joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000d1a0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp + 0x60], xmm4
movaps xmmword [rbp + 0x70], xmm4
mov qword [rbp + 0x80], rax
mov rax, qword [0x18018d300]
mov qword [rbp + 0x20], rax
mov rbx, rcx
test dword [rsp], esp
sub rsp, 0x100
lea rcx, [rsp + 0x20]
mov qword [rbp + 0x78], rcx
mov dword [rbp + 0x80], 0x80
xor ecx, ecx
mov dword [rbp + 0x70], ecx
mov rcx, qword gs:[0x58]
mov eax, dword [0x1801981cc]
mov edx, 0x10
add rdx, qword [rcx + rax*8]
mov rsi, qword [rdx]
test rsi, rsi
je 0x18000d328
mov qword [rbp + 0x28], rsi
jmp 0x18000d23f
mov edx, ebx
mov rbx, qword [rbp + 0xd0]
sub edx, dword [rbp + 0x70]
lea rcx, [rbp + 0x68]
call fcn.18002c550
mov rdi, qword [rbp + 0x78]
mov r14d, dword [rbp + 0x80]
mov qword [rbp + 0x60], rdi
test rbx, rbx
je 0x18000d260
mov qword [rbp + 0xd0], rbx
lea r15, [rbx + 0xc]
jmp 0x18000d26a
xor r15d, r15d
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0x58], r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r15
mov qword [rbp + 0x14], rcx
mov rdx, rdi
mov qword [rbp + 0xc], rdx
mov r8d, r14d
mov dword [rbp + 0x1c], r8d
lea rcx, [rbp + 0x30]
call fcn.1800a4870
mov rcx, qword [rbp + 0x14]
mov rdx, qword [rbp + 0xc]
mov r8d, dword [rbp + 0x1c]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.1800a48c0
call sub.KERNEL32.dll_GetLastError
xor edx, edx
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x60], rdx
mov rsi, qword [rbp + 0x28]
mov dword [rsi + 0x78], eax
mov edx, ebx
movsxd rcx, dword [rbp + 0x80]
cmp rdx, rcx
jle 0x18000d2eb
cmp ebx, dword [rbp + 0x80]
ja 0x18000d22a
mov rbx, qword [rbp + 0xd0]
jmp 0x18000d23f
test ebx, ebx
je 0x18000d33c
lea ecx, [rbx - 1]
mov dword [rbp + 0x70], ecx
lea rcx, [rbp + 0x68]
call fcn.18002c310
lea rcx, [0x18018d300]
mov rcx, qword [rcx]
cmp qword [rbp + 0x20], rcx
je 0x18000d313
call fcn.1800a23d0
nop
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x18003b3d0]
call rax
mov rsi, rax
jmp 0x18000d224
lea rcx, [0x1801998a8]
call fcn.180031020
mov rcx, rax
call fcn.1800a3120
int3
Function at 0x18000d540
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp + 0x60], xmm4
movaps xmmword [rbp + 0x70], xmm4
mov qword [rbp + 0x80], rax
mov rax, qword [0x18018d300]
mov qword [rbp + 0x20], rax
mov rbx, rcx
test dword [rsp], esp
sub rsp, 0x100
lea rcx, [rsp + 0x20]
mov qword [rbp + 0x78], rcx
mov dword [rbp + 0x80], 0x80
xor ecx, ecx
mov dword [rbp + 0x70], ecx
mov rcx, qword gs:[0x58]
mov eax, dword [0x1801981cc]
mov edx, 0x10
add rdx, qword [rcx + rax*8]
mov rsi, qword [rdx]
test rsi, rsi
je 0x18000d70c
mov qword [rbp + 0x28], rsi
jmp 0x18000d5df
mov edx, ebx
mov rbx, qword [rbp + 0xd0]
sub edx, dword [rbp + 0x70]
lea rcx, [rbp + 0x68]
call fcn.18002c550
mov rdi, qword [rbp + 0x78]
mov r14d, dword [rbp + 0x80]
mov qword [rbp + 0x60], rdi
test rbx, rbx
je 0x18000d600
mov qword [rbp + 0xd0], rbx
lea r15, [rbx + 0xc]
jmp 0x18000d60a
xor r15d, r15d
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0x58], r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r15
mov qword [rbp + 0x14], rcx
mov rdx, rdi
mov qword [rbp + 0xc], rdx
mov r8d, r14d
mov dword [rbp + 0x1c], r8d
lea rcx, [rbp + 0x30]
call fcn.1800a4870
mov rcx, qword [rbp + 0x14]
mov rdx, qword [rbp + 0xc]
mov r8d, dword [rbp + 0x1c]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.1800a48c0
call sub.KERNEL32.dll_GetLastError
xor edx, edx
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x60], rdx
mov rsi, qword [rbp + 0x28]
mov dword [rsi + 0x78], eax
mov edx, ebx
movsxd rcx, dword [rbp + 0x80]
cmp rdx, rcx
jle 0x18000d68b
cmp ebx, dword [rbp + 0x80]
ja 0x18000d5ca
mov rbx, qword [rbp + 0xd0]
jmp 0x18000d5df
test ebx, ebx
jne 0x18000d698
cmp dword [rsi + 0x78], 0xcb
je 0x18000d6a6
mov dword [rbp + 0x70], ebx
lea rcx, [rbp + 0x68]
call fcn.18002c310
jmp 0x18000d6e2
mov rbx, qword [rbp + 0x68]
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
test rbx, rbx
je 0x18000d6e0
lea rcx, [0x1801ae600]
cmp qword [rcx - 8], 0
jne 0x18000d720
mov rcx, qword [0x18018c5d8]
mov rcx, qword [rcx + 8]
mov rdx, rbx
xor r8d, r8d
cmp dword [rcx], ecx
call fcn.18007df60
xor eax, eax
lea rcx, [0x18018d300]
mov rcx, qword [rcx]
cmp qword [rbp + 0x20], rcx
je 0x18000d6f7
call fcn.1800a23d0
nop
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x18003b3d0]
call rax
mov rsi, rax
jmp 0x18000d5c4
call fcn.18009fd98
jmp 0x18000d6c8
Function at 0x18000e680
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x20]
xorps xmm4, xmm4
movaps xmmword [rbp + 0x10], xmm4
xor eax, eax
mov qword [rbp + 0x20], rax
mov rax, qword [0x18018d300]
mov qword [rbp + 8], rax
mov esi, ecx
mov ebx, edx
mov rdi, r8
mov r14d, dword [rdi + 8]
xor r15d, r15d
cmp r14d, 0x100
jb 0x18000e706
lea rcx, [0x1801ae600]
cmp qword [rcx - 8], 0
jne 0x18000e7fd
mov rcx, qword [0x18018c5d8]
mov rcx, qword [rcx + 8]
lea edx, [r14 + 1]
cmp dword [rcx], ecx
call fcn.18007dd00
mov r15, rax
test r15, r15
jne 0x18000e6fc
xor r13d, r13d
xor r12d, r12d
jmp 0x18000e704
lea r13, [r15 + 0x10]
mov r12d, dword [r15 + 8]
jmp 0x18000e71b
test dword [rsp], esp
sub rsp, 0x200
lea r13, [rsp + 0x20]
mov r12d, 0x100
mov qword [rbp + 0x10], r13
mov dword [rbp + 0x18], r12d
lea rdx, [rbp + 0x10]
mov rcx, rdi
call fcn.1800213b0
cmp r14d, r12d
jae 0x18000e80e
mov ecx, r14d
mov word [r13 + rcx*2], 0
xor ecx, ecx
test r12d, r12d
cmovne rcx, r13
mov qword [rbp + 0x20], rcx
cmp r14d, 2
jle 0x18000e787
add r14d, 0xfffffffc
mov edx, esi
rol edx, 5
add esi, edx
mov edx, dword [rcx]
or edx, 0x200020
xor esi, edx
mov edx, ebx
rol edx, 5
add ebx, edx
mov edx, dword [rcx + 4]
or edx, 0x200020
xor ebx, edx
add rcx, 8
cmp r14d, 2
jg 0x18000e756
test r14d, r14d
jle 0x18000e79d
mov edx, ebx
rol edx, 5
add edx, ebx
mov ebx, dword [rcx]
or ebx, 0x200020
xor ebx, edx
xor ecx, ecx
mov qword [rbp + 0x20], rcx
test r15, r15
je 0x18000e7ce
lea rcx, [0x1801ae600]
cmp qword [rcx - 8], 0
jne 0x18000e807
mov rcx, qword [0x18018c5d8]
mov rcx, qword [rcx + 8]
mov rdx, r15
xor r8d, r8d
cmp dword [rcx], ecx
call fcn.18007df60
imul eax, ebx, 0x5d588b65
add eax, esi
lea rcx, [0x18018d300]
mov rcx, qword [rcx]
cmp qword [rbp + 8], rcx
je 0x18000e7eb
call fcn.1800a23d0
nop
lea rsp, [rbp + 0x28]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.18009fd98
jmp 0x18000e6d6
call fcn.18009fd98
jmp 0x18000e7b6
call fcn.18003daa0
int3
Function at 0x180017240
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, dword [rbx + 0x1c]
mov edi, esi
and edi, 3
cmp esi, 4
jae 0x180017274
lea rbp, [0x1801ae3f8]
cmp qword [rbp - 8], 0
jne 0x180017301
mov eax, dword [rbp]
add eax, 0x165667b1
jmp 0x180017290
mov eax, dword [rbx]
rol eax, 1
mov ecx, dword [rbx + 4]
rol ecx, 7
add eax, ecx
mov ecx, dword [rbx + 8]
rol ecx, 0xc
add eax, ecx
mov ecx, dword [rbx + 0xc]
rol ecx, 0x12
add eax, ecx
lea eax, [rax + rsi*4]
test edi, edi
je 0x1800172d7
imul ecx, dword [rbx + 0x10], 0xc2b2ae3d
add eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp edi, 1
jbe 0x1800172d7
imul ecx, dword [rbx + 0x14], 0xc2b2ae3d
add ecx, eax
rol ecx, 0x11
imul eax, ecx, 0x27d4eb2f
cmp edi, 2
jbe 0x1800172d7
imul ecx, dword [rbx + 0x18], 0xc2b2ae3d
add ecx, eax
rol ecx, 0x11
imul eax, ecx, 0x27d4eb2f
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul eax, ecx, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae3d
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
call fcn.18009f8d0
jmp 0x18001726a
Function at 0x18001bee0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
mov rsi, rcx
mov rdi, r8
mov r8d, edx
mov ebx, r9d
test ebx, ebx
je 0x18001c0fd
lea ebp, [rbx - 1]
test ebp, ebp
je 0x18001c0a4
xor r14d, r14d
movzx r15d, word [rdi]
mov r13d, r8d
sub r13d, ebp
cmp r13d, 8
jl 0x18001c019
movsxd rcx, ebp
movzx ecx, word [rdi + rcx*2]
movsxd rbp, ebp
jmp 0x18001bf43
dec rbp
movzx ecx, word [rdi + rbp*2]
cmp ecx, r15d
jne 0x18001bf4e
cmp rbp, 1
jg 0x18001bf3c
movd xmm0, r15d
movaps xmm6, xmm0
punpcklwd xmm6, xmm0
pshufd xmm6, xmm6, 0
movd xmm0, ecx
movaps xmm7, xmm0
punpcklwd xmm7, xmm0
pshufd xmm7, xmm7, 0
movsxd r15, r13d
add r15, 0xfffffffffffffff8
jmp 0x18001bf7b
mov r14, r15
movups xmm0, xmmword [rsi + r14*2]
pcmpeqw xmm0, xmm6
lea rcx, [r14 + rbp]
movups xmm1, xmmword [rsi + rcx*2]
pcmpeqw xmm1, xmm7
pand xmm0, xmm1
xorps xmm1, xmm1
pcmpeqb xmm1, xmm0
pmovmskb ecx, xmm1
cmp ecx, 0xffff
je 0x18001bffa
pmovmskb r12d, xmm0
test r12d, r12d
je 0x18001bfb7
bsf ecx, r12d
jmp 0x18001bfbc
mov ecx, 0x20
shr ecx, 1
mov eax, ecx
mov qword [rsp + 0x28], rax
cmp ebx, 2
je 0x18001c014
lea rcx, [r14 + rax]
lea rcx, [rsi + rcx*2]
mov r8d, ebx
add r8, r8
mov rdx, rdi
call fcn.18001bac0
test eax, eax
mov rax, qword [rsp + 0x28]
jne 0x18001c014
lea ecx, [r12 - 1]
and ecx, r12d
lea r12d, [rcx - 1]
and r12d, ecx
jne 0x18001bfac
add r14, 8
movsxd rcx, r13d
cmp r14, rcx
je 0x18001c066
cmp r14, r15
jle 0x18001bf7b
jmp 0x18001bf78
add eax, r14d
jmp 0x18001c089
add rdi, 2
test r13d, r13d
jle 0x18001c066
lea rcx, [rsi + r14*2]
movsx rdx, r15w
mov r8d, r13d
call fcn.1800973c0
test eax, eax
jl 0x18001c066
sub r13d, eax
movsxd rcx, eax
add r14, rcx
test r13d, r13d
jle 0x18001c066
lea rcx, [rsi + r14*2 + 2]
mov r8d, ebp
add r8, r8
mov rdx, rdi
call fcn.18001bac0
test eax, eax
jne 0x18001c086
dec r13d
inc r14
test r13d, r13d
jg 0x18001c022
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, r14d
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
movsx rdx, word [rdi]
movzx ecx, dx
dec ecx
cmp ecx, 0xfe
jb 0x18001c0d7
mov rcx, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1800973c0
movsx rdx, dx
mov rcx, rsi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
jmp fcn.18009dda0
xor eax, eax
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180026340
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm7
movsd xmm6, qword [0x18013a480]
movaps xmm7, xmm6
call fcn.180026580
call fcn.180025540
test eax, eax
jl 0x18002652b
lea rbx, [0x1801ae518]
cmp qword [rbx - 8], 0
jne 0x18002654c
movabs rdx, 0x431bde82d7b634db
mov rax, rdx
imul qword [rbx]
mov rcx, rdx
shr rcx, 0x3f
sar rdx, 0x12
lea rsi, [rdx + rcx + 1]
mov ebx, 0xa
mov edi, 8
add edi, edi
lea rcx, [rsp + 0x38]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rbp, qword [rsp + 0x38]
cmp dword [0x180191e60], 0
jne 0x180026556
test edi, edi
jle 0x1800263dc
mov r14d, edi
call fcn.180025540
dec r14d
jne 0x1800263d2
lea rcx, [rsp + 0x30]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rcx, qword [rsp + 0x30]
sub rcx, rbp
mov rbp, rcx
cmp dword [0x180191e60], 0
jne 0x180026560
cmp rbp, rsi
jl 0x1800263ad
xorps xmm0, xmm0
cvtsi2sd xmm0, rbp
xorps xmm1, xmm1
cvtsi2sd xmm1, edi
divsd xmm0, xmm1
ucomisd xmm7, xmm0
jp 0x18002641e
je 0x18002642c
ucomisd xmm7, xmm7
jp 0x180026436
ucomisd xmm0, xmm7
ja 0x180026436
jmp 0x180026439
movq rcx, xmm7
test rcx, rcx
jge 0x18002642a
movaps xmm0, xmm7
movaps xmm7, xmm0
mov ecx, edi
sar ecx, 0x1f
and ecx, 3
add ecx, edi
mov edi, ecx
sar edi, 2
add edi, edi
lea rcx, [rsp + 0x28]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rbp, qword [rsp + 0x28]
cmp dword [0x180191e60], 0
jne 0x18002656a
test edi, edi
jle 0x18002647a
mov r14d, edi
call fcn.180026580
dec r14d
jne 0x180026470
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rax, qword [rsp + 0x20]
sub rax, rbp
mov rbp, rax
cmp dword [0x180191e60], 0
jne 0x180026574
cmp rbp, rsi
jl 0x18002644b
xorps xmm0, xmm0
cvtsi2sd xmm0, rbp
xorps xmm1, xmm1
cvtsi2sd xmm1, edi
divsd xmm0, xmm1
ucomisd xmm6, xmm0
jp 0x1800264bc
je 0x1800264ca
ucomisd xmm6, xmm6
jp 0x1800264d4
ucomisd xmm0, xmm6
ja 0x1800264d4
jmp 0x1800264d7
movq rax, xmm6
test rax, rax
jge 0x1800264c8
movaps xmm0, xmm6
movaps xmm6, xmm0
dec ebx
jne 0x1800263a8
movaps xmm0, xmm7
mulsd xmm0, qword [0x18013a488]
divsd xmm0, xmm6
call fcn.1800a3870
mov ecx, 0x1388
cmp eax, 0x1388
cmovg eax, ecx
mov dword [0x18018d490], eax
cmp dword [0x18018d490], 5
setle al
movzx eax, al
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
ret
mov dword [0x18018d490], 0xffff
xor eax, eax
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
ret
call fcn.18009f961
jmp 0x180026383
call fcn.1800a39c0
jmp 0x1800263cb
call fcn.1800a39c0
jmp 0x1800263fe
call fcn.1800a39c0
jmp 0x180026469
call fcn.1800a39c0
jmp 0x18002649c
Function at 0x18003db70
Capabilities:
Copy file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], rax
mov rbx, r8
mov rsi, r9
mov rdi, qword [rbp + 0x30]
mov qword [rbp - 0x40], rdi
test rdx, rdx
jne 0x18003dbad
xor r14d, r14d
jmp 0x18003dbb1
lea r14, [rdx + 0xc]
mov qword [rbp - 0x48], r14
test rcx, rcx
jne 0x18003dbbf
xor r15d, r15d
jmp 0x18003dbc3
lea r15, [rcx + 0xc]
mov qword [rbp - 0x50], r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov qword [rsp + 0x20], rdi
mov edi, dword [rbp + 0x38]
mov dword [rsp + 0x28], edi
mov rcx, r15
mov qword [rbp - 0x80], rcx
mov rdx, r14
mov qword [rbp - 0x88], rdx
mov r8, rbx
mov qword [rbp - 0x90], r8
mov r9, rsi
mov qword [rbp - 0x98], r9
lea rcx, [rbp - 0x78]
call fcn.1800a4870
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x88]
mov r8, qword [rbp - 0x90]
mov r9, qword [rbp - 0x98]
call sub.KERNEL32.dll_CopyFileExW
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.1800a48c0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1801981cc]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x18003dc85
mov dword [rdi + 0x78], esi
test ebx, ebx
setne al
movzx eax, al
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x18003b3d0]
call rax
mov rdi, rax
jmp 0x18003dc66

Function at 0x18003e180
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
jne 0x18003e1a7
xor ebx, ebx
jmp 0x18003e1ab
lea rbx, [rcx + 0xc]
mov qword [rbp - 0x40], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rbx
mov qword [rbp - 0x70], rcx
lea rcx, [rbp - 0x68]
call fcn.1800a4870
mov rcx, qword [rbp - 0x70]
call sub.KERNEL32.dll_DeleteFileW
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.1800a48c0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1801981cc]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x18003e223
mov dword [rdi + 0x78], esi
test ebx, ebx
setne al
movzx eax, al
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x18003b3d0]
call rax
mov rdi, rax
jmp 0x18003e207
Function at 0x18003ece0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rdx
mov esi, r8d
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.180039220
mov rcx, qword [rbp - 0x48]
mov r14, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, r14
mov qword [rbp - 0x7c], rcx
mov rdx, rbx
mov qword [rbp - 0x84], rdx
mov r8d, esi
mov dword [rbp - 0x74], r8d
mov r9, rdi
mov qword [rbp - 0x8c], r9
lea rcx, [rbp - 0x70]
call fcn.1800a4870
mov rcx, qword [rbp - 0x7c]
mov rdx, qword [rbp - 0x84]
mov r8d, dword [rbp - 0x74]
mov r9, qword [rbp - 0x8c]
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.1800a48c0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
cmp byte [rbp - 0x40], 0
je 0x18003eda3
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.180039260
mov rax, qword gs:[0x58]
mov ecx, dword [0x1801981cc]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x18003eddc
mov dword [rdi + 0x78], esi
mov eax, ebx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x18003b3d0]
call rax
mov rdi, rax
jmp 0x18003edc3

Function at 0x18003ee30
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rdx
mov edi, r8d
mov rbx, r9
xor edx, edx
mov dword [rbx], edx
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.180039220
nop
mov qword [rbp - 0x50], rbx
mov rcx, qword [rbp - 0x48]
mov r14, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, r14
mov qword [rbp - 0x84], rcx
mov rdx, rsi
mov qword [rbp - 0x8c], rdx
mov r8d, edi
mov dword [rbp - 0x7c], r8d
mov r9, rbx
mov qword [rbp - 0x94], r9
lea rcx, [rbp - 0x78]
call fcn.1800a4870
mov rcx, qword [rbp - 0x84]
mov rdx, qword [rbp - 0x8c]
mov r8d, dword [rbp - 0x7c]
mov r9, qword [rbp - 0x94]
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.1800a48c0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x18003ef0f
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.180039260
mov rax, qword gs:[0x58]
mov ecx, dword [0x1801981cc]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x18003ef48
mov dword [rdi + 0x78], esi
mov eax, ebx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x18003b3d0]
call rax
mov rdi, rax
jmp 0x18003ef2f
Function at 0x18003f4c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
xor ecx, ecx
mov dword [r9], ecx
mov qword [rbp - 0x40], r9
mov r14, r9
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x74], rcx
mov rdx, rsi
mov qword [rbp - 0x7c], rdx
mov r8d, edi
mov dword [rbp - 0x6c], r8d
mov r9, r14
mov qword [rbp - 0x84], r9
lea rcx, [rbp - 0x68]
call fcn.1800a4870
mov rcx, qword [rbp - 0x74]
mov rdx, qword [rbp - 0x7c]
mov r8d, dword [rbp - 0x6c]
mov r9, qword [rbp - 0x84]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.1800a48c0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1801981cc]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x18003f589
mov dword [rdi + 0x78], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x18003b3d0]
call rax
mov rdi, rax
jmp 0x18003f573

Function at 0x18003f890
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov ebx, r8d
mov qword [rbp - 0x40], rdx
mov rsi, rdx
test rcx, rcx
jne 0x18003f8c1
xor edi, edi
jmp 0x18003f8c5
lea rdi, [rcx + 0xc]
mov qword [rbp - 0x48], rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x7c], rcx
mov rdx, rsi
mov qword [rbp - 0x84], rdx
mov r8d, ebx
mov dword [rbp - 0x74], r8d
lea rcx, [rbp - 0x70]
call fcn.1800a4870
mov rcx, qword [rbp - 0x7c]
mov rdx, qword [rbp - 0x84]
mov r8d, dword [rbp - 0x74]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.1800a48c0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1801981cc]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x18003f957
mov dword [rdi + 0x78], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x18003b3d0]
call rax
mov rdi, rax
jmp 0x18003f941