi
mov esi, 1
xor r8d, r8d
mov qword [rsp + 0x30], rdi
test byte [rbx], 0x10
je 0x18000cbf2
cmp word [rbx + 0x2c], 0x2e
jne 0x18000cb51
movzx eax, word [rbx + 0x2e]
cmp ax, 0x2e
jne 0x18000cb48
cmp word [rbx + 0x30], 0
je 0x18000cc20
test ax, ax
je 0x18000cc20
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbx + 0x2c]
repne scasw ax, word [rdi]
mov eax, dword [rsp + 0x20]
not rcx
cmp rax, rcx
jb 0x18000cc16
mov rax, qword [rsp + 0x30]
or rcx, 0xffffffffffffffff
mov rdi, rbp
mov word [rbp + rax*2 - 2], r8w
xor eax, eax
repne scasw ax, word [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rbx + rcx + 0x2c]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x18000cb90
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
mov rdx, rbx
repne scasw ax, word [rdi]
mov eax, dword [0x1800d4788]
mov rcx, rbp
mov dword [rdi - 2], eax
movzx eax, word [0x1800d478c]
mov word [rdi + 2], ax
call fcn.18000cab0
mov rdi, qword [rsp + 0x30]
mov esi, eax
mov eax, 0x2a
mov word [rbp + rdi*2 - 2], ax
xor eax, eax
mov word [rbp + rdi*2], ax
jmp 0x18000cc1b
mov word [rbp + rdi*2 - 2], r8w
mov r8, qword [rsp + 0x78]
lea rdx, [rbx + 0x2c]
mov rcx, rbp
call qword [rsp + 0x70]
mov esi, eax
mov eax, 0x2a
mov word [rbp + rdi*2 - 2], ax
jmp 0x18000cc1b
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
test esi, esi
je 0x18000cc40
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rcx, qword [rsp + 0x28]
mov r8d, 0
test eax, eax
jne 0x18000cb23
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x60]
mov eax, esi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000d800
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x390
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov ebp, edx
mov rbx, rcx
test rcx, rcx
je 0x18000da32
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x18000da32
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
cmp eax, 0xffffffff
je 0x18000da32
test al, 1
je 0x18000d86f
and edi, 0xfffffffe
mov rcx, rbx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test dil, 0x10
je 0x18000da10
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x3a8], rsi
mov byte [rsp + 0x270], 0
call fcn.180043ef0
lea rcx, [rsp + 0x270]
mov rdx, rbx
sub rcx, rbx
nop dword [rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x18000d8b0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x270]
repne scasb al, byte [rdi]
movzx eax, word [0x1800d4784]
lea rcx, [rsp + 0x24]
mov word [rdi - 1], ax
movzx eax, byte [0x1800d4786]
xor edx, edx
mov r8d, 0x13c
mov dword [rsp + 0x20], 0
mov byte [rdi + 1], al
call fcn.180043ef0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000d9fd
nop dword [rax]
lea rdx, [0x1800d4b0c]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000d9de
lea rdx, [0x1800d4b08]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000d9de
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], 0
call fcn.180043ef0
lea rcx, [rsp + 0x160]
sub rcx, rbx
mov rdx, rbx
nop
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x18000d980
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x160]
repne scasb al, byte [rdi]
movzx eax, word [0x1800d1cbc]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x160]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x4c]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18000d9c0
lea rcx, [rsp + 0x160]
xor edx, edx
call fcn.18000d800
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18000d920
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rsi, qword [rsp + 0x3a8]
jmp 0x18000da19
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x18000da34
test ebp, ebp
je 0x18000da34
lea r8d, [rax + 4]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x18000da34
xor eax, eax
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.180043ec0
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18000e0c0
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x1e0], rbx
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x18000e2b2
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x18000e2b2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18000e2b2
test al, 0x10
je 0x18000e2b2
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.18002b2f0
nop
mov dl, 0x5c
lea rcx, [rsp + 0x20]
call fcn.180028dd0
mov dword [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x13c
lea rcx, [rsp + 0x64]
call fcn.180043ef0
lea r8, [0x1800d4784]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.18002b680
lea rdx, [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
lea rcx, [rsp + 0x48]
call fcn.180027bd0
cmp rdi, 0xffffffffffffffff
je 0x18000e2a1
lea rdx, [0x1800d4b0c]
lea rcx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000e281
lea rdx, [0x1800d4b08]
lea rcx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000e281
lea rdx, [rbp - 0x74]
lea rcx, [rsp + 0x28]
call fcn.18002b2f0
nop
lea r8, [0x1800d1cbc]
lea rdx, [rsp + 0x20]
test byte [rsp + 0x60], 0x10
je 0x18000e234
lea rcx, [rsp + 0x30]
call fcn.18002b680
nop
lea r8, [rsp + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18002b620
nop
mov rdx, rsi
mov rcx, qword [rax]
call fcn.18000e0c0
nop
lea rcx, [rsp + 0x50]
call fcn.180027bd0
nop
lea rcx, [rsp + 0x30]
jmp 0x18000e271
lea rcx, [rsp + 0x40]
call fcn.18002b680
nop
lea r8, [rsp + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.18002b620
nop
mov r8, rax
mov edx, dword [rsi + 8]
mov rcx, rsi
call fcn.18002ce90
nop
lea rcx, [rsp + 0x38]
call fcn.180027bd0
nop
lea rcx, [rsp + 0x40]
call fcn.180027bd0
nop
lea rcx, [rsp + 0x28]
call fcn.180027bd0
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18000e1a4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x20]
call fcn.180027bd0
mov eax, 1
jmp 0x18000e2b4
xor eax, eax
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.180043ec0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1b0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000e2e0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
movsxd rsi, r8d
mov rdi, rdx
mov rbp, rcx
call fcn.180036d90
test eax, eax
je 0x18000e311
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.USER32.dll_GetWindowTextW]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
test rdi, rdi
je 0x18000e39c
test esi, esi
je 0x18000e39c
lea r8, [rsi + rsi]
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r13
call fcn.180043ef0
mov rcx, rsi
call fcn.180045488
mov r12, rax
test rax, rax
je 0x18000e392
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.180043ef0
mov r8d, esi
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, eax
test eax, eax
je 0x18000e392
mov r9d, esi
mov r8, rdi
or edx, 0xffffffff
mov rcx, r12
xor ebx, ebx
call fcn.180018870
test eax, eax
je 0x18000e392
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx - 1]
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000e420
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r15d, r15d
mov qword [rsp + 0xc8], rbp
mov r14, r8
mov r12, rdx
mov r13, rcx
mov edi, 0x200
mov dword [rsp + 0x40], r15d
mov ebx, r15d
mov qword [rsp + 0x70], rsi
cmp ebx, 1
jne 0x18000e470
mov edi, 0x400
jmp 0x18000e4d8
cmp ebx, 2
jne 0x18000e4d8
xor eax, eax
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov edx, 0x70000
mov rcx, r13
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x44], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x18000e576
mov edi, dword [rsp + 0x5c]
cmp edi, 0x200
jb 0x18000e576
mov ecx, edi
mov ebp, edi
call fcn.180045488
mov rsi, rax
test rax, rax
je 0x18000e4f8
mov r8d, ebp
xor edx, edx
mov rcx, rax
call fcn.180043ef0
jmp 0x18000e4fb
mov rsi, r15
mov r8, rbp
xor edx, edx
mov rcx, rsi
mov qword [r12], rsi
call fcn.180043ef0
mov rdx, qword [r12]
lea r9, [rsp + 0x40]
mov r8d, edi
mov rcx, r13
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test eax, eax
jne 0x18000e544
mov rcx, qword [r12]
call fcn.180045904
inc ebx
mov qword [r12], r15
cmp ebx, 3
jl 0x18000e464
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
mov eax, esi
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
xor eax, eax
jmp 0x18000e54d
Function at 0x18000e580
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov edi, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.180043ef0
movzx eax, word [0x1800d4c14]
xor ebx, ebx
mov word [rsp + 0x20], ax
movzx eax, byte [0x1800d4c16]
mov byte [rsp + 0x22], al
test edi, edi
je 0x18000e5da
cmp edi, 1
jne 0x18000e5ea
call fcn.180036d30
test eax, eax
jne 0x18000e5ea
mov eax, 4
jmp 0x18000e655
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
add dil, 0x41
mov r8d, 0x103
mov byte [rsp + 0x20], dil
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
dec eax
cmp eax, 0x102
ja 0x18000e653
lea rcx, [rsp + 0x30]
call fcn.1800460a0
lea rdx, str.cdrom
lea rcx, [rsp + 0x30]
call fcn.180044fd4
mov ecx, 5
lea rdx, str.floppy
test rax, rax
cmovne ebx, ecx
lea rcx, [rsp + 0x30]
call fcn.180044fd4
test rax, rax
mov eax, 4
jne 0x18000e655
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180043ec0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x18000e680
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rbx
push rbp
sub rsp, 0x98
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ebx, ebx
mov rbp, rdx
test rdx, rdx
je 0x18000e856
cmp r8d, 0x200
jne 0x18000e856
xor eax, eax
mov dword [rsp + 0x38], 0x10
add cx, 0x41
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x18], rsi
movabs rax, 0x5c003a0041
mov qword [r11 - 0x60], rax
lea rax, [r11 - 0x58]
mov word [rsp + 0x48], cx
mov qword [r11 - 0x78], rax
lea rax, [r11 - 0x64]
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x80], rax
lea rax, [r11 - 0x68]
lea rcx, [r11 - 0x60]
xor r8d, r8d
xor edx, edx
mov qword [r11 - 0x28], r12
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], ebx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x18000e7fe
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
lea r8d, [rbx + 5]
lea rdx, str.FAT16
not rcx
lea rsi, [rcx - 1]
lea rcx, [rbp + 0x36]
call fcn.180052940
lea edi, [rbx + 3]
test eax, eax
jne 0x18000e78c
cmp esi, 5
jne 0x18000e76c
mov r8d, esi
lea rdx, [0x1800d4c50]
jmp 0x18000e77a
cmp esi, edi
jne 0x18000e78c
mov r8, rdi
lea rdx, [0x1800d4c48]
lea rcx, [rsp + 0x50]
call fcn.1800c8194
test eax, eax
je 0x18000e83a
lea rdx, str.FAT12
lea rcx, [rbp + 0x36]
mov r8d, 5
call fcn.180052940
test eax, eax
jne 0x18000e7c2
cmp esi, edi
jne 0x18000e7c2
lea rdx, [0x1800d4c48]
lea rcx, [rsp + 0x50]
mov r8, rdi
call fcn.1800c8194
test eax, eax
je 0x18000e83a
lea rcx, [rbp + 0x52]
lea rdx, str.FAT32
mov r8d, 5
call fcn.180052940
test eax, eax
jne 0x18000e7fe
cmp esi, 5
jne 0x18000e7fe
lea rdx, [0x1800d4c28]
lea rcx, [rsp + 0x50]
mov r8d, esi
call fcn.1800c8194
test eax, eax
jne 0x18000e7fe
lea edi, [rsi - 3]
jmp 0x18000e83a
lea rdx, str.EXFAT
lea rcx, [rbp + 3]
mov r8d, 5
call fcn.180052940
test eax, eax
jne 0x18000e81d
lea edi, [rax + 5]
jmp 0x18000e83a
lea rdx, str.NTFS
lea rcx, [rbp + 3]
mov r8d, 4
call fcn.180052940
test eax, eax
sete bl
mov edi, ebx
mov r12, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
mov eax, edi
mov rdi, qword [rsp + 0x88]
jmp 0x18000e858
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x98
pop rbp
pop rbx
ret
Function at 0x18000fc80
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x1a0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1d8], rbx
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x18000fe47
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x18000fe47
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18000fe47
test al, 0x10
je 0x18000fe47
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.18002b2f0
nop
mov dl, 0x5c
lea rcx, [rsp + 0x20]
call fcn.180028dd0
mov dword [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x13c
lea rcx, [rsp + 0x54]
call fcn.180043ef0
lea r8, [0x1800d4784]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.18002b680
lea rdx, [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
lea rcx, [rsp + 0x40]
call fcn.180027bd0
cmp rdi, 0xffffffffffffffff
je 0x18000fe36
lea rdx, [0x1800d4b0c]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000fe0b
lea rdx, [0x1800d4b08]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000fe0b
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x28]
call fcn.18002b2f0
nop
test byte [rsp + 0x50], 0x10
je 0x18000fdf7
lea r8, [0x1800d1cbc]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18002b680
nop
lea r8, [rsp + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.18002b620
nop
mov r8d, esi
mov rdx, rbx
mov rcx, qword [rax]
call fcn.18000fc80
nop
lea rcx, [rsp + 0x30]
call fcn.180027bd0
nop
lea rcx, [rsp + 0x38]
call fcn.180027bd0
jmp 0x18000fdf9
inc dword [rbx]
test esi, esi
je 0x18000fe01
cmp esi, dword [rbx]
jbe 0x18000fe22
lea rcx, [rsp + 0x28]
call fcn.180027bd0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x18000fe2c
jmp 0x18000fd60
lea rcx, [rsp + 0x28]
call fcn.180027bd0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x20]
call fcn.180027bd0
mov eax, 1
jmp 0x18000fe49
xor eax, eax
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.180043ec0
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000feb0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
je 0x18000ff72
test rdx, rdx
je 0x18000ff72
mov rax, qword [0x180134960]
mov qword [rsp + 0x30], rbp
mov ebp, dword [rdx]
test rax, rax
jne 0x18000ff24
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000ff18
lea rdx, str.GetComputerNameExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180134960], rax
jmp 0x18000ff1f
mov rax, qword [0x180134960]
test rax, rax
je 0x18000ff49
mov r8, rbx
mov rdx, rsi
mov ecx, edi
call rax
mov r11d, eax
test eax, eax
je 0x18000ff49
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
jne 0x18000ff5a
mov rdx, rbx
mov rcx, rsi
mov dword [rbx], ebp
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov r11d, eax
mov eax, r11d
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x180011550
Capabilities:
Check if file exists
Get disk size
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x450
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r12, r9
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
test rcx, rcx
je 0x180011657
test rdx, rdx
jne 0x1800115a3
test r8, r8
jne 0x1800115a3
test r9, r9
je 0x180011657
mov word [rsp + 0x30], bx
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x32]
call fcn.180043ef0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.18002bea0
nop
nop dword [rax + rax]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800115fe
test al, 0x10
je 0x1800115fe
mov r9, r12
mov r8, rbp
mov rdx, rsi
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ebx, eax
test eax, eax
jne 0x18001164d
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x30]
call fcn.180043ef0
mov r8d, 0x207
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call fcn.180037de0
test eax, eax
je 0x18001164d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call fcn.1800463e4
test eax, eax
je 0x18001164d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1800296b0
jmp 0x1800115d0
lea rcx, [rsp + 0x20]
call fcn.180029530
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x450
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800116e0
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x2e0], rbx
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rsi, rdx
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.18002bea0
nop
mov rax, qword [rsp + 0x30]
cmp dword [rax - 8], 0
jne 0x180011736
jmp 0x18001190f
mov edx, 0x5c
lea rcx, [rsp + 0x30]
call fcn.18002a5b0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.18002bde0
nop
lea rdx, [0x1800d4788]
lea rcx, [rsp + 0x38]
call fcn.180029800
mov dword [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x54]
call fcn.180043ef0
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800117a9
lea rcx, [rsp + 0x38]
call fcn.180029530
nop
jmp 0x18001190f
lea rdx, [0x1800d4b84]
lea rcx, [rsp + 0x28]
call fcn.18002bea0
nop
lea rdx, [0x1800d4b84]
lea rcx, [rsp + 0x20]
call fcn.18002bea0
nop
nop dword [rax]
lea rdx, [0x1800d4b14]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1800118ce
lea rdx, [0x1800d4b10]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1800118ce
lea r9, [rsp + 0x7c]
mov r8, qword [rsp + 0x30]
lea rdx, [0x1800d2178]
lea rcx, [rsp + 0x28]
call fcn.18002a4e0
mov r11, qword [rsp + 0x28]
cmp dword [r11 - 8], 0
je 0x1800118ce
lea r9, [rsp + 0x7c]
mov r8, rsi
lea rdx, [0x1800d2178]
lea rcx, [rsp + 0x20]
call fcn.18002a4e0
mov rcx, qword [rsp + 0x20]
call fcn.18000f1b0
mov ebx, eax
test byte [rsp + 0x50], 0x10
je 0x180011887
cmp eax, 0xffffffff
jne 0x180011871
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1800118ce
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.1800116e0
cmp ebx, 0xffffffff
jne 0x1800118ce
jmp 0x1800118bf
xor r8d, r8d
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1800118bf
mov rcx, qword [rsp + 0x28]
call fcn.18000d6e0
xor r8d, r8d
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1800118ce
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.180011270
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800117d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x20]
call fcn.180029530
nop
lea rcx, [rsp + 0x28]
call fcn.180029530
nop
lea rcx, [rsp + 0x38]
call fcn.180029530
nop
lea rcx, [rsp + 0x30]
call fcn.180029530
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.180043ec0
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2b0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180013af0
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov rdi, r8
mov rsi, rdx
test ecx, ecx
jne 0x180013b51
test r8, r8
je 0x180013b27
xor edx, edx
mov rcx, r8
call fcn.180039e00
test eax, eax
je 0x180013b27
mov rcx, rdi
call fcn.18003a330
test rbx, rbx
je 0x180013baa
xor edx, edx
mov rcx, rbx
call fcn.180039e00
test eax, eax
je 0x180013baa
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18003a330
test rdx, rdx
je 0x180013baa
xor edx, edx
mov rcx, rsi
call fcn.180039e00
test eax, eax
je 0x180013baa
test rdi, rdi
je 0x180013b87
mov rdx, rdi
mov rcx, rsi
call fcn.180013a70
test eax, eax
jne 0x180013b87
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test rbx, rbx
je 0x180013baa
mov rdx, rbx
mov rcx, rsi
call fcn.180013a70
test eax, eax
jne 0x180013baa
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180013bc0
Capabilities:
Copy file

Disassembly:
test rcx, rcx
je 0x180013c7c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test r9, r9
je 0x180013c10
xor edx, edx
mov rcx, r9
call fcn.180039e00
test eax, eax
je 0x180013c10
mov rdx, rbx
mov rcx, rbp
call fcn.180013a70
test eax, eax
jne 0x180013c68
mov rcx, rbp
jmp 0x180013c5c
test rsi, rsi
je 0x180013c37
xor edx, edx
mov rcx, rsi
call fcn.180039e00
test eax, eax
je 0x180013c37
mov rdx, rbx
mov rcx, rsi
call fcn.180013a70
test eax, eax
jne 0x180013c68
mov rcx, rsi
jmp 0x180013c5c
test rdi, rdi
je 0x180013c68
xor edx, edx
mov rcx, rdi
call fcn.180039e00
test eax, eax
je 0x180013c68
mov rdx, rbx
mov rcx, rdi
call fcn.180013a70
test eax, eax
jne 0x180013c68
mov rcx, rdi
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
repz ret