joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800178d0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x660
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x650], rax
mov ebp, edx
mov rdi, rcx
call sym.SafeBase64.dll_GetDiskMaxCounts
mov esi, eax
test eax, eax
je 0x180017a7f
cmp esi, ebp
mov qword [rsp + 0x688], rbx
mov qword [rsp + 0x690], r14
cmova esi, ebp
xor ebx, ebx
mov eax, ebx
test esi, esi
je 0x1800179e2
cmp esi, 0x10
jb 0x1800179bd
movdqa xmm2, xmmword [0x180164b30]
lea edx, [rbx + 8]
movdqa xmm3, xmmword [0x180164b60]
mov r8d, esi
and r8d, 0xfffffff0
nop word [rax + rax]
mov ecx, eax
movd xmm0, eax
add eax, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm2
paddd xmm0, xmm3
movdqu xmmword [rdi + rcx*4], xmm0
lea ecx, [rdx - 4]
movd xmm0, edx
movd xmm1, ecx
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
pshufd xmm0, xmm0, 0
paddd xmm1, xmm3
paddd xmm0, xmm2
movdqu xmmword [rdi + rcx*4], xmm1
mov ecx, edx
paddd xmm0, xmm3
movdqu xmmword [rdi + rcx*4], xmm0
lea ecx, [rdx + 4]
add edx, 0x10
movd xmm1, ecx
pshufd xmm1, xmm1, 0
paddd xmm1, xmm2
paddd xmm1, xmm3
movdqu xmmword [rdi + rcx*4], xmm1
cmp eax, r8d
jb 0x180017950
cmp eax, esi
jae 0x1800179e2
mov ecx, eax
lea rdx, [rdi + rcx*4]
nop word [rax + rax]
lea ecx, [rax + 0x80]
inc eax
mov dword [rdx], ecx
lea rdx, [rdx + 4]
cmp eax, esi
jb 0x1800179d0
lea rcx, [rsp + 0x30]
call sym.SafeBase64.dll_GetHardDiskCounts
mov edx, 0x104
lea rcx, [rsp + 0x440]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x180017a2d
movzx ecx, word [rsp + 0x440]
lea rdx, [rsp + 0x20]
call sym.SafeBase64.dll_GetDiskNumber
test eax, eax
je 0x180017a2d
mov r8d, dword [rsp + 0x24]
cmp r8d, 3
ja 0x180017a2d
sub r8d, 0xffffff80
jmp 0x180017a33
mov r8d, 0x80
cmp r14d, ebp
cmovb ebp, r14d
mov r14, qword [rsp + 0x690]
test ebp, ebp
je 0x180017a70
mov edx, ebp
nop dword [rax + rax]
mov ecx, dword [rsp + rbx + 0x30]
sub ecx, 0xffffff80
mov dword [rbx + rdi], ecx
cmp r8d, ecx
jne 0x180017a66
mov eax, dword [rdi]
mov dword [rdi], ecx
mov dword [rbx + rdi], eax
add rbx, 4
sub rdx, 1
jne 0x180017a50
mov rbx, qword [rsp + 0x688]
cmp ebp, esi
cmovbe ebp, esi
mov eax, ebp
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x660
pop rdi
pop rsi
pop rbp
ret
Function at 0x180017aa0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x660
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x650], rax
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x30]
call sym.SafeBase64.dll_GetHardDiskCounts
cmp eax, ebx
lea rcx, [rsp + 0x440]
mov esi, eax
mov edx, 0x104
cmova esi, ebx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x180017b18
movzx ecx, word [rsp + 0x440]
lea rdx, [rsp + 0x20]
call sym.SafeBase64.dll_GetDiskNumber
test eax, eax
je 0x180017b18
mov r9d, dword [rsp + 0x24]
cmp r9d, 3
ja 0x180017b18
sub r9d, 0xffffff80
jmp 0x180017b1e
mov r9d, 0x80
xor ecx, ecx
test esi, esi
je 0x180017b57
mov r8d, ecx
nop word [rax + rax]
mov eax, dword [rsp + r8 + 0x30]
sub eax, 0xffffff80
mov dword [r8 + rdi], eax
test ecx, ecx
je 0x180017b4d
cmp r9d, eax
jne 0x180017b4d
mov edx, dword [rdi]
mov dword [rdi], eax
mov dword [r8 + rdi], edx
inc ecx
add r8, 4
cmp ecx, esi
jb 0x180017b30
mov eax, esi
mov rcx, qword [rsp + 0x650]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180017b80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov qword [rsp + 0x40], r8
mov rsi, rdx
mov ebp, ecx
call sym.SafeBase64.dll_OpenDiskDriver
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180017c46
lea rax, [rsp + 0x48]
xor edi, edi
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 0x28
mov edx, 0x700a0
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
test eax, eax
jne 0x180017c94
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x18
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70000
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x180017c73
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x308]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r14d, dword [rsp + 0x5c]
mov r15d, dword [rsp + 0x60]
mov edi, r14d
mov r12, qword [rsp + 0x50]
mov r13d, dword [rsp + 0x64]
imul rdi, r15
imul rdi, r12
jmp 0x180017cbe
mov rax, qword [rsp + 0x80]
mov r13d, dword [rsp + 0x7c]
cqo
mov r12d, dword [rsp + 0x68]
mov r14d, dword [rsp + 0x74]
mov r15d, dword [rsp + 0x78]
idiv r13
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, r14w
lea eax, [rbp + 0x80]
movzx edx, r15w
imul edx, ecx
lea rcx, [rsp + 0x90]
mov dword [rsi], ebp
mov word [rsi + 0x40], r12w
mov word [rsi + 0x3e], r14w
mov word [rsi + 0x42], r15w
mov word [rsi + 0x44], dx
mov edx, 0x104
mov word [rsi + 0x3c], r13w
mov qword [rsi + 0x34], rdi
mov byte [rsi + 0x49], 1
mov byte [rsi + 0x4a], al
mov byte [rsi + 0x4b], 0
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x180017d39
movzx ecx, word [rsp + 0x90]
lea rdx, [rsp + 0x50]
call sym.SafeBase64.dll_GetDiskNumber
test eax, eax
je 0x180017d39
mov eax, dword [rsp + 0x54]
cmp eax, 3
ja 0x180017d39
sub eax, 0xffffff80
cmp ebp, eax
jne 0x180017d39
mov byte [rsi + 0x4b], 1
call sym.SafeBase64.dll_GetDiskMaxCounts
mov rdx, qword [rsp + 0x40]
mov r8d, 1
test eax, eax
movzx ecx, r8w
cmovne cx, ax
mov eax, r8d
mov word [rdx], cx
jmp 0x180017c48

Function at 0x180017d60
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x180017dba
movzx ecx, word [rsp + 0x30]
lea rdx, [rsp + 0x20]
call sym.SafeBase64.dll_GetDiskNumber
test eax, eax
je 0x180017dba
mov eax, dword [rsp + 0x24]
cmp eax, 3
ja 0x180017dba
sub eax, 0xffffff80
mov dword [rbx], eax
mov eax, 1
jmp 0x180017dbc
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x250
pop rbx
ret
Function at 0x180018080
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r14, rdx
mov r15d, ecx
lea rdx, [rsp + 0x30]
mov ecx, 0x104
mov rdi, r8
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebp, eax
shr ebp, 2
test ebp, ebp
je 0x180018139
nop dword [rax]
nop word [rax + rax]
lea ecx, [rbx*4]
lea rsi, [rsp + 0x30]
lea rsi, [rsi + rcx*2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x180018133
movzx ecx, word [rsi]
lea rdx, [rsp + 0x20]
call sym.SafeBase64.dll_GetDriverBusType
test eax, eax
je 0x180018116
cmp dword [rsp + 0x20], 7
je 0x180018133
movzx ecx, word [rsi]
mov rdx, rdi
call sym.SafeBase64.dll_GetDriverInfo
test eax, eax
je 0x180018133
lea eax, [r15 - 0x80]
cmp dword [rdi + 0x28], eax
jne 0x180018133
cmp qword [rdi], r14
je 0x180018168
inc ebx
cmp ebx, ebp
jb 0x1800180e0
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov eax, 1
jmp 0x18001813b
Function at 0x180018250
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x7d0]
sub rsp, 0x8d0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x7c0], rax
mov r14, rdx
movzx esi, cx
mov ebx, 0x208
lea rcx, [rbp + 0x190]
mov r8d, ebx
xor edx, edx
call fcn.180113150
mov r8d, ebx
lea rcx, [rbp + 0x3a0]
xor edx, edx
call fcn.180113150
mov eax, dword [0x1801554c0]
lea r8d, [rbx - 0x1e]
movups xmm0, xmmword [str.DosDevicesA:]
lea rcx, [rbp - 0x62]
mov dword [rbp - 0x68], eax
movsd xmm1, qword [0x1801554b8]
xor edi, edi
movzx eax, word [0x1801554c4]
xor edx, edx
movaps xmmword [rbp - 0x80], xmm0
mov word [rbp - 0x64], ax
movsd qword [rbp - 0x70], xmm1
call fcn.180113150
lea rax, [rbp + 0x5b0]
mov dword [rsp + 0x28], 0x2080000
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x80]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x180018310
add ax, ax
mov word [rbp - 0x68], si
mov word [rsp + 0x38], ax
lea r8, [rsp + 0x48]
add ax, 2
mov dword [rsp + 0x48], 0x30
mov word [rsp + 0x3a], ax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x50], rdi
xorps xmm0, xmm0
mov qword [rsp + 0x58], rax
mov edx, 0x80000000
mov dword [rsp + 0x60], 0x40
movdqu xmmword [rsp + 0x68], xmm0
call qword [sym.imp.ntdll.dll_ZwOpenSymbolicLinkObject]
test eax, eax
js 0x180018472
mov rcx, qword [rsp + 0x20]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_ZwQuerySymbolicLinkObject]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.ntdll.dll_ZwClose]
test ebx, ebx
js 0x180018472
movzx ebx, word [rsp + 0x28]
lea rdx, [rbp + 0x5b0]
mov r8d, ebx
lea rcx, [rbp + 0x3a0]
call fcn.180112cb0
shr rbx, 1
lea rcx, [rbp + 0x3a0]
mov edx, 0x103
mov word [rbp + rbx*2 + 0x3a0], di
call fcn.180125d4c
movzx r9d, si
lea r8, str._c:_
mov edx, 0x103
lea rcx, [rbp + 0x190]
call fcn.18000f870
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x18001846e
mov ebx, edi
nop dword [rax]
nop dword [rax + rax]
mov r9d, ebx
lea r8, str.DEVICECDROM_d
mov edx, 0x103
lea rcx, [rbp + 0x190]
call fcn.18000f870
lea rax, [rbp + 0x190]
lea r8, [rbp + 0x3a0]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180018454
add rax, 2
test ecx, ecx
jne 0x180018440
test edx, edx
je 0x180018463
inc ebx
cmp ebx, 4
jl 0x180018410
mov eax, edi
jmp 0x180018474
lea eax, [rbx + 0x60]
mov edi, 1
mov dword [r14], eax
mov eax, edi
jmp 0x180018474
xor eax, eax
mov rcx, qword [rbp + 0x7c0]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x8d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180018710
Capabilities:
Write file on windows

Disassembly:
push rbx
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rdx
mov r14d, ecx
lea rdx, [0x180155510]
mov rcx, r9
mov rbx, r9
mov r15d, r8d
call fcn.1801258f4
mov r12, rax
test rax, rax
jne 0x18001876b
lea rdx, [0x180155514]
mov rcx, rbx
call fcn.1801258f4
mov r12, rax
test rax, rax
jne 0x18001876b
mov eax, 0x9001
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
mov ecx, 0x40000
mov qword [rsp + 0x68], rsi
call fcn.180115540
mov rsi, rax
test rax, rax
jne 0x1800187a2
mov rcx, r12
call fcn.180125984
mov rsi, qword [rsp + 0x68]
mov eax, 0xa001
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov rbp, qword [r13]
mov qword [rsp + 0x70], rdi
mov eax, 0x200
mov edi, r15d
cmp r15d, eax
cmova edi, eax
xor ebx, ebx
mov r9d, edi
mov qword [rsp + 0x20], rsi
mov r8, rbp
mov edx, r14d
mov ecx, 3
call fcn.180016860
test eax, eax
jne 0x1800187f2
mov r9d, edi
mov qword [rsp + 0x20], rsi
mov r8, rbp
lea ecx, [rax + 3]
mov edx, r14d
call sym.SafeBase64.dll_KrnlRWDisk
inc ebx
test eax, eax
jne 0x180018814
cmp ebx, 2
jb 0x1800187c0
mov rcx, rsi
call fcn.180115548
mov rcx, r12
call fcn.180125984
mov eax, 0x8002
jmp 0x18001886f
mov r9, r12
mov r8d, edi
mov edx, 0x200
mov ebx, edi
mov rcx, rsi
call fcn.18012600c
cmp rax, rbx
jb 0x18001885a
mov rbp, qword [r13]
lea rbp, [rdi + rbp]
mov qword [r13], rbp
sub r15d, edi
jne 0x1800187b0
mov rcx, rsi
call fcn.180115548
mov rcx, r12
call fcn.180125984
mov eax, 1
jmp 0x18001886f
mov rcx, rsi
call fcn.180115548
mov rcx, r12
call fcn.180125984
mov eax, 0x9003
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
Function at 0x180018890
Capabilities:
Read file on windows

Disassembly:
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov r14d, edx
mov r15d, r9d
lea rdx, [0x180155518]
mov r12, r8
call fcn.1801258f4
mov r13, rax
test rax, rax
jne 0x1800188cb
mov eax, 0x9001
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
ret
mov ecx, 0x40000
mov qword [rsp + 0x70], rsi
call fcn.180115540
mov rsi, rax
test rax, rax
jne 0x180018901
mov rcx, r13
call fcn.180125984
mov rsi, qword [rsp + 0x70]
mov eax, 0xa001
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
ret
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x30], rdi
mov eax, 0x200
mov edi, r15d
cmp r15d, eax
mov r9, r13
mov edx, eax
mov rcx, rsi
cmova edi, eax
mov r8d, edi
mov ebx, edi
call fcn.180126310
cmp rax, rbx
jb 0x1800189b9
mov rbp, qword [r12]
xor ebx, ebx
nop
mov r9d, edi
mov qword [rsp + 0x20], rsi
mov r8, rbp
mov edx, r14d
mov ecx, 4
call fcn.180016860
test eax, eax
jne 0x180018972
mov r9d, edi
mov qword [rsp + 0x20], rsi
mov r8, rbp
lea ecx, [rax + 4]
mov edx, r14d
call sym.SafeBase64.dll_KrnlRWDisk
inc ebx
test eax, eax
jne 0x180018994
cmp ebx, 2
jb 0x180018940
mov rcx, rsi
call fcn.180115548
mov rcx, r13
call fcn.180125984
mov eax, 0x8002
jmp 0x1800189ce
mov eax, edi
add qword [r12], rax
sub r15d, edi
jne 0x180018910
mov rcx, rsi
call fcn.180115548
mov rcx, r13
call fcn.180125984
lea eax, [r15 + 1]
jmp 0x1800189ce
mov rcx, rsi
call fcn.180115548
mov rcx, r13
call fcn.180125984
mov eax, 0x9002
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x70]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1800189f0
Capabilities:
Read file on windows

Disassembly:
push rdi
push r12
push r14
sub rsp, 0x40
mov r12d, edx
mov r14, r8
lea rdx, [0x180155518]
call fcn.1801258f4
mov rdi, rax
test rax, rax
jne 0x180018a23
mov eax, 0x9001
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
mov ecx, 0x40000
mov qword [rsp + 0x68], rbp
call fcn.180115540
mov rbp, rax
mov rcx, rdi
test rax, rax
jne 0x180018a56
call fcn.180125984
mov rbp, qword [rsp + 0x68]
mov eax, 0xa001
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x60], rbx
lea r8d, [rdx + 2]
call fcn.18012664c
test eax, eax
jne 0x180018b79
mov rcx, rdi
call fcn.180126b30
mov ebx, eax
test eax, eax
js 0x180018b79
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.18012664c
test eax, eax
jne 0x180018b79
mov eax, ebx
mov qword [rsp + 0x70], rsi
cdq
mov qword [rsp + 0x38], r13
and edx, 0x1ff
mov qword [rsp + 0x30], r15
add eax, edx
mov ebx, eax
and eax, 0x1ff
sar ebx, 9
cmp eax, edx
je 0x180018abf
inc ebx
mov r13d, 0x200
nop word [rax + rax]
cmp ebx, r13d
mov esi, ebx
mov r9, rdi
mov rdx, r13
cmova esi, r13d
mov rcx, rbp
mov r8d, esi
mov r15d, esi
call fcn.180126310
test rax, rax
je 0x180018b62
mov r8, qword [r14]
mov r9d, esi
mov edx, r12d
mov qword [rsp + 0x20], rbp
mov ecx, 4
call sym.SafeBase64.dll_ReadWriteDisk
test eax, eax
je 0x180018b4b
add qword [r14], r15
sub ebx, esi
jne 0x180018ad0
mov rcx, rbp
call fcn.180115548
mov rcx, rdi
call fcn.180125984
lea eax, [rbx + 1]
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
mov rcx, rbp
call fcn.180115548
mov rcx, rdi
call fcn.180125984
mov eax, 0x8002
jmp 0x180018b28
mov rcx, rbp
call fcn.180115548
mov rcx, rdi
call fcn.180125984
mov eax, 0x9002
jmp 0x180018b28
mov rcx, rbp
call fcn.180115548
mov rcx, rdi
call fcn.180125984
mov eax, 0x9004
jmp 0x180018b37

Function at 0x180018d00
Capabilities:
Get disk information
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
movzx edi, dx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x180018d1f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx r8d, di
lea rcx, [rbx + 0x150]
lea rdx, str._C:_
call fcn.180007e60
movzx ecx, di
call sym.SafeBase64.dll_OpenVolumeDriver
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x180018d68
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenVolume:_Open_error__ErrCode_x
call sym.SafeBase64.dll_DbgPrintW
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
mov word [rbx + 8], di
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800199a0
Function at 0x180019000
Capabilities:
Read file on windows

Disassembly:
push rbx
push r13
push r15
sub rsp, 0x80
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc0]
mov r15, r8
mov qword [rsp + 0x40], rax
mov r13, rcx
mov ebx, r9d
test r9d, r9d
jne 0x180019043
mov dword [rax], r9d
lea eax, [r9 + 1]
jmp 0x18001921c
mov r8, qword [rcx + 0xc6]
cmp rdx, r8
jb 0x180019067
mov ecx, 0x44c
mov dword [rax], 0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18001921c
mov qword [rsp + 0x78], rbp
mov rcx, r8
sub r8d, edx
mov qword [rsp + 0x70], rsi
sub rcx, rdx
mov qword [rsp + 0x68], r12
mov r12d, dword [r13 + 0xc2]
mov qword [rsp + 0x60], r14
xor r14d, r14d
cmp rcx, rbx
mov dword [rsp + 0x34], r12d
mov rcx, qword [r13]
cmovb ebx, r8d
lea ebp, [r12 - 1]
mov eax, ebp
lea r8, [rsp + 0x54]
and eax, edx
xor r9d, r9d
sub rdx, rax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1800190d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1800191e2
xor esi, esi
cmp dword [rsp + 0x30], esi
je 0x180019166
mov rcx, r12
lea rdx, [0x1801423a8]
call fcn.18010fb14
mov r12, rax
test rax, rax
je 0x1800191e2
mov rcx, qword [r13]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
mov rdx, rax
mov esi, dword [rsp + 0x34]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r14d, eax
test eax, eax
jne 0x180019134
mov rcx, r12
call sym.SafeBase64.dll_SafeBase_free
xor eax, eax
jmp 0x180019208
mov rdx, qword [rsp + 0x38]
mov eax, esi
sub eax, dword [rsp + 0x30]
mov rcx, r15
cmp eax, ebx
cmovae eax, ebx
add rdx, r12
mov r8d, eax
mov esi, eax
call fcn.180112cb0
mov rcx, r12
call sym.SafeBase64.dll_SafeBase_free
mov r12d, dword [rsp + 0x34]
add r15, rsi
sub ebx, esi
not ebp
and ebp, ebx
je 0x18001919a
mov rcx, qword [r13]
lea r9, [rsp + 0x48]
mov r8d, ebp
mov qword [rsp + 0x20], 0
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r14d, eax
test eax, eax
je 0x1800191e2
mov eax, ebp
sub ebx, ebp
add r15, rax
add esi, ebp
test ebx, ebx
je 0x1800191fe
mov ecx, r12d
lea rdx, [0x1801423a8]
call fcn.18010fb14
mov rbp, rax
test rax, rax
je 0x1800191e2
mov rcx, qword [r13]
lea r9, [rsp + 0x48]
mov r8d, r12d
mov qword [rsp + 0x20], 0
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r14d, eax
test eax, eax
jne 0x1800191e6
mov rcx, rbp
call sym.SafeBase64.dll_SafeBase_free
xor eax, eax
jmp 0x180019208
mov r8d, ebx
mov rdx, rbp
mov rcx, r15
call fcn.180112cb0
mov rcx, rbp
add esi, ebx
call sym.SafeBase64.dll_SafeBase_free
mov rax, qword [rsp + 0x40]
mov dword [rax], esi
mov eax, r14d
mov r12, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x80
pop r15
pop r13
pop rbx
ret
Function at 0x18001a850
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
push r15
lea rbp, [rsp - 0x11a8]
mov eax, 0x12a8
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x1180], rax
xor esi, esi
mov r13d, r9d
mov r12, r8
mov r15, rdx
test rcx, rcx
je 0x18001aae6
mov r8, rcx
mov edx, 0x3ff
lea rcx, [rbp + 0x980]
call fcn.1801259f0
mov rbx, 0xffffffffffffffff
lea rcx, [rbp + 0x980]
mov rax, rbx
nop dword [rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x18001a8c0
cmp word [rbp + rax*2 + 0x97e], 0x5c
jne 0x18001a8f2
lea rax, [rax*2 - 2]
cmp rax, 0x800
jae 0x18001ab08
mov word [rbp + rax + 0x980], si
lea r8, [rbp + 0x980]
mov edx, 0x3ff
lea rcx, [rbp + 0x180]
call fcn.1801259f0
test r15, r15
je 0x18001a932
cmp word [r15], si
je 0x18001a932
lea r8, [0x180155ad4]
mov edx, 0x3ff
lea rcx, [rbp + 0x180]
call fcn.180125a58
mov r8, r15
jmp 0x18001a981
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18001a976
lea rax, [rbp + 0x180]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], si
jne 0x18001a950
test ebx, ebx
je 0x18001a992
movsxd rax, ebx
movzx ecx, word [rbp + rax*2 + 0x17e]
cmp cx, 0x5c
je 0x18001a97a
cmp cx, 0x3a
je 0x18001a97a
jmp 0x18001a992
test al, 0x10
je 0x18001a992
lea r8, [0x180155a80]
mov edx, 0x3ff
lea rcx, [rbp + 0x180]
call fcn.180125a58
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001aae6
mov qword [rsp + 0x12a0], rdi
mov edi, dword [rbp + 0x1208]
mov qword [rsp + 0x1298], r14
mov r14d, dword [rbp + 0x1200]
nop
lea rdx, [0x180155a8c]
lea rcx, [rsp + 0x5c]
call fcn.1801153c8
test eax, eax
je 0x18001aab3
lea rdx, [0x180155a90]
lea rcx, [rsp + 0x5c]
call fcn.1801153c8
test eax, eax
je 0x18001aab3
test byte [rsp + 0x30], 0x10
je 0x18001aa5c
test edi, edi
je 0x18001aab3
lea rax, [rsp + 0x5c]
mov edx, 0x3ff
lea r9, [rbp + 0x980]
mov qword [rsp + 0x20], rax
lea r8, [0x180154c70]
lea rcx, [rbp + 0x180]
call fcn.18000f870
mov r9d, r13d
mov dword [rsp + 0x28], edi
mov r8, r12
mov dword [rsp + 0x20], r14d
mov rdx, r15
lea rcx, [rbp + 0x180]
call sym.SafeBase64.dll_EncryptFolder
mov esi, eax
jmp 0x18001aab3
lea rax, [rsp + 0x5c]
mov edx, 0x3ff
lea r9, [rbp + 0x980]
mov qword [rsp + 0x20], rax
lea r8, [0x180154c70]
lea rcx, [rbp + 0x180]
call fcn.18000f870
mov r9d, r14d
lea rcx, [rbp + 0x180]
mov r8d, r13d
mov rdx, r12
call sym.SafeBase64.dll_SlfEncryptFile
mov esi, eax
test eax, eax
jne 0x18001aab3
lea rdx, [rbp + 0x180]
lea rcx, [0x180155a98]
call sym.SafeBase64.dll_DbgPrintW
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18001a9d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r14, qword [rsp + 0x1298]
mov eax, esi
mov rdi, qword [rsp + 0x12a0]
jmp 0x18001aae8
xor eax, eax
mov rcx, qword [rbp + 0x1180]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x12a8
pop r15
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
call fcn.18010fc24
int3