joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009ab8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x140055cd4], 0
lea rsi, [0x140055cd0]
mov ebx, r8d
mov edi, edx
mov r10, rcx
jne 0x140009b1f
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edx, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdx, 1
jne 0x140009aed
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x140009ae5
not ebx
mov edx, ebx
test edi, edi
jle 0x140009b41
movzx eax, byte [r10]
inc r10
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
sub edi, 1
jne 0x140009b27
jmp 0x140009b7b
mov r8b, byte [r10]
inc r10
test r8b, r8b
je 0x140009b7b
mov r9b, 0x23
cmp r8b, r9b
jne 0x140009b60
cmp byte [r10], r9b
jne 0x140009b60
cmp byte [r10 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [r10]
xor rcx, rax
shr edx, 8
inc r10
xor edx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x140009b4f
mov rbx, qword [rsp + 8]
not edx
mov rsi, qword [rsp + 0x10]
mov eax, edx
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14000f9c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140055ca0]
mov rbx, rcx
and dword [rax + 0x2d9c], 0
test rcx, rcx
je 0x14000fa29
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14000fa34
lea rdx, [0x1400489c4]
mov rcx, rbx
mov rdi, rax
call fcn.140009884
mov rbx, rax
test rax, rax
je 0x14000fa29
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001ef84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x14001f175
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, 0x100
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001f026
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
jmp 0x14001f048
movsxd rdx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
xorps xmm6, xmmword [0x140048b50]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
mov al, byte [rbp + 0x20]
xor r15d, r15d
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], r15d
jle 0x14001f168
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001f096
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x14001f09a
mov edx, dword [rax + r12]
mov rcx, rsi
call fcn.14001e6f0
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x20], xmm7
call fcn.14001eb28
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x20]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x1c]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x14001f085
mov r11d, 0x100
add rbx, 0x28
sub rdi, r8
jne 0x14001efd4
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400202d4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140055b80]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140009104
mov rcx, qword [0x140056128]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x140056130]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140056138]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x140056130], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.140009104
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x1400203fd
cvttss2si ecx, dword [rbx]
lea rdx, [rbp - 0x30]
cvttss2si eax, dword [rax + 0x114]
mov dword [rbp - 0x30], ecx
mov rcx, qword [0x140056128]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x140056128]
jne 0x140020452
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140020452
mov rcx, qword [0x140056128]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140020452
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140020460
or eax, 0xffffffff
jmp 0x140020465
call fcn.140009140
cmp dword [0x140054138], eax
je 0x140020478
mov dword [0x140054138], eax
call fcn.1400204a0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140045dd0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x14003aac0
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x140055b80]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x90], 0
jl 0x14003ab19
cmp dword [rsp + 0x90], 0x7c
jge 0x14003ab19
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x90]
lea rcx, [0x1400547f0]
call fcn.14003add0
lea rcx, [rsp + 0x50]
call fcn.140034ce8
nop
cmp qword [rsp + 0x30], 0
jne 0x14003ab3f
lea rdx, [0x14004dcf0]
lea rcx, [rsp + 0x50]
call fcn.1400355a0
jmp 0x14003ab4e
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400355a0
cmp dword [rsp + 0xa0], 1
jne 0x14003ab69
lea rdx, [0x14004dd00]
lea rcx, [rsp + 0x50]
call fcn.1400355a0
movss xmm2, dword [0x14004cbb0]
movss xmm1, dword [0x14004f17c]
lea rcx, [rsp + 0x48]
call fcn.1400350a4
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.14003d5cc
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.14002534c
movzx eax, al
test eax, eax
je 0x14003abde
cmp dword [rsp + 0xa0], 0
jne 0x14003abde
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x50]
call fcn.1400353ec
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140045dd0
add rsp, 0x88
ret

Function at 0x14003ac00
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rcx, [0x14004ddb0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x14004dda0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14003ac89
lea rcx, [0x14004ddc8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserSendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14003ac89
lea rcx, [0x14004dddc]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14003ac89
xor al, al
jmp 0x14003ad3b
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x14004dde8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14003ad0b
lea rcx, [0x14004de20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserGetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14003ad0b
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x14004de28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14003ad0b
xor al, al
jmp 0x14003ad3b
mov r8d, 0x1e
mov rdx, qword [rsp + 0x20]
lea rcx, [0x140056958]
call fcn.140046912
mov r8d, 0x1e
mov rdx, qword [rsp + 0x28]
lea rcx, [0x140056978]
call fcn.140046912
mov al, 1
add rsp, 0x38
ret
Function at 0x14003c100
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14003c132
xor eax, eax
jmp 0x14003c188
mov r8d, 0x1e
lea rdx, [0x140056978]
mov rcx, qword [rsp + 0x28]
call fcn.140046912
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x14003f634
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rax, qword [0x140055b80]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x130
rep stosb byte [rdi], al
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14003f6d0
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14003f6bd
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x14003f6dd
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14003f695
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140045dd0
add rsp, 0x170
pop rdi
ret
Function at 0x140043764
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14003c7a4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xa0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], 0
lea rax, [0x14003cd6c]
mov qword [rsp + 0x78], rax
lea rax, [0x14004e2b0]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x14004381c
lea rdx, str._n_n_Notepad
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400307b0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, str.Notepad
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400569c0], rax
mov edx, 5
mov rcx, qword [0x1400569c0]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x14004e2a0]
mov rcx, qword [0x1400569c0]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x1400569c0]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x1400569c0]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0xc0
pop rdi
ret
Function at 0x1400464d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140046522
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140046522
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140046522
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140046522
cmp dword [rcx + 0x84], 0xe
jbe 0x140046522
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140046524
xor al, al
add rsp, 0x28
ret
Function at 0x180001000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x18002b0d8]
mov rcx, qword [0x18002b0e8]
call qword [rax + 0x288]
mov rax, qword gs:[0x30]
xor r11d, r11d
mov rsi, qword [0x18002b0e8]
xor r10d, r10d
mov r9, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x18]
mov ecx, r10d
test r10d, r10d
je 0x180001073
sub ecx, 1
je 0x180001067
cmp ecx, 1
jne 0x18000107d
lea rdx, [rbx + 0x30]
lea r11d, [rcx + 0x1f]
jmp 0x18000107a
lea rdx, [rbx + 0x20]
mov r11d, reloc.OLEAUT32.dll_SafeArrayGetDim
jmp 0x18000107a
lea rdx, [rbx + 0x10]
xor r11d, r11d
mov r9, rdx
mov r8, qword [rdx]
cmp r8, r9
je 0x1800010b7
mov edi, r11d
mov rax, r8
mov rdx, r8
sub rax, rdi
cmp qword [rax + 0x30], rsi
jne 0x1800010ac
mov rcx, qword [r8 + 8]
mov rax, qword [r8]
mov qword [rcx], rax
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rax, qword [r8]
mov r8, rax
cmp rax, r9
jne 0x180001088
inc r10d
cmp r10d, 3
jl 0x18000104b
call fcn.1800017c4
mov rax, qword [0x18002b0d8]
xor ecx, ecx
call qword [rax + 0x1d8]
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800010e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x330
mov rbx, rcx
cmp edx, 1
jne 0x180001238
xor r8d, r8d
mov edx, 0x96000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x18002bc58], rax
call fcn.18000d0c0
mov rcx, rbx
mov qword [0x18002b0e8], rbx
mov dword [0x18002b0e0], 1
call fcn.18001b700
mov edx, 0x298
lea rcx, [0x180024dd0]
mov r8d, 5
call fcn.18000d008
xor r8d, r8d
mov qword [0x18002b0d8], rax
mov edx, 0x1d0
lea rcx, [0x180024f20]
call fcn.18000d008
mov ecx, 0x53b
mov qword [0x18002b0d0], rax
call fcn.18000de90
mov rcx, rax
mov qword [rsp + 0x358], rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x358]
cmp eax, 0xffffffff
je 0x1800011a3
call fcn.18000de2c
xor eax, eax
jmp 0x180001227
call fcn.18000de2c
xor ebx, ebx
mov edi, reloc.OLEAUT32.dll_SafeArrayLock
movzx eax, word [0x18002500c]
lea rcx, [rsp + 0x33]
mov word [rsp + 0x30], ax
xor edx, edx
mov al, byte [0x18002500e]
mov r8d, 0xfd
mov byte [rsp + 0x32], al
call sub.msvcrt.dll_memset
xor edx, edx
mov word [rsp + 0x130], bx
mov r8d, 0x1fe
lea rcx, [rsp + 0x132]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x130]
mov dword [rsp + 0x28], 0xff
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub rdi, 1
jne 0x1800011af
mov eax, 1
mov rbx, qword [rsp + 0x340]
add rsp, 0x330
pop rdi
ret
test edx, edx
jne 0x180001222
mov rax, qword [0x18002b0d8]
mov ecx, 0xaa
call qword [rax + 0x178]
jmp 0x18000119c
Function at 0x18000127c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rcx, qword [0x18002bc58]
xor ebx, ebx
test rcx, rcx
jne 0x18000129b
mov edi, ebx
jmp 0x1800012ad
mov edx, 8
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov rcx, qword [0x18002b140]
cmp word [rcx + 0x242], 0x3a
jne 0x1800012f2
movzx eax, word [rcx + 0x240]
mov word [rsp + 0x20], ax
movzx eax, word [rcx + 0x242]
mov word [rsp + 0x22], ax
movzx eax, word [rcx + 0x244]
lea rcx, [rsp + 0x20]
mov word [rsp + 0x24], ax
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov qword [rdi], 2
lea r14, [rdi + 8]
call fcn.18000345c
mov ecx, 0x7bd
mov qword [r14], rax
call fcn.18000de90
mov rcx, qword [0x18002b140]
xor r8d, r8d
add rcx, 0x240
mov qword [rsp + 0x68], rax
mov rdx, rax
call fcn.18000d68c
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rsi, rax
call fcn.18000de2c
mov rax, qword [0x18002b0d8]
mov rcx, rsi
call qword [rax + 0x110]
cmp eax, 0xffffffff
je 0x180001382
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.180015e1c
test rax, rax
jne 0x18000136b
mov rax, rbx
jmp 0x180001373
mov rcx, rax
call fcn.18000fb10
lea rsi, [rdi + 0x10]
mov dword [rdi], 3
mov qword [rsi], rax
jmp 0x180001386
lea rsi, [rdi + 0x10]
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x70]
call fcn.18000c864
mov rcx, qword [r14]
test rcx, rcx
je 0x1800013c8
mov r8d, dword [rcx]
mov eax, ebx
test r8d, r8d
je 0x1800013c8
mov rdx, qword [rcx + 8]
mov ecx, eax
add rcx, rcx
cmp dword [rdx + rcx*8], 0x3b
je 0x1800013c1
inc eax
cmp eax, r8d
jb 0x1800013ad
jmp 0x1800013c8
cmp qword [rdx + rcx*8 + 8], rbx
jne 0x1800013d6
call fcn.180003330
test eax, eax
je 0x1800013d6
or ebx, 0xffffffff
jmp 0x1800013de
mov rcx, rdi
call fcn.180002538
mov rcx, r14
call fcn.18000fc2c
mov rcx, rsi
call fcn.18000fc2c
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1800014c4
Capabilities:
Set current directory

Disassembly:
push rbx
sub rsp, 0x60
mov ecx, 0x141d
call fcn.18000de50
mov rcx, rax
mov qword [rsp + 0x70], rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rax, [0x18002bb7c]
cmp rbx, rax
je 0x1800014ff
or rdx, 0xffffffffffffffff
lea rcx, [rsp + 0x70]
call fcn.18000c864
mov r8, qword [0x18002b140]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
mov r8d, dword [r8 + 0xac]
call fcn.18000f018
mov qword [0x18002c670], rax
test rax, rax
jne 0x180001534
or eax, 0xffffffff
jmp 0x180001631
call fcn.180017d20
mov ecx, 0x31
mov dword [rsp + 0x70], ebx
call fcn.18000f520
test eax, eax
jne 0x180001584
mov rax, qword [0x18002b140]
cmp dword [rax + 0x218], 3
je 0x180001584
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x18000326c]
mov rax, qword [0x18002b0d8]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [rax + 0xf0]
call fcn.18000170c
mov dword [0x18002bb60], eax
test eax, eax
je 0x1800015f3
sub eax, 1
je 0x1800015fc
sub eax, 1
je 0x18000162f
cmp eax, 1
jne 0x18000162f
mov rax, qword [0x18002b140]
lea rcx, [rsp + 0x30]
mov edx, dword [rax + 0xac]
add edx, 4
call fcn.180010abc
lea rcx, [rsp + 0x30]
call fcn.1800118fc
mov rcx, qword [0x18002b140]
mov edx, 0x1d4c0
mov ecx, dword [rcx + 0xac]
call fcn.180002e1c
mov qword [0x18002b120], rax
call fcn.180001400
jmp 0x180001611
call fcn.18000127c
test eax, eax
js 0x18000162f
mov rax, qword [0x18002b140]
cmp dword [rax + 0xa4], 1
je 0x180001611
call fcn.180017c40
mov rax, qword [0x18002b0d8]
lea rdx, [0x180001254]
mov ecx, 1
call qword [rax + 0x230]
call fcn.180002bc0
xor eax, eax
add rsp, 0x60
pop rbx
ret
Function at 0x1800092ac
Capabilities:
Create directory

Disassembly:
push rbp
push rbx
push rsi
push r14
push r15
lea rbp, [rsp - 0x9a0]
sub rsp, 0xaa0
and dword [rbp + 0x9d0], 0
lea eax, [rcx - 1]
mov r8, rdx
mov ebx, ecx
cmp eax, 1
jbe 0x1800092df
or eax, 0xffffffff
jmp 0x1800094c3
lea rdx, [rbp + 0x9d0]
mov rcx, r8
call fcn.180016d1c
mov qword [rsp + 0x30], rax
mov rsi, rax
test rax, rax
jne 0x180009303
lea eax, [rsi - 2]
jmp 0x1800094c3
mov rcx, qword [0x18002b140]
xor edx, edx
add rcx, 0xb0
je 0x180009326
cmp byte [rcx], dl
je 0x180009326
mov rax, rcx
inc rax
inc edx
cmp byte [rax], 0
jne 0x18000931c
xor r8d, r8d
call fcn.180014970
lea rdx, [rbp - 0x30]
lea ecx, [rbx + rax]
call fcn.18001c234
mov r9d, SafeArrayGetDim
lea rax, [rbp - 0x30]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8d, [r9 - 2]
lea ecx, [r9 - 0xa]
call fcn.18000d170
movsxd rcx, eax
lea rdx, [0x18002523c]
mov eax, 0x2e
xor r8d, r8d
mov word [rsp + rcx*2 + 0x48], ax
mov rcx, qword [0x18002b140]
add rcx, 0x458
call fcn.18000d68c
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x50]
mov rcx, rax
lea rdx, [0x180025194]
mov rbx, rax
call fcn.18000d68c
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, qword [0x18002b140]
mov r9b, 2
add rdx, 0xb0
mov r8d, 2
mov rcx, r15
call fcn.180015ec0
mov qword [rbp + 0x9e0], rax
mov r14, rax
test rax, rax
jne 0x1800093ed
lea ebx, [rax - 4]
jmp 0x18000947e
mov r8d, dword [rbp + 0x9d0]
mov rdx, rsi
mov rcx, rax
call fcn.1800162b4
test eax, eax
jns 0x18000940a
mov ebx, 0xfffffffb
jmp 0x18000947e
lea rcx, [rbp + 0x9e0]
call fcn.180015fe0
mov rcx, qword [0x18002b140]
lea r8, [rsp + 0x50]
add rcx, 0x458
lea rdx, [0x180025194]
xor r9d, r9d
call fcn.18000d68c
mov rdx, rax
mov qword [rbp + 0x9e8], rax
mov rcx, r15
call fcn.18000e230
mov ebx, eax
lea rcx, [rbp + 0x9e8]
mov rdx, 0xfffffffffffffffe
sar ebx, 0x1f
call fcn.18000c864
and ebx, 0xfffffff9
jne 0x180009473
mov ecx, 0x2deb8b96
call fcn.180008b4c
jmp 0x18000948f
test ebx, ebx
jns 0x18000948f
mov r14, qword [rbp + 0x9e0]
test r14, r14
je 0x18000948f
lea rcx, [rbp + 0x9e0]
call fcn.180015fe0
mov edx, dword [rbp + 0x9d0]
lea rcx, [rsp + 0x30]
call fcn.18000c864
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x38]
call fcn.18000c864
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x40]
call fcn.18000c864
mov eax, ebx
add rsp, 0xaa0
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret