joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005e3a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
test rcx, rcx
mov ebx, 0x10000
je 0x18005e3c0
lea rbx, [rcx + 0x10000]
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov esi, 0x5a4d
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18005e467
cmp dword [rsp + 0x40], 0x1000
jne 0x18005e469
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x18005e469
bt eax, 8
jb 0x18005e469
cmp qword [rsp + 0x38], 0x40
jbe 0x18005e469
cmp word [rbx], si
jne 0x18005e469
movsxd rdi, dword [rbx + 0x3c]
add rdi, rbx
mov rax, rdi
sub rax, rbx
add rax, 4
cmp rax, qword [rsp + 0x38]
jb 0x18005e458
mov edx, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x18005e469
cmp dword [rdi], 0x4550
jne 0x18005e469
mov rax, rbx
jmp 0x18005e467
jmp 0x18005e478
mov rbx, qword [rsp + 0x38]
add rbx, qword [rsp + 0x20]
jmp 0x18005e3f0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x18005e490
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x30
mov r9, rcx
test rcx, rcx
jne 0x18005e4ab
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rax
mov eax, 0x5a4d
cmp word [r9], ax
je 0x18005e4c8
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18005e591
movsxd r10, dword [r9 + 0x3c]
add r10, r9
cmp dword [r10], 0x4550
je 0x18005e4ea
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18005e591
movzx eax, word [r10 + 0x14]
test ax, ax
jne 0x18005e506
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18005e591
movzx eax, ax
lea r11, [rax + r10 + 0x18]
xor edx, edx
mov dword [rsp + 0x20], edx
movzx eax, word [r10 + 6]
cmp edx, eax
jae 0x18005e575
lea rcx, [rdx + rdx*4]
lea r8, [r11 + rcx*8]
lea rdi, str.tdetour
mov rsi, r8
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
jne 0x18005e571
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x18005e575
cmp dword [r8 + 0x10], 0
je 0x18005e575
lea rdi, [r9 + rax]
mov eax, dword [rdi]
cmp eax, 0x40
jb 0x18005e575
cmp dword [rdi + 4], 0x727444
jne 0x18005e575
cmp dword [rdi + 8], 0
jne 0x18005e564
mov dword [rdi + 8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
jmp 0x18005e591
inc edx
jmp 0x18005e510
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18005e591
mov rsi, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18005e9f0
Capabilities:
Parse pe header

Disassembly:
push rbp
push r14
sub rsp, 0x28
xor ebp, ebp
mov r14, rcx
test rcx, rcx
je 0x18005eb1c
xor ecx, ecx
mov qword [rsp + 0x58], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test rax, rax
je 0x18005eb17
mov eax, 0x5a4d
cmp word [r12], ax
jne 0x18005eb17
movsxd rax, dword [r12 + 0x3c]
add rax, r12
je 0x18005eb17
cmp dword [rax], 0x4550
jne 0x18005eb17
mov qword [rsp + 0x40], rbx
mov ebx, dword [rax + 0x90]
add rbx, r12
je 0x18005eb12
mov ecx, dword [rax + 0x94]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], r13
movabs rax, 0xcccccccccccccccd
mov esi, ebp
mul rcx
mov r13, rdx
shr r13, 4
test r13d, r13d
je 0x18005eb08
add rbx, 0xc
mov qword [rsp + 0x50], rdi
cmp dword [rbx - 0xc], ebp
jne 0x18005ea9f
cmp dword [rbx + 4], ebp
je 0x18005eb03
mov edi, dword [rbx]
add rdi, r12
je 0x18005eb03
mov rdx, r14
mov rcx, rdi
call fcn.18003da0c
test eax, eax
je 0x18005eafe
mov edx, 0x5c
mov rcx, rdi
call fcn.180029eb0
mov r11, rax
test rax, rax
je 0x18005eaf1
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r11
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 1
jbe 0x18005eaf1
lea rcx, [r11 + 1]
mov rdx, r14
call fcn.18003da0c
test eax, eax
je 0x18005eafe
inc esi
add rbx, 0x14
cmp esi, r13d
jb 0x18005ea95
jmp 0x18005eb03
mov ebp, 1
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x58]
mov eax, ebp
add rsp, 0x28
pop r14
pop rbp
ret
Function at 0x18005f990
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x190
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rcx
lea rcx, [0x1800b0254]
mov rsi, rdx
call fcn.18005d630
mov rbx, rax
test rax, rax
jne 0x18005f9d5
xor eax, eax
jmp 0x18005fa82
xor eax, eax
lea r8, [rsp + 0x30]
mov rdx, rsi
lea r9d, [rax + 0x40]
mov rcx, rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
je 0x18005f9ce
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
jne 0x18005f9ce
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x108
call fcn.180029630
movsxd rdx, dword [rsp + 0x6c]
lea r8, [rsp + 0x70]
add rdx, rsi
mov r9d, 0x108
mov rcx, rdi
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
je 0x18005f9ce
cmp dword [rsp + 0x70], 0x4550
jne 0x18005f9ce
movzx eax, word [rsp + 0x86]
not ax
movzx eax, ax
shr eax, 0xd
and eax, 1
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.180029600
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18005fb70
Capabilities:
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0xc0
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r8
mov rdi, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], r8
test rdx, rdx
mov ebx, 0x10000
je 0x18005fbb2
lea rbx, [rdx + 0x10000]
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
xor r13d, r13d
mov r12d, 0x5a4d
nop dword [rax + rax]
mov r9d, 0x30
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x18005fcd5
mov rcx, qword [rsp + 0x48]
mov rax, rcx
and eax, 0xfff
cmp rax, 0xfff
je 0x18005fcd5
add rcx, qword [rsp + 0x30]
cmp rcx, rbx
jb 0x18005fcd5
cmp dword [rsp + 0x50], 0x1000
jne 0x18005fcc6
mov eax, dword [rsp + 0x54]
cmp al, 1
je 0x18005fcc6
bt eax, 8
jb 0x18005fcc6
mov qword [rsp + 0x20], r13
mov r9d, 0x40
lea r8, [rsp + 0x70]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18005fcc6
cmp word [rsp + 0x70], r12w
jne 0x18005fcb1
movsxd rcx, dword [rsp + 0xac]
mov eax, ecx
cmp rax, qword [rsp + 0x48]
ja 0x18005fcb1
cmp ecx, 0x40
jb 0x18005fcb1
lea rdx, [rbx + rcx]
mov qword [rsp + 0x20], r13
mov r9d, pe_nt_image_headers64
mov r8, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18005fcc6
cmp dword [rsi], 0x4550
jne 0x18005fcc6
mov rax, rbx
jmp 0x18005fcd7
jmp 0x18005fcc6
mov rbx, qword [rsp + 0x48]
add rbx, qword [rsp + 0x30]
jmp 0x18005fbe0
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180029600
add rsp, 0xc0
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180060790
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
test rcx, rcx
mov ebx, 0x10000
je 0x1800607ab
lea rbx, [rcx + 0x10000]
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov edi, 0x5a4d
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18006081a
cmp dword [rsp + 0x40], 0x1000
jne 0x18006081c
mov eax, dword [rsp + 0x44]
cmp al, 1
je 0x18006081c
bt eax, 8
jb 0x18006081c
cmp word [rbx], di
jne 0x18006081c
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x18006081c
mov rax, rbx
jmp 0x18006081a
jmp 0x180060828
mov rbx, qword [rsp + 0x38]
add rbx, qword [rsp + 0x20]
jmp 0x1800607d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x180060840
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x30
mov r9, rcx
test rcx, rcx
jne 0x18006085b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rax
mov eax, 0x5a4d
cmp word [r9], ax
je 0x180060878
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180060941
movsxd r10, dword [r9 + 0x3c]
add r10, r9
cmp dword [r10], 0x4550
je 0x18006089a
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180060941
movzx eax, word [r10 + 0x14]
test ax, ax
jne 0x1800608b6
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180060941
movzx eax, ax
lea r11, [rax + r10 + 0x18]
xor edx, edx
mov dword [rsp + 0x20], edx
movzx eax, word [r10 + 6]
cmp edx, eax
jae 0x180060925
lea rcx, [rdx + rdx*4]
lea r8, [r11 + rcx*8]
lea rdi, str.tdetour
mov rsi, r8
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
jne 0x180060921
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x180060925
cmp dword [r8 + 0x10], 0
je 0x180060925
lea rdi, [r9 + rax]
mov eax, dword [rdi]
cmp eax, 0x40
jb 0x180060925
cmp dword [rdi + 4], 0x727444
jne 0x180060925
cmp dword [rdi + 8], 0
jne 0x180060914
mov dword [rdi + 8], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
jmp 0x180060941
inc edx
jmp 0x1800608c0
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180060941
mov rsi, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180060da0
Capabilities:
Parse pe header

Disassembly:
push rbp
push r14
sub rsp, 0x28
xor ebp, ebp
mov r14, rcx
test rcx, rcx
je 0x180060ecc
xor ecx, ecx
mov qword [rsp + 0x58], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test rax, rax
je 0x180060ec7
mov eax, 0x5a4d
cmp word [r12], ax
jne 0x180060ec7
movsxd rax, dword [r12 + 0x3c]
add rax, r12
je 0x180060ec7
cmp dword [rax], 0x4550
jne 0x180060ec7
mov qword [rsp + 0x40], rbx
mov ebx, dword [rax + 0x90]
add rbx, r12
je 0x180060ec2
mov ecx, dword [rax + 0x94]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x20], r13
movabs rax, 0xcccccccccccccccd
mov esi, ebp
mul rcx
mov r13, rdx
shr r13, 4
test r13d, r13d
je 0x180060eb8
add rbx, 0xc
mov qword [rsp + 0x50], rdi
cmp dword [rbx - 0xc], ebp
jne 0x180060e4f
cmp dword [rbx + 4], ebp
je 0x180060eb3
mov edi, dword [rbx]
add rdi, r12
je 0x180060eb3
mov rdx, r14
mov rcx, rdi
call fcn.18003da0c
test eax, eax
je 0x180060eae
mov edx, 0x5c
mov rcx, rdi
call fcn.180029eb0
mov r11, rax
test rax, rax
je 0x180060ea1
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r11
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 1
jbe 0x180060ea1
lea rcx, [r11 + 1]
mov rdx, r14
call fcn.18003da0c
test eax, eax
je 0x180060eae
inc esi
add rbx, 0x14
cmp esi, r13d
jb 0x180060e45
jmp 0x180060eb3
mov ebp, 1
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x58]
mov eax, ebp
add rsp, 0x28
pop r14
pop rbp
ret
Function at 0x180062c50
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x390
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov rdi, rdx
mov r8, rdx
mov edx, 4
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov ebx, eax
test eax, eax
je 0x180062dbc
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x3c0], rsi
mov byte [rsp + 0x270], 0
call fcn.180029630
lea rdx, str._s
lea rcx, [rsp + 0x270]
mov r8, rbp
call fcn.18002971c
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x13c
mov dword [rsp + 0x20], 0
call fcn.180029630
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180062db2
lea rdx, [0x1800b08c8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x180062d8f
lea rdx, str.._C
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x180062d8f
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], 0
call fcn.180029630
lea r9, [rsp + 0x4c]
lea rdx, [0x1800a5a04]
lea rcx, [rsp + 0x160]
mov r8, rbp
call fcn.18002971c
test byte [rsp + 0x20], 0x10
lea rcx, [rsp + 0x160]
je 0x180062d7f
mov rdx, rdi
call fcn.180062c50
jmp 0x180062d8d
mov r8, rdi
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
mov ebx, eax
test ebx, ebx
je 0x180062da9
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180062d01
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x3c0]
mov eax, ebx
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.180029600
add rsp, 0x390
pop rdi
pop rbp
pop rbx
ret
Function at 0x180063c90
Capabilities:
Get user security identifier

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x40
xor ebx, ebx
lea rax, [rsp + 0x78]
mov rsi, rdx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rdx], rbx
mov rbp, rcx
mov rdx, rcx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], ebx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x180063cf0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x180063cf0
xor eax, eax
add rsp, 0x40
pop rsi
pop rbp
pop rbx
ret
mov ecx, dword [rsp + 0x70]
mov qword [rsp + 0x60], rdi
call fcn.180029d7c
mov ecx, dword [rsp + 0x68]
mov qword [rsi], rax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180029d7c
mov r8, qword [rsi]
mov rdi, rax
test r8, r8
je 0x180063d5b
test rax, rax
je 0x180063d6c
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x70]
mov rdx, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test rdi, rdi
je 0x180063d68
mov rcx, rdi
call fcn.180029a70
test ebx, ebx
jne 0x180063d79
mov rcx, qword [rsi]
test rcx, rcx
je 0x180063d79
call fcn.180029a70
mov eax, ebx
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
pop rbp
pop rbx
ret
Function at 0x180067dc0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
call fcn.180066c80
mov r11, qword [0x1800f0828]
mov rdx, rbx
mov rcx, rdi
test r11, r11
je 0x180067e0a
mov eax, dword [rsp + 0x60]
mov r9, rsi
mov r8, rbp
mov dword [rsp + 0x20], eax
call r11
jmp 0x180067e10
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800686b0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800f0cc4]
test ecx, ecx
jne 0x1800687cf
mov eax, dword [0x1800f0cc0]
cmp eax, 3
ja 0x1800687cf
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800f0cc0], eax
call fcn.18001c810
test eax, eax
je 0x1800686f6
lea rcx, str.Userenv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180068703
lea rcx, [0x1800b2180]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180068715
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.CreateEnvironmentBlock
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DestroyEnvironmentBlock
mov rcx, rbx
mov qword [0x1800f0c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ExpandEnvironmentStringsForUserA
mov rcx, rbx
mov qword [0x1800f0c90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ExpandEnvironmentStringsForUserW
mov rcx, rbx
mov qword [0x1800f0c98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LoadUserProfileA
mov rcx, rbx
mov qword [0x1800f0ca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.LoadUserProfileW
mov rcx, rbx
mov qword [0x1800f0ca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.UnloadUserProfile
mov rcx, rbx
mov qword [0x1800f0cb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov dword [0x1800f0cc4], 1
mov qword [0x1800f0cb8], rax
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1800687e0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1800f0d1c]
test ecx, ecx
jne 0x180068944
mov eax, dword [0x1800f0d18]
cmp eax, 3
ja 0x180068944
inc eax
mov qword [rsp + 0x20], rbx
mov dword [0x1800f0d18], eax
call fcn.18001c810
test eax, eax
je 0x180068826
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x180068833
lea rcx, [0x1800b22a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x180068845
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdx, str.EnumProcesses
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.EnumProcessModules
mov rcx, rbx
mov qword [0x1800f0cc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessMemoryInfo
mov rcx, rbx
mov qword [0x1800f0cd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExA
mov rcx, rbx
mov qword [0x1800f0cd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleFileNameExW
mov rcx, rbx
mov qword [0x1800f0ce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetModuleInformation
mov rcx, rbx
mov qword [0x1800f0ce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessImageFileNameA
mov rcx, rbx
mov qword [0x1800f0cf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessImageFileNameW
mov rcx, rbx
mov qword [0x1800f0cf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetMappedFileNameA
mov rcx, rbx
mov qword [0x1800f0d00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetMappedFileNameW
mov rcx, rbx
mov qword [0x1800f0d08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x20]
mov qword [0x1800f0d10], rax
mov dword [0x1800f0d1c], 1
mov eax, 1
add rsp, 0x28
ret
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1800689e0
Capabilities:
Get disk information

Disassembly:
push rbx
push rsi
sub rsp, 0x258
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
cmp eax, 1
jne 0x180068b45
test rbx, rbx
je 0x180068b45
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x280], rdi
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
cmp ecx, 2
jle 0x180068b3d
movzx eax, word [rbx + 2]
cmp ax, 0x3a
jne 0x180068a72
movabs rax, 0x5c003a0041
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
movzx eax, word [rbx]
mov word [rsp + 0x20], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
jmp 0x180068b3d
cmp word [rbx], 0x5c
jne 0x180068b3d
cmp ax, 0x5c
jne 0x180068b3d
mov qword [rsp + 0x278], rbp
mov qword [rsp + 0x250], r12
mov r12d, 0x5c
lea rcx, [rbx + 4]
mov edx, r12d
call fcn.18002a8ac
mov rbp, rax
test rax, rax
je 0x180068b2d
xor eax, eax
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], ax
call fcn.180029630
lea rcx, [rbp + 2]
mov edx, r12d
call fcn.18002a8ac
test rax, rax
je 0x180068afd
sub rax, rbx
sar rax, 1
lea ecx, [rax + 1]
cmp ecx, 0x104
jge 0x180068b2d
movsxd r8, ecx
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.180029944
jmp 0x180068b20
lea eax, [rdi + 1]
cmp eax, 0x104
jge 0x180068b2d
movsxd rdi, edi
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, rdi
call fcn.180029944
mov word [rsp + rdi*2 + 0x30], r12w
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esi, eax
mov rbp, qword [rsp + 0x278]
mov r12, qword [rsp + 0x250]
mov rdi, qword [rsp + 0x280]
mov eax, esi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180029600
add rsp, 0x258
pop rsi
pop rbx
ret

Function at 0x180068c20
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x48
xor eax, eax
mov dword [rdx], eax
test rcx, rcx
je 0x180068c4e
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov r9, rdx
mov qword [rsp + 0x28], rax
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add rsp, 0x48
ret

Function at 0x180068ec0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.1800138b0
test rbx, rbx
je 0x180068f51
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], 0
call fcn.180029630
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov ebx, eax
call fcn.180010070
mov eax, ebx
jmp 0x180068f53
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180029600
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rdi
ret
Function at 0x180068f80
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x48
xor eax, eax
mov dword [rdx], eax
test rcx, rcx
je 0x180068fae
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
add rsp, 0x48
ret

Function at 0x180068fe0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.1800138b0
xor esi, esi
test rbx, rbx
je 0x18006906d
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], sil
call fcn.180029630
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8d, 0x104
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov ebx, eax
call fcn.180010070
mov eax, ebx
jmp 0x18006906f
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180029600
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180069140
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x430
mov rax, qword [0x1800d7110]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.1800138b0
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x20], 0
call fcn.180029630
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
dec eax
cmp eax, 0x3fe
ja 0x1800691b5
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.180010070
mov eax, 1
jmp 0x1800691b7
xor eax, eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.180029600
mov rbx, qword [rsp + 0x450]
add rsp, 0x430
pop rdi
ret

Function at 0x1800692b0
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbp, rdx
mov rsi, rcx
or r8d, 0xffffffff
xor edx, edx
mov rcx, rbp
call fcn.180014f90
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsi], eax
mov edi, 1
xor ebx, ebx
nop dword [rax]
test dword [rsi], edi
je 0x180069340
movzx eax, word [0x1800b2360]
mov word [rsp + 0x50], ax
movzx eax, byte [0x1800b2362]
mov byte [rsp + 0x52], al
xor eax, eax
mov byte [rsp + 0x53], al
add byte [rsp + 0x50], bl
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.180013640
nop
lea r8, [rsp + 0x60]
mov edx, dword [rbp + 8]
mov rcx, rbp
call fcn.1800151e0
nop
lea rcx, [rsp + 0x60]
call fcn.18000fef0
inc ebx
add edi, edi
cmp ebx, 0x1a
jb 0x1800692f0
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret