joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180028600
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, r9
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
call fcn.1800282d0
test rax, rax
jne 0x180028668
mov rcx, qword [0x1801491d8]
lea rax, [0x1801491d8]
cmp rcx, rax
je 0x18002865e
test byte [rcx + 0x1c], 0x10
je 0x18002865e
cmp byte [rcx + 0x19], 2
jb 0x18002865e
mov rcx, qword [rcx + 0x10]
lea r8, [0x180123200]
mov edx, 0xf
call fcn.18001f9f0
mov eax, 0x8000ffff
jmp 0x1800286f7
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800286e7
mov edi, dword [rsp + 0x30]
test rdi, rdi
je 0x1800286e7
test rbx, rbx
je 0x180028699
mov dword [rbx], edi
cmp byte [rsi + 0xc], 0
je 0x1800286e3
mov rdx, rdi
mov rcx, rbp
call fcn.18000afd0
cmp rdi, rax
je 0x1800286e3
mov rcx, qword [0x1801491d8]
lea rax, [0x1801491d8]
cmp rcx, rax
je 0x1800286e3
test byte [rcx + 0x1c], 0x10
je 0x1800286e3
cmp byte [rcx + 0x19], 2
jb 0x1800286e3
mov rcx, qword [rcx + 0x10]
lea r8, [0x180123200]
mov edx, 0x10
call fcn.18001f9f0
xor eax, eax
jmp 0x1800286f7
test rbx, rbx
je 0x1800286f2
mov dword [rbx], 0
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180028710
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rdi, r9
mov esi, r8d
mov r14, rdx
mov rbx, rcx
cmp byte [rcx + 0xe], 0
jne 0x18002875e
lea rax, [0x1801491d8]
mov rcx, qword [0x1801491d8]
cmp rcx, rax
je 0x18002879f
test byte [rcx + 0x1c], 0x10
je 0x18002879f
cmp byte [rcx + 0x19], 2
jb 0x18002879f
mov edx, 0x11
jmp 0x18002878f
call fcn.1800282d0
mov r15, rax
test rax, rax
jne 0x1800287a9
lea rax, [0x1801491d8]
mov rcx, qword [0x1801491d8]
cmp rcx, rax
je 0x18002879f
test byte [rcx + 0x1c], 0x10
je 0x18002879f
cmp byte [rcx + 0x19], 2
jb 0x18002879f
mov edx, 0x12
lea r8, [0x180123200]
mov rcx, qword [rcx + 0x10]
call fcn.18001f9f0
mov eax, 0x8000ffff
jmp 0x18002890f
xor r12d, r12d
test rdi, rdi
je 0x1800287b4
mov dword [rdi], r12d
test esi, esi
je 0x18002890d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
cmp byte [rbx + 0xc], 0
je 0x18002888e
lfence
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.180027bd0
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
sub rax, rbx
cmp rax, rsi
je 0x180028834
lea rax, [0x1801491d8]
mov rcx, qword [0x1801491d8]
cmp rcx, rax
je 0x18002882a
test byte [rcx + 0x1c], 0x10
je 0x18002882a
cmp byte [rcx + 0x19], 2
jb 0x18002882a
mov edx, 0x13
lea r8, [0x180123200]
mov rcx, qword [rcx + 0x10]
call fcn.18001f9f0
mov edi, 0x8000ffff
jmp 0x180028932
lfence
mov r8, rsi
mov rdx, r14
mov r14, qword [rsp + 0x30]
mov rcx, r14
call fcn.180100680
mov rdx, rsi
mov rcx, r14
call fcn.18000b280
cmp rsi, rax
je 0x18002888e
lea rax, [0x1801491d8]
mov rcx, qword [0x1801491d8]
cmp rcx, rax
je 0x18002888e
test byte [rcx + 0x1c], 0x10
je 0x18002888e
cmp byte [rcx + 0x19], 2
jb 0x18002888e
mov edx, 0x14
lea r8, [0x180123200]
mov rcx, qword [rcx + 0x10]
call fcn.18001f9f0
lfence
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x80]
mov r8d, esi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180028928
mov eax, dword [rsp + 0x80]
cmp eax, esi
jne 0x180028928
test rdi, rdi
je 0x1800288c3
mov dword [rdi], eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18002890d
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800288fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002897a
call fcn.1800d504c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov edi, 0x80030103
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x180028976
mov rdx, qword [rsp + 0x40]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x180028960
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002897a
mov rcx, rbx
call fcn.1800d504c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov eax, edi
jmp 0x18002890f
call fcn.1800dbd50
int3
Function at 0x180028ce0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
xorps xmm0, xmm0
mov rbx, rdx
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm0
movups xmmword [rdx + 0x40], xmm0
call fcn.1800282d0
lea rdx, [rsp + 0x3c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x38], eax
cmp eax, 0xffffffff
jne 0x180028d35
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x180028d35
mov qword [rbx + 0x10], 0xffffffffffffffff
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rax, qword [rsp + 0x38]
mov qword [rbx + 0x10], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x18002a660
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1801483c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov esi, r9d
mov rdi, rcx
mov qword [rsp + 0x40], rcx
mov dword [rcx], edx
mov dword [rcx + 4], r8d
mov eax, dword [rsp + 0x2a0]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x2a8]
mov qword [rcx + 0x10], rax
movzx eax, byte [rsp + 0x2b0]
mov byte [rcx + 0x18], al
mov eax, dword [rsp + 0x2b8]
mov dword [rcx + 0x1c], eax
xor ebp, ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov qword [rcx + 0x30], rbp
mov byte [rcx + 0x38], bpl
add rcx, 0x40
lea rax, [0x18002a990]
mov qword [rsp + 0x20], rax
lea r9, [0x18003ac40]
mov edx, 0x10
mov r8d, 2
call fcn.1800d57dc
nop
mov dword [rdi + 0x60], ebp
xorps xmm0, xmm0
movups xmmword [rdi + 0x68], xmm0
mov qword [rdi + 0x78], rbp
mov qword [rdi + 0x80], 7
mov word [rdi + 0x68], bp
lea rbx, [rdi + 0x88]
mov qword [rsp + 0x30], rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov byte [rbx + 0x20], bpl
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x18002a77d
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18002a763
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180020c20
jmp 0x18002a7c3
mov qword [rbx + 0x10], rbp
cmp qword [rbx + 0x18], 7
jbe 0x18002a78b
mov rbx, qword [rbx]
mov word [rbx], bp
lea rax, [0x1801491d8]
mov rcx, qword [0x1801491d8]
cmp rcx, rax
je 0x18002a7c3
test byte [rcx + 0x1c], 0x10
je 0x18002a7c3
cmp byte [rcx + 0x19], 2
jb 0x18002a7c3
mov edx, 0x26
lea r8, [0x1801231f0]
mov rcx, qword [rcx + 0x10]
call fcn.18001f9f0
nop
mov qword [rdi + 0xb0], rbp
xorps xmm0, xmm0
movups xmmword [rdi + 0xb8], xmm0
mov qword [rdi + 0xc8], rbp
mov qword [rdi + 0xd0], 7
mov word [rdi + 0xb8], bp
mov qword [rdi + 0xd8], rbp
mov word [rdi + 0xe0], bp
lea rbx, [rdi + 0xe8]
mov qword [rsp + 0x30], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
lea rcx, [rbx + 0x20]
call fcn.180022530
nop
mov dword [rbx + 0xc0], ebp
mov word [rdi + 0x1b0], bp
mov qword [rdi + 0x1b8], rbp
mov byte [rdi + 0x1c0], 0
mov qword [rdi + 0x1c4], rbp
mov dword [rdi + 0x1cc], 0
mov qword [rdi + 0x1d0], rbp
mov dword [rdi + 0x1d8], ebp
mov qword [rdi + 0x1dc], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi + 0x1e4], xmm0
mov qword [rdi + 0x1f4], rax
mov dword [rdi + 0x24], esi
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800d5000
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180052ce0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x300
mov rax, qword [0x1801483c0]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov rdi, rcx
mov ebx, 0x104
mov edx, ebx
lea rcx, [rsp + 0xe0]
call fcn.180054fe0
lea rax, [rsp + 0xe0]
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180052d30
lea rax, [rdx + 1]
xor esi, esi
cmp rax, rbx
jae 0x180052d8a
lea rax, [rdx + 0xb]
lea r8, str.eeclnt.exe
lea rcx, [rsp + 0xe0]
cmp rax, rbx
ja 0x180052d67
mov rdx, rbx
call fcn.1800ec574
jmp 0x180052d8a
lfence
sub rbx, rdx
lea rcx, [rcx + rdx*2]
mov r9d, 0x103
sub r9, rdx
mov rdx, rbx
call fcn.1800eb918
mov word [rsp + 0x2e6], si
xorps xmm0, xmm0
lea rax, str.runas
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xe0]
movups xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x60], 0x70
movups xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0x64], 0x440
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x180052e93
nop dword [rax + rax]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x180052e85
mov rax, qword [rcx]
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov qword [rsp + 0x38], rdx
xor r8d, r8d
mov qword [rsp + 0x30], rsi
xor edx, edx
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [case.0x18001b453.0]
mov ebx, eax
cmp eax, 4
je 0x180052e4b
cmp eax, 1
jne 0x180052e65
mov rcx, qword [rsp + 0xc8]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x180052e00
mov rcx, qword [rsp + 0xc8]
call qword [0x180148118]
test ebx, ebx
je 0x180052e81
cmp ebx, 3
je 0x180052e81
cmp ebx, 0xc
jne 0x180052e93
mov al, 1
jmp 0x180052e95
mov rcx, qword [rsp + 0xc8]
call qword [0x180148118]
xor al, al
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1800d5000
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180052ec0
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1801483c0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov edi, dword [0x18014f670]
mov r14, rcx
mov qword [rsp + 0x90], r15
mov r15d, edx
test edi, edi
jne 0x1800530cd
call qword [0x180148258]
test eax, eax
je 0x180052f0f
mov edi, 1
jmp 0x1800530c7
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xd0], r12
mov qword [rsp + 0x98], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0xf]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, 2
test eax, eax
je 0x1800530af
mov r12, qword [rbp + 0xf]
lea rax, [rbp + 0x17]
xor ebx, ebx
mov dword [rbp + 0x27], 0
mov rcx, r12
mov word [rbp + 0x2b], 0x500
mov r9d, 4
mov qword [rbp + 0x1f], rbx
lea r8, [rbp + 0x1b]
mov qword [rsp + 0x20], rax
mov edx, 0x12
xor r13b, r13b
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1800530a5
cmp dword [rbp + 0x17], 4
jb 0x1800530a5
cmp dword [rbp + 0x1b], 3
jne 0x1800530a5
lea rax, [rbp + 7]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, edi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1800530a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18005308f
mov ecx, dword [rbp + 7]
mov qword [rsp + 0xc8], rsi
call fcn.1800db928
mov rsi, rax
test rax, rax
je 0x180053087
mov r9d, dword [rbp + 7]
lea rax, [rbp + 7]
mov r8, rsi
mov qword [rsp + 0x20], rax
mov edx, edi
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x18005307f
lea rax, [rbp + 0x1f]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x27]
mov dword [rsp + 0x48], ebx
mov r8d, 0x20
mov dword [rsp + 0x40], ebx
movzx edx, dil
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x18005307f
cmp dword [rsi], ebx
jbe 0x180053075
mov rdx, qword [rbp + 0x1f]
mov ecx, ebx
add rcx, rcx
mov rcx, qword [rsi + rcx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x180053072
inc ebx
cmp ebx, dword [rsi]
jb 0x180053052
jmp 0x180053075
mov r13b, 1
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rsi
call fcn.1800db930
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rbp + 0xf]
call qword [0x180148118]
test r13b, r13b
je 0x1800530af
mov edi, 3
jmp 0x1800530af
mov rcx, qword [rbp + 0xf]
call qword [0x180148118]
mov r12, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc0]
mov r13, qword [rsp + 0x98]
mov dword [0x18014f670], edi
mov rcx, qword [r14]
test r15b, 2
je 0x1800530e2
lea eax, [rdi - 2]
cmp eax, 1
ja 0x1800530e2
mov rcx, qword [r14 + 8]
test r15b, 4
je 0x1800530f1
cmp edi, 2
jne 0x1800530f1
mov rcx, qword [r14 + 8]
test r15b, 8
mov r15, qword [rsp + 0x90]
je 0x18005310a
cmp edi, 4
jne 0x18005310a
mov rax, qword [r14 + 8]
jmp 0x18005310d
mov rax, rcx
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1800d5000
add rsp, 0xa0
pop r14
pop rdi
pop rbp
ret
Function at 0x180054190
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x1801483c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x104
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800542fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1800542fe
add eax, 0xfffffffe
cmp eax, 1
ja 0x1800542f9
mov edx, 0x5c
mov rcx, rsi
call fcn.1800d755c
test rax, rax
je 0x1800542f9
sub rax, rsi
sar rax, 1
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.180054350
test al, al
je 0x1800542f9
mov rdi, qword [rsp + 0x30]
lea r15, [rdi + 1]
cmp r15, qword [rsp + 0x28]
jbe 0x1800542c0
lfence
movabs rax, 0xfc0fc0fc0fc0fc1
mul r15
shr rdx, 4
inc rdx
imul rax, rdx, 0x104
cmp rax, r15
cmovae r15, rax
lea rdx, [r15 + r15]
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x38]
cmp rcx, rax
cmove rcx, rbx
call fcn.1800dc220
mov r14, rax
test rax, rax
je 0x1800542f9
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1800542b4
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x20], rax
jne 0x1800542b4
lea r8, [rdi + rdi]
lea rdx, [rsp + 0x38]
mov rcx, r14
call fcn.180100680
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r15
jmp 0x1800542c5
mov r14, qword [rsp + 0x20]
mov word [r14 + rdi*2], bx
inc qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call fcn.180054190
test eax, eax
jne 0x1800542f9
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800542fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1800542fe
mov ebx, 0xffffffff
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
cmp rcx, rax
je 0x180054317
test rcx, rcx
je 0x180054317
call fcn.1800db930
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800d5000
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x180054760
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1801483c0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r9, r9
je 0x18005479b
mov r8, r9
mov rdx, rbx
mov rcx, rdi
call fcn.1800592e0
jmp 0x1800547ae
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x180054817
mov eax, eax
cmp rax, rbx
ja 0x180054817
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x180054817
test rbx, rbx
je 0x180054813
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800547e0
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rdi
cmp rax, rbx
jae 0x180054803
call fcn.1800eb8b0
xor eax, eax
jmp 0x18005481e
lea r9, [rbx - 1]
call fcn.1800eb918
xor eax, eax
mov word [rdi + rbx*2 - 2], ax
xor eax, eax
jmp 0x18005481e
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800d5000
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret

Function at 0x180054840
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x28
mov r11, rcx
mov r10d, r8d
mov edx, r8d
and edx, 1
mov r9d, edx
or r9d, 2
test r8b, 2
cmove r9d, edx
mov ecx, r9d
or ecx, 4
test r8b, 4
cmove ecx, r9d
mov edx, ecx
or edx, 0x10
test r8b, 8
cmove edx, ecx
mov ecx, edx
bts ecx, 0xa
test r8b, 0x10
cmove ecx, edx
mov edx, ecx
bts edx, 7
test r8b, 0x20
cmove edx, ecx
mov r8d, edx
bts r8d, 9
test r10b, 0x80
cmove r8d, edx
mov ecx, r8d
bts ecx, 0x12
bt r10d, 8
cmovae ecx, r8d
mov r8d, ecx
bts r8d, 0x16
bt r10d, 9
cmovae r8d, ecx
mov rcx, r11
mov edx, r8d
bts edx, 0xc
bt r10d, 0xb
cmovae edx, r8d
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret
Function at 0x180054bb0
Capabilities:
Get file size
Get system information on windows
Read file via mapping

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rsi, r9
mov rbx, r8
mov r15, rdx
mov r14, rcx
xor edi, edi
lea rdx, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x180054bf6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x180054bf6
mov edx, 0xffffffff
xor eax, eax
xor ecx, ecx
jmp 0x180054c03
mov rdi, qword [rsp + 0x30]
xor edx, edx
mov rax, rdi
mov rcx, rdi
test edx, edx
je 0x180054c1d
mov rax, 0xffffffffffffffff
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
cmp rsi, rax
jb 0x180054c33
xor eax, eax
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
lea rax, [rsi + rbx]
cmp rax, rcx
jbe 0x180054c42
mov rbx, rdi
sub rbx, rsi
mov eax, dword [0x18014f674]
test eax, eax
jne 0x180054c61
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x70]
mov dword [0x18014f674], eax
mov edi, eax
dec rdi
not rdi
and rdi, rsi
sub rsi, rdi
mov qword [rsp + 0x38], 0xffffffffffffffff
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov rcx, r14
call qword [0x180148130]
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180054d1c
lfence
lea rcx, [rsi + rbx]
mov r8, rdi
shr r8, 0x20
mov qword [rsp + 0x20], rcx
mov r9d, edi
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180054d13
lfence
lea rdx, [rax + rsi]
mov r8, rbx
mov rcx, r15
call fcn.180100680
mov qword [rsp + 0x38], rbx
jmp 0x180054d07
lfence
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [0x180148118]
lfence
mov rax, qword [rsp + 0x38]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x180054d40
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x1801483c0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180054e03
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180054e03
add eax, 0xfffffffe
cmp eax, 1
ja 0x180054e29
mov edx, 0x5c
mov rcx, rdi
call fcn.1800d755c
mov rbx, rax
test rax, rax
je 0x180054e29
sub rbx, rdi
lea rcx, [rsp + 0x20]
sar rbx, 1
mov r8, rdi
mov r9, rbx
mov edx, 0x104
call fcn.1800eb918
add rbx, rbx
cmp rbx, 0x208
jae 0x180054e2d
xor eax, eax
lea rcx, [rsp + 0x20]
mov word [rsp + rbx + 0x20], ax
call fcn.180054d40
test eax, eax
je 0x180054e29
lfence
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180054e03
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180054e29
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800d5000
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
xor eax, eax
jmp 0x180054e08
call fcn.1800d51b4
int3
Function at 0x180057c30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, edx
mov r9d, r8d
shr eax, 4
mov edi, edx
inc ax
mov edx, 6
movzx r8d, ax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x180057ccd
mov rdx, rax
mov qword [rsp + 0x30], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x180057cbd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180057ca1
and edi, 0xf
jbe 0x180057ca1
mov ecx, edi
nop
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
sub rcx, 1
jne 0x180057c90
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rsi, qword [rsp + 0x30]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180059010
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov esi, r9d
mov r14, rdx
mov ebp, ecx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, esi
mov r15d, eax
test esi, esi
je 0x1800590d8
nop dword [rax]
nop word [rax + rax]
mov r9d, edi
mov dword [rsp + 0x20], 0x1cff
xor r8d, r8d
mov rdx, r14
mov ecx, ebp
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp ebp, eax
jne 0x1800590e9
mov ebx, 0x64
cmp ebx, 0xffffffff
je 0x18005907f
mov eax, ebx
dec ebx
test eax, eax
je 0x1800590b6
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1800590b6
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [0x180148228]
jmp 0x180059072
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r15d
mov ecx, esi
cmp eax, esi
cmova eax, esi
sub ecx, eax
cmp esi, 0xffffffff
cmove ecx, edi
mov edi, ecx
test ecx, ecx
jne 0x180059050
mov r9d, edi
xor r8d, r8d
mov rdx, r14
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret