joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b5bcc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14009aa6c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400b5c56
cmp byte [rbp - 0x21], r15b
je 0x1400b5c51
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400b5c8c
call fcn.1400a77f8
test eax, eax
jne 0x1400b5c78
cmp byte [rbp - 0x21], r15b
je 0x1400b5c70
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400b5c8c
cmp byte [rbp - 0x21], r15b
je 0x1400b5c89
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400a18e4
test eax, eax
jne 0x1400b5d2c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14009aa6c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400b5ccb
cmp byte [rbp - 0x21], r15b
je 0x1400b5d00
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400b5d00
call fcn.1400a77f8
test eax, eax
jne 0x1400b5cec
cmp byte [rbp - 0x21], r15b
je 0x1400b5ce5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400b5d00
cmp byte [rbp - 0x21], r15b
je 0x1400b5cfd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400a18e4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400b5d2c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400b5d2f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400b5d3d
mov rcx, rdi
call fcn.1400a51b0
cmp byte [rbp + 0x3f], r15b
je 0x1400b5d4c
mov rcx, qword [rbp + 0x27]
call fcn.1400a51b0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400b6aac
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400a82e4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400a82e4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400b6bfc
cmp rax, 0xffffffffffffffff
je 0x1400b6bfc
xor edi, edi
test rbp, rbp
jle 0x1400b6ba7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400a5138
mov rbx, rax
test rax, rax
jne 0x1400b6b34
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400b6b9d
mov edx, 0x8000
mov ecx, r14d
call fcn.1400a2f78
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400a9860
cmp eax, 0xffffffff
je 0x1400b6b7d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400b6b44
mov edx, r15d
mov ecx, r14d
call fcn.1400a2f78
jmp 0x1400b6b9d
cmp byte [rsi + 0x38], dil
je 0x1400b6b94
cmp dword [rsi + 0x34], 5
jne 0x1400b6b94
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400b6b9d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400a51b0
jmp 0x1400b6c10
jns 0x1400b6c10
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400a82e4
cmp rax, 0xffffffffffffffff
jne 0x1400b6bc8
cmp byte [rsi + 0x30], dil
je 0x1400b6c10
mov edi, dword [rsi + 0x2c]
jmp 0x1400b6c10
mov ecx, r14d
call fcn.1400af570
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400b6c10
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400b6c10
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400b6c09
mov eax, dword [rsi + 0x2c]
jmp 0x1400b6c0e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400a82e4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400b7a60
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400b7a88
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400b7a88
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1422d10
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1422d1d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1422d2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1422d15
lea eax, [rcx + 1]
jmp 0x1422d3b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1422d4e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1422d34
sub eax, 3
jb 0x1422d6e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1422dbd
sar eax, 1
movsxd rbp, eax
jb 0x1422da4
jmp 0x1422d7c
add ebx, ebx
jne 0x1422d7a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1422da4
inc ecx
add ebx, ebx
jne 0x1422d8a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1422da4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1422d9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1422d8c
add ecx, 2
jmp 0x1422da9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.01422cd2
jmp 0x1422d1d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x100e000]
mov eax, dword [rdi]
or eax, eax
je 0x1422e19
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1022000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1422dc9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1422e13
mov qword [rbx], rax
add rbx, 8
jmp 0x1422de9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1422e5d
cmp al, 0xef
ja 0x1422e45
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1422e25
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1422e34
mov eax, dword [rdi]
add rdi, 4
jmp 0x1422e34
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1422eb1
sub rsp, 0xffffffffffffff80
jmp 0x45bb20
Function at 0x1800018f4
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xae8
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rax, qword [rsp + 0xb30]
mov rdi, rcx
mov rcx, qword [rsp + 0xb38]
mov qword [rsp + 0x48], rcx
xor ecx, ecx
mov qword [rsp + 0x38], r9
mov rbp, r8
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x40], rax
cmp rdi, rcx
je 0x180001b10
cmp r8, rcx
jne 0x180001954
cmp rax, rcx
je 0x180001b10
cmp word [rdi + 2], 0x3a
je 0x1800019ab
cmp word [rdi + 2], 0x5c
je 0x1800019ab
mov word [rsp + 0x6c0], cx
lea rcx, [rsp + 0x6c2]
xor edx, edx
mov r8d, 0x40e
call fcn.180059f80
lea rdx, [rsp + 0x6c0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x6c0]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdi, [rsp + 0x6c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180001b10
test al, 0x10
je 0x180001b10
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x180081a9c]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180001b10
mov ebx, 1
lea rdx, [0x180081aa0]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180001ae7
lea rdx, [0x180081aa4]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180001ae7
cmp dword [rsp + 0x50], 0xffffffff
je 0x180001ae7
lea rcx, [rsp + 0x2a0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [rsp + 0x50], 0x10
je 0x180001acf
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180001a9c
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x2a0]
call rax
test eax, eax
je 0x180001afe
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x180001ae7
mov rdx, qword [rsp + 0x48]
mov r9, qword [rsp + 0x38]
mov r8, rbp
mov qword [rsp + 0x28], rdx
mov edx, ecx
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
call fcn.1800018f4
cmp eax, 2
jmp 0x180001ae5
test rbp, rbp
je 0x180001ae7
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x2a0]
call rbp
test eax, eax
je 0x180001afe
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x180001b03
jmp 0x180001a10
mov ebx, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x180001b12
xor eax, eax
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.180059930
add rsp, 0xae8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180001b30
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0x740
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x730], rax
mov rbp, rdx
mov rbx, rcx
mov qword [r11 - 0x6c8], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
lea rcx, [rsp + 0x50]
call fcn.180006600
nop
cmp rbp, r12
jne 0x180001bbb
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180006664
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x50]
call fcn.18000800c
nop
mov rcx, qword [rsp + 0x50]
call fcn.1800018ec
mov rax, rbx
jmp 0x180001d2e
mov rdx, rbp
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..________.dirty
lea rcx, [rsp + 0x520]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180001d01
lea rdx, [0x180081aa0]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x180001cde
lea rdx, [0x180081aa4]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x180001cde
cmp dword [rsp + 0xc0], 0xffffffff
je 0x180001cde
mov rdx, rbp
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xec]
lea rcx, [rsp + 0x310]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x310]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x28]
call fcn.1800076b4
nop
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.1800066e4
nop
cmp qword [rsp + 0x48], 8
jb 0x180001cde
mov rcx, qword [rsp + 0x30]
call fcn.1800018ec
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r12d
jne 0x180001c04
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180006664
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x50]
call fcn.18000800c
nop
mov rcx, qword [rsp + 0x50]
call fcn.1800018ec
mov rax, rbx
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.180059930
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180001dd8
Capabilities:
Check if file exists
Clear file content
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor esi, esi
mov rdi, rdx
mov rbx, rcx
cmp rcx, rsi
je 0x180001f21
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x180001f21
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], si
call fcn.180059f80
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180002fe8
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180001e5f
shr eax, 4
not eax
and eax, 1
jmp 0x180001f23
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x250]
call fcn.180001f48
cmp eax, esi
je 0x180001f21
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rdi, rsi
je 0x180001eee
cmp rax, rsi
je 0x180001efe
cmp rax, 0xffffffffffffffff
je 0x180001eee
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp rbx, rsi
je 0x180001efe
mov ecx, 1
cmp rbx, 0xffffffffffffffff
jne 0x180001f00
mov ecx, esi
cmp cl, sil
mov edi, esi
setne dil
cmp rbx, 0xffffffffffffffff
je 0x180001f1d
cmp rbx, rsi
je 0x180001f1d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180001f23
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180059930
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180002698
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor esi, esi
mov dil, dl
mov rbx, rcx
cmp rcx, rsi
je 0x180002723
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], si
call fcn.180059f80
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
je 0x180002723
lea rcx, [rsp + 0x20]
mov r9, rbx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, esi
jbe 0x180002723
cmp dil, sil
je 0x18000271c
xor edx, edx
mov rcx, rbx
call fcn.180001dd8
jmp 0x180002725
mov eax, 1
jmp 0x180002725
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180059930
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18000274c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2070
call fcn.18006de30
sub rsp, rax
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor esi, esi
mov rbx, rdx
mov rdi, rcx
cmp rcx, rsi
je 0x180002919
cmp rdx, rsi
je 0x180002919
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
jne 0x1800027a4
mov esi, 1
jmp 0x180002919
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov rdi, rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rdi, rsi
je 0x1800028f1
cmp rdi, 0xffffffffffffffff
je 0x1800028f1
cmp rax, rsi
je 0x1800028f1
cmp rax, 0xffffffffffffffff
je 0x180002905
xor eax, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
je 0x18000285c
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
je 0x18000285c
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x50], rax
je 0x18000286a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180002910
mov dword [rsp + 0x40], esi
jmp 0x1800028c0
mov r8d, dword [rsp + 0x40]
cmp r8d, esi
je 0x1800028e7
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x1060]
mov rcx, rbx
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
je 0x18000285c
mov eax, dword [rsp + 0x40]
cmp eax, dword [rsp + 0x44]
jne 0x18000285c
lea rdx, [rsp + 0x1060]
lea rcx, [rsp + 0x60]
mov r8, rax
call fcn.18005a1f0
cmp eax, esi
jne 0x18000285c
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
jne 0x180002870
jmp 0x18000285c
mov esi, 1
jmp 0x18000285c
cmp rax, 0xffffffffffffffff
je 0x180002905
cmp rax, rsi
je 0x180002905
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 0xffffffffffffffff
je 0x180002919
cmp rdi, rsi
je 0x180002919
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.180059930
lea r11, [rsp + 0x2070]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180002940
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180002963
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18000297e
test al, 1
je 0x180002975
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rsp, 0x20
pop rbx
ret
Function at 0x180002984
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
cmp rcx, rbx
je 0x1800029e3
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
je 0x1800029e3
lea rax, [0x180002a04]
lea r8, [0x1800029f0]
lea edx, [rbx + 1]
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.1800018f4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
sete bl
mov eax, ebx
jmp 0x1800029e5
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180002b0c
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov ebp, r8d
mov r12, rdx
mov rdi, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
test eax, eax
jne 0x180002b45
xor edx, edx
mov rcx, rdi
call fcn.180001dd8
test eax, eax
je 0x180002bf1
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x180002bd0
cmp rax, 0xffffffffffffffff
je 0x180002bd0
and dword [rsp + 0x78], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebp
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180002bb3
cmp dword [rsp + 0x78], ebp
jne 0x180002bb3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180002bf3
test esi, esi
jne 0x180002bdd
mov rcx, rbx
or rbx, 0xffffffffffffffff
cmp rcx, rbx
je 0x180002bd4
test rcx, rcx
je 0x180002bd4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180002bd4
test esi, esi
jne 0x180002bdd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp rbx, 0xffffffffffffffff
je 0x180002bf1
test rbx, rbx
je 0x180002bf1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret

Function at 0x180002c08
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor r9d, r9d
movsxd r10, edx
cmp r10, r9
jle 0x180002c3b
movzx edx, byte [r9 + rcx]
movzx eax, r8b
lea r11, [0x1800a39e0]
xor rdx, rax
mov eax, r8d
inc r9
mov r8d, dword [r11 + rdx*4]
shr eax, 8
xor r8d, eax
cmp r9, r10
jl 0x180002c13
not r8d
mov eax, r8d
ret
Function at 0x1800030d8
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movsx r8d, cl
lea rdx, str.__c:
lea rcx, [rsp + 0x48]
call fcn.180005538
cmp qword [rax + 0x20], 0x10
jb 0x180003119
mov rcx, qword [rax + 8]
jmp 0x18000311d
lea rcx, [rax + 8]
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp qword [rsp + 0x68], 0x10
mov rbx, rax
jb 0x180003156
mov rcx, qword [rsp + 0x50]
call fcn.1800018ec
and qword [rsp + 0x60], 0
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x68], sendto
mov byte [rsp + 0x50], 0
test rbx, rbx
je 0x1800031fa
cmp rbx, rdi
je 0x18000320d
lea r8d, [rdi + 0x25]
lea rcx, [rsp + 0x84]
xor edx, edx
mov dword [rsp + 0x80], 0x28
call fcn.180059f80
and dword [rsp + 0x70], 0
and dword [rsp + 0x74], 0
xor eax, eax
lea r9d, [rdi + 0xd]
and qword [rsp + 0x38], rax
and dword [rsp + 0x40], eax
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov edx, 0x2d1400
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov rcx, rbx
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180003204
mov edi, dword [rsp + 0x9c]
jmp 0x180003204
cmp rbx, rdi
je 0x18000320d
test rbx, rbx
je 0x18000320d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.180059930
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret

Function at 0x180003230
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1800a1628]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor r12d, r12d
mov rsi, rdx
mov rdi, rcx
cmp rdx, r12
je 0x180003312
lea rdx, str.deviceMup_
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, rdi
jne 0x18000329b
lea r8, [0x180081b6c]
lea rdx, str.deviceMup_
mov r9, rsi
mov rcx, rdi
call fcn.180005248
mov eax, 1
jmp 0x180003314
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, r12d
mov ebp, eax
bt ebp, ebx
jae 0x18000330b
lea ecx, [rbx + 0x61]
mov eax, 0x3a
xor edx, edx
mov word [rsp + 0x20], cx
mov word [rsp + 0x22], ax
xor eax, eax
lea rcx, [rsp + 0x32]
mov r8d, 0x206
mov word [rsp + 0x30], r12w
mov dword [rsp + 0x24], eax
call fcn.180059f80
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, r12d
jbe 0x18000330b
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rcx, rdi
call fcn.180005374
cmp eax, r12d
jne 0x18000333c
inc ebx
cmp ebx, 0x1a
jl 0x1800032a6
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180059930
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
jmp 0x180003289