joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d3cc0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movzx esi, r9b
mov r14, r8
mov ebx, edx
mov rdi, rcx
call fcn.1800ac590
test bl, 2
jne 0x1800d3d4b
mov rax, qword [rdi + 0x1c8]
mov byte [rax + 0x40], sil
test sil, sil
je 0x1800d3d0a
mov edx, 0x7ed
mov rcx, rdi
call fcn.1800d4a80
jmp 0x1800d3d4b
cmp qword [rdi + 0x128], 0
je 0x1800d3d4b
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1800d3d31
cmp byte [rdi + 0x130], 0
jne 0x1800d3d31
xor r8b, r8b
jmp 0x1800d3d34
mov r8b, 1
mov rdx, qword [r14]
mov rcx, qword [rdi + 0x128]
call fcn.1800ed900
mov rcx, rdi
call fcn.1800d4f90
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x1800d3d70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x1c8]
mov rbx, rcx
movzx ebp, r9b
mov rdi, r8
mov esi, edx
movzx ecx, byte [rax + 0x40]
mov byte [rax + 0x40], 0
test dl, 2
je 0x1800d3dc7
cmp byte [rbx + 0x1b8], 0
je 0x1800d3dc7
mov rax, qword [rbx + 0x1c8]
mov rcx, rbx
mov byte [rax + 0x40], 0
call fcn.1800d3f10
mov al, 1
jmp 0x1800d3e72
test cl, cl
jne 0x1800d3dc0
cmp qword [rbx + 0x128], 0
je 0x1800d3e0c
cmp byte [rbx + 0x1c5], cl
jne 0x1800d3e0c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1800d3dfa
cmp byte [rbx + 0x130], 0
jne 0x1800d3dfa
xor r8b, r8b
jmp 0x1800d3dfd
mov r8b, 1
mov rdx, qword [rdi]
mov rcx, qword [rbx + 0x128]
call fcn.1800ed900
xor eax, eax
mov byte [rbx + 0x130], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov eax, dword [rbx + 0xbc]
mov r8b, 1
sub eax, dword [rbx + 0xb4]
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0xc0]
sub eax, dword [rbx + 0xb8]
mov dword [rsp + 0x2c], eax
movaps xmm0, xmmword [rsp + 0x20]
mov rax, qword [rbx]
movdqa xmmword [rsp + 0x20], xmm0
call qword [rax + pe_nt_image_headers64]
mov rcx, rbx
call fcn.1800d4f90
movzx r9d, bpl
mov r8, rdi
mov edx, esi
mov rcx, rbx
call fcn.1800ac6f0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800e1320
Capabilities:
Read file on windows

Disassembly:
mov r9, qword [rcx + 8]
mov rax, rdx
mov rcx, rax
mov edx, 1
jmp fcn.18018d438
Function at 0x1800e34e0
Capabilities:
Get file size
Get system information on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rdx
mov rdi, rcx
mov ecx, 0x48
call fcn.18017e70c
mov rbx, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rax
cmp qword [0x1802713b8], rax
jne 0x1800e358d
mov rcx, qword [0x180271048]
test rcx, rcx
je 0x1800e3565
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x1802713b8], 0
jne 0x1800e357b
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x68]
mov qword [0x1802713b8], rax
mov rcx, qword [0x180271048]
test rcx, rcx
je 0x1800e358d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800e35a8
mov rcx, qword [rsp + 0x38]
mov qword [rbx + 0x30], rcx
mov qword [rdi], rbx
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18017e6e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800e6f20
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov rbx, rcx
mov qword [rbp - 0x40], rcx
xor esi, esi
mov dword [rbp - 0x50], esi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
movdqa xmm6, xmmword [0x1801f4bb0]
movdqu xmmword [rbp - 0x28], xmm6
mov word [rbp - 0x38], si
lea ecx, [rsi + 0xd]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x1800e6f9d
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm6
movdqa xmm0, xmm6
movdqu xmmword [rbp - 0x28], xmm6
mov word [rbp - 0x38], si
jmp 0x1800e7017
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1800e6ffb
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1800e6ff5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800e6fd0
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1800099c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
movdqu xmm6, xmmword [rbp - 0x28]
call qword [sym.imp.USER32.dll_CloseClipboard]
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rbx], xmm0
movdqa xmm0, xmmword [0x1801f4bb0]
mov word [rbp - 0x38], si
movdqu xmmword [rbp - 0x28], xmm0
movups xmmword [rbx + 0x10], xmm6
mov dword [rbp - 0x50], 1
movdqa xmm0, xmmword [0x1801f4bb0]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], si
mov rax, rbx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.18017e6e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [rsp + 0x60]
mov rsp, r11
pop rbp
ret
Function at 0x1800e94e0
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rbp, r9
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0x58], r8
xor ebx, ebx
lea r9, [rcx + 0x40]
lea r8, [0x180269a40]
call fcn.180085410
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 0x82000000
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call fcn.1800e9870
mov qword [rsi + 8], rax
test rax, rax
je 0x1800e96b7
mov ecx, 0xc0
call fcn.18017e70c
mov rdi, rax
mov qword [rsp + 0x80], rax
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call fcn.180180df0
mov qword [rdi + 8], rbx
call fcn.1800f7230
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x90], rcx
mov qword [rcx + 0x18], rbx
mov qword [rdi + 0x30], rbx
mov dword [rdi + 0x38], ebx
mov rax, qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [rdi + 0x40], rax
movups xmm0, xmmword [0x1801ca418]
movups xmmword [rdi + 0x50], xmm0
movups xmm0, xmmword [0x1801ca418]
movups xmmword [rdi + 0x60], xmm0
mov dword [rdi + 0x70], ebx
mov dword [rdi + 0x74], 0xfefefefe
movups xmm0, xmmword [0x1801ca418]
movups xmmword [rdi + 0x50], xmm0
movups xmm1, xmmword [0x1801ca418]
movups xmmword [rdi + 0x60], xmm1
lea rax, vtable.RC::IERenderView.2.0
mov qword [rdi], rax
lea rax, vtable.RC::IERenderView.0
mov qword [rdi + 0x48], rax
lea rax, vtable.RC::IERenderView.1.0
mov qword [rdi + 0x78], rax
mov qword [rdi + 0x80], rbx
mov qword [rdi + 0x88], rbx
mov qword [rdi + 0x90], rbx
mov qword [rdi + 0x98], rbx
mov qword [rdi + 0xa0], rbx
mov word [rdi + 0xa8], bx
mov byte [rdi + 0xaa], bl
mov qword [rdi + 0xb0], rbp
mov qword [rdi + 0xb8], rbx
mov qword [rsi + 0x50], rdi
mov rax, qword [rsi + 8]
mov qword [rdi + 0x80], rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x1800f9cd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x90], rax
lea ecx, [rbx + 0x38]
call fcn.18017e70c
mov rcx, rax
mov qword [rsp + 0x80], rax
xor eax, eax
mov qword [rcx + 8], rax
mov qword [rcx + 0x30], rax
lea rax, vtable.RC::IEExternal.0
mov qword [rcx], rax
mov dword [rcx + 8], ebx
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbx
mov qword [rcx + 0x28], rbx
mov qword [rcx + 0x30], rbx
mov qword [rdi + 0xa0], rcx
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800ee640
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r13, rcx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x1800ee68c
xor al, al
jmp 0x1800ee7e1
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1800ee685
xor bl, bl
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov r15, rax
test rax, rax
je 0x1800ee7d8
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rbp, rax
mov qword [rsp + 0x50], rax
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x1800ee700
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.1800099c0
nop
mov rax, qword [r13 + 0x60]
cmp byte [rax + 0x11e], 0
je 0x1800ee766
mov rbx, r12
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x1800ee766
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
nop dword [rax]
lea rax, [rsp + 0x28]
cmp r14, 8
cmovae rax, rdi
movzx ecx, word [rax + rbx*2]
call fcn.180189040
test eax, eax
je 0x1800ee80c
inc rbx
cmp rbx, rsi
jb 0x1800ee740
mov bl, 1
lea rdx, [rsp + 0x28]
mov rcx, r13
call fcn.1800ee070
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
cmp r14, 8
jb 0x1800ee7b6
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800ee7ae
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ee813
mov rcx, rdi
call fcn.18017ebfc
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
test rbp, rbp
je 0x1800ee7d8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18017e6e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor bl, bl
jmp 0x1800ee77f
call fcn.18018341c
int3
Function at 0x1800ee8a0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
xor ebp, ebp
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1800ee8ec
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x1800ee8f3
call qword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
jmp 0x1800eea07
xor bl, bl
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1800ee820
nop
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1800ee9ac
lea rsi, [rax*2 + 2]
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdi, qword [rsp + 0x30]
mov rdx, rsi
mov ecx, 0x2002
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x1800ee9ac
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x1800ee972
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop
xor bl, bl
jmp 0x1800ee9ac
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.180180990
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
jne 0x1800ee9aa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor bl, bl
jmp 0x1800ee9ac
mov bl, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1800ee9f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ee9ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800eea2a
call fcn.18017ebfc
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18017e6e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.18018341c
int3
Function at 0x1800fd180
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x11
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1800fd1c0
test rbx, rbx
je 0x1800fd1c0
cmp dword [rbx + 8], 0x100
jne 0x1800fd1c0
mov rax, qword [rbx + 0x10]
cmp rax, 0x4c
je 0x1800fd1d0
add rax, 0xffffffffffffffb2
cmp rax, 1
jbe 0x1800fd1d0
cmp dword [rbx + 8], 0x104
jne 0x1800fd1d8
cmp qword [rbx + 0x10], 0x12
jne 0x1800fd1d8
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x18012fda0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rdx
mov r14d, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], rdx
xor esi, esi
mov qword [rdx + 0x10], rsi
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x18012fde4
mov rax, qword [rdx]
mov word [rax], si
call fcn.18012fec0
movzx edi, al
mov byte [rsp + 0x20], al
jmp 0x18012fe09
test dil, dil
jne 0x18012fe89
cmp r14d, 0x1a
jne 0x18012fe89
mov qword [rbx + 0x10], rsi
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x18012fe25
mov rax, qword [rbx]
mov word [rax], si
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x40]
call fcn.180180df0
mov r8d, 0x207
lea rdx, [rsp + 0x40]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18012fe60
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1800099c0
movzx edi, dil
mov eax, 1
cmp qword [rbx + 0x10], 0
cmovne edi, eax
movzx eax, dil
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18017e6e0
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r14
pop rdi
pop rsi
ret

Function at 0x180130170
Capabilities:
Query environment variable

Disassembly:
mov rdx, rcx
mov ecx, 0x1a
jmp fcn.18012fda0
Function at 0x180138c00
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x60
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], rsi
xor ebx, ebx
cmp qword [rcx + 0x20], 0xffffffffffffffff
mov r14, r9
mov qword [rsp + 0x50], rdi
mov rsi, rdx
mov qword [rsp + 0x40], r15
mov edi, r8d
mov r15, rcx
mov ebp, ebx
jne 0x180138c45
mov ebx, 1
jmp 0x180138c96
mov qword [rsp + 0x48], r12
mov r12d, 0x100000
mov rcx, qword [r15 + 0x20]
lea r9, [rsp + 0x30]
mov r8d, edi
mov dword [rsp + 0x30], ebx
cmp edi, r12d
mov qword [rsp + 0x20], rbx
mov rdx, rsi
cmova r8d, r12d
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
add ebp, ecx
test eax, eax
je 0x180138c8c
test ecx, ecx
je 0x180138c91
add rsi, rcx
sub edi, ecx
jne 0x180138c50
jmp 0x180138c91
mov ebx, 1
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
mov eax, ebx
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
test r14, r14
je 0x180138caf
mov dword [r14], ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x60
pop r14
pop rbp
pop rbx
ret

Function at 0x180139620
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
cmp rcx, 0xffffffffffffffff
je 0x18013965b
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x18013965b
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x20]
call fcn.18014b7e0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x180142220
Capabilities:
Check if file exists

Disassembly:
cmp dword [rcx + 0x50], 0
jge 0x180142360
jmp 0x180142230
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x478
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor dil, dil
mov byte [rsp + 0x30], dil
xor edx, edx
mov r8d, 0x412
lea rcx, [rsp + 0x40]
call fcn.180180df0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.180141f20
cmp byte [rsi + 0x40], dil
je 0x1801422bd
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1801422b9
test al, 0x10
jne 0x1801422b9
call fcn.180143950
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180143c20
test al, al
jne 0x1801422bd
xor al, al
jmp 0x180142336
mov qword [rsi + 0x48], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x180142336
lea rdx, str.ExtractArchive
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180142313
mov qword [rsi + 0x48], rbx
mov qword [rsp + 0x20], rsi
lea r9, [0x180141e50]
mov r8, r12
mov rdx, r15
mov rcx, r14
call rax
test eax, eax
sete dil
mov byte [rsp + 0x30], dil
mov qword [rsi + 0x48], 0
jmp 0x180142324
test rbx, rbx
je 0x180142332
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, dil
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x478
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x478
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rdi, rcx
xor sil, sil
mov byte [rsp + 0x30], sil
xor edx, edx
mov r8d, 0x412
lea rcx, [rsp + 0x40]
call fcn.180180df0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180141f20
cmp byte [rdi + 0x40], sil
je 0x1801423f0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1801423e9
test al, 0x10
jne 0x1801423e9
call fcn.180143950
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180143c20
test al, al
jne 0x1801423f0
xor al, al
jmp 0x180142474
mov qword [rdi + 0x48], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x180142474
lea rdx, str.ExtractArchive2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x180142451
mov qword [rdi + 0x48], rbx
mov eax, dword [rdi + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea r9, [0x180141e50]
mov r8, r12
mov rdx, r15
mov rcx, r14
call r10
test eax, eax
sete sil
mov byte [rsp + 0x30], sil
mov qword [rdi + 0x48], 0
jmp 0x180142462
test rbx, rbx
je 0x180142470
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, sil
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x478
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180142230
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [rcx + 0x50], 0
jge 0x180142360
jmp 0x180142230
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x478
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor dil, dil
mov byte [rsp + 0x30], dil
xor edx, edx
mov r8d, 0x412
lea rcx, [rsp + 0x40]
call fcn.180180df0
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.180141f20
cmp byte [rsi + 0x40], dil
je 0x1801422bd
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1801422b9
test al, 0x10
jne 0x1801422b9
call fcn.180143950
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180143c20
test al, al
jne 0x1801422bd
xor al, al
jmp 0x180142336
mov qword [rsi + 0x48], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x180142336
lea rdx, str.ExtractArchive
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180142313
mov qword [rsi + 0x48], rbx
mov qword [rsp + 0x20], rsi
lea r9, [0x180141e50]
mov r8, r12
mov rdx, r15
mov rcx, r14
call rax
test eax, eax
sete dil
mov byte [rsp + 0x30], dil
mov qword [rsi + 0x48], 0
jmp 0x180142324
test rbx, rbx
je 0x180142332
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, dil
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x478
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x478
mov rax, qword [0x180268080]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rdi, rcx
xor sil, sil
mov byte [rsp + 0x30], sil
xor edx, edx
mov r8d, 0x412
lea rcx, [rsp + 0x40]
call fcn.180180df0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180141f20
cmp byte [rdi + 0x40], sil
je 0x1801423f0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1801423e9
test al, 0x10
jne 0x1801423e9
call fcn.180143950
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180143c20
test al, al
jne 0x1801423f0
xor al, al
jmp 0x180142474
mov qword [rdi + 0x48], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x180142474
lea rdx, str.ExtractArchive2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x180142451
mov qword [rdi + 0x48], rbx
mov eax, dword [rdi + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea r9, [0x180141e50]
mov r8, r12
mov rdx, r15
mov rcx, r14
call r10
test eax, eax
sete sil
mov byte [rsp + 0x30], sil
mov qword [rdi + 0x48], 0
jmp 0x180142462
test rbx, rbx
je 0x180142470
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, sil
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18017e6e0
add rsp, 0x478
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret