joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009b20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
mov eax, 0x2040
call fcn.1400140f0
sub rsp, rax
mov rax, qword [0x140029568]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov rbx, rdx
mov r14, rcx
add rdx, 0x18
call fcn.140009370
mov edx, dword [rbx]
xor r8d, r8d
mov rcx, qword [r14]
mov rsi, rax
mov rdi, qword [rbx + 8]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
test eax, eax
jne 0x140009c1d
mov r9, qword [r14]
lea rcx, [rsp + 0x30]
mov ebx, 0x2000
mov edx, 1
cmp rdi, rbx
cmovle rbx, rdi
mov r8, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, rbx
jne 0x140009beb
mov r9, rsi
lea rcx, [rsp + 0x30]
mov r8, rbx
mov edx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
cmp rax, rbx
jne 0x140009c4f
sub rdi, rbx
test rdi, rdi
jg 0x140009b73
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.140014070
mov rbx, qword [rsp + 0x2070]
add rsp, 0x2040
pop r14
pop rdi
pop rsi
ret
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c460
lea rcx, str.I_O_failure_reading_contents_of_the_bundle.
call fcn.14000c460
lea rdx, [0x140026fa0]
mov dword [rsp + 0x20], 0x800080a0
lea rcx, [rsp + 0x20]
call fcn.140014fac
int3
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c460
lea rcx, str.I_O_seek_failure_within_the_bundle.
call fcn.14000c460
lea rdx, [0x140026fa0]
mov dword [rsp + 0x20], 0x800080a0
lea rcx, [rsp + 0x20]
call fcn.140014fac
int3
lea rcx, str.Failure_extracting_contents_of_the_application_bundle.
call fcn.14000c460
lea rcx, str.I_O_failure_when_writing_extracted_files.
call fcn.14000c460
lea rdx, [0x140026fa0]
mov dword [rsp + 0x20], 0x800080a0
lea rcx, [rsp + 0x20]
call fcn.140014fac
int3
Function at 0x140009c90
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cl
test cl, cl
js 0x140009ca3
movsx rax, cl
jmp 0x140009cde
mov r9, rdx
mov byte [rsp + 0x30], 0
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, edx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, 1
jne 0x140009cf1
movzx eax, byte [rsp + 0x30]
test al, al
js 0x140009d23
movsx eax, al
shl eax, 7
movsx rcx, bl
cdqe
and ecx, 0x7f
or rax, rcx
lea rcx, [rax - 1]
cmp rcx, 0x103
ja 0x140009d55
add rsp, 0x20
pop rbx
ret
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c460
lea rcx, str.I_O_failure_reading_contents_of_the_bundle.
call fcn.14000c460
lea rdx, [0x140026fa0]
mov dword [rsp + 0x40], 0x800080a0
lea rcx, [rsp + 0x40]
call fcn.140014fac
int3
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c460
lea rcx, str.Path_length_encoding_read_beyond_two_bytes
call fcn.14000c460
lea rdx, [0x140026fa0]
mov dword [rsp + 0x40], 0x8000809f
lea rcx, [rsp + 0x40]
call fcn.140014fac
int3
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c460
lea rcx, str.Path_length_is_zero_or_too_long
call fcn.14000c460
lea rdx, [0x140026fa0]
mov dword [rsp + 0x30], 0x8000809f
lea rcx, [rsp + 0x30]
call fcn.140014fac
int3

Function at 0x140009df0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, r8
mov rbx, rdx
mov r8, rdx
mov edx, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, rbx
jne 0x140009e14
add rsp, 0x20
pop rbx
ret
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c460
lea rcx, str.I_O_failure_reading_contents_of_the_bundle.
call fcn.14000c460
lea rdx, [0x140026fa0]
mov dword [rsp + 0x38], 0x800080a0
lea rcx, [rsp + 0x38]
call fcn.140014fac
int3

Function at 0x140009e50
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
lea rcx, [rdx + 1]
call fcn.1400140cc
mov rbx, rax
mov qword [rsp + 0x68], rax
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, rsi
jne 0x140009ec2
mov byte [rbx + rsi], 0
mov rdx, rbp
mov rcx, rbx
call fcn.14000e950
nop
test rbx, rbx
je 0x140009eb5
mov rcx, rbx
call fcn.140013f50
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.Failure_processing_application_bundle__possible_file_corruption.
call fcn.14000c460
lea rcx, str.I_O_failure_reading_contents_of_the_bundle.
call fcn.14000c460
mov dword [rsp + 0x58], 0x800080a0
lea rdx, [0x140026fa0]
lea rcx, [rsp + 0x58]
call fcn.140014fac
int3
Function at 0x14000a2d0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, r8
mov qword [rsp + 0x30], rsi
mov rbx, rdx
mov rdi, rcx
xor ebp, ebp
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x14000a302
mov rdx, qword [rbx]
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x14000a30f
mov rcx, qword [rdi]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__wrename
test eax, eax
je 0x14000a377
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov rcx, rbx
mov esi, dword [rax]
call fcn.14000e980
test al, al
jne 0x14000a36f
cmp esi, 0xd
jne 0x14000a36b
cmp qword [rbx + 0x18], 8
mov r8, rbx
jb 0x14000a33d
mov r8, qword [rbx]
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x14000a34a
mov rdx, qword [rdi]
lea rcx, str.Retrying_Rename___s__to___s__due_to_EACCES_error
call fcn.14000c6b0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0x1f4
jl 0x14000a2f5
xor al, al
jmp 0x14000a379
mov byte [r14], 1
xor al, al
jmp 0x14000a379
mov al, 1
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000bf30
Capabilities:
Access the windows event log

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140029568]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov rsi, rcx
lea rdx, str..NET_Runtime
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbp, rax
movdqa xmm0, xmmword [0x14001a1f0]
movdqu xmmword [rsp + 0x70], xmm0
xor r14d, r14d
mov word [rsp + 0x60], r14w
lea r8d, [r14 + 0x2d]
lea rdx, str.Description:_A_.NET_Core_application_failed._n
lea rcx, [rsp + 0x60]
call fcn.14000ae00
lea r8d, [r14 + 0xd]
lea rdx, str.Application:
lea rcx, [rsp + 0x60]
call fcn.14000ae00
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rdi + r8*2], 0
jne 0x14000bfc3
mov rdx, rdi
mov rcx, rax
call fcn.14000ae00
mov edi, 1
mov r8d, edi
lea rdx, [0x14001af38]
mov rcx, rax
call fcn.14000ae00
lea r8d, [rdi + 5]
lea rdx, str.Path:
lea rcx, [rsp + 0x60]
call fcn.14000ae00
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14000c005
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.14000ae00
mov r8, rdi
lea rdx, [0x14001af38]
mov rcx, rax
call fcn.14000ae00
mov r8d, 9
lea rdx, str.Message:
lea rcx, [rsp + 0x60]
call fcn.14000ae00
lea rdx, [0x140029028]
cmp qword [0x140029040], 8
cmovae rdx, qword [0x140029028]
mov r8, qword [0x140029038]
mov rcx, rax
call fcn.14000ae00
mov r8, rdi
lea rdx, [0x14001af38]
mov rcx, rax
call fcn.14000ae00
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r14d
mov word [rsp + 0x28], di
mov qword [rsp + 0x20], r14
mov r9d, 0x3ff
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14000c10e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c109
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c136
call fcn.140013f50
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140014070
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
int3
Function at 0x14000c460
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
lea rbp, [0x140029d20]
mov qword [rsp + 0x40], rbp
mov rcx, rbp
call sub.KERNEL32.dll_EnterCriticalSection
nop
lea r15, [rsp + 0xa8]
call fcn.1400088d0
mov r14, rax
mov rcx, qword [rax]
or rcx, 1
mov qword [rsp + 0x28], r15
xor edi, edi
mov qword [rsp + 0x20], rdi
mov r9, qword [rsp + 0xa0]
xor r8d, r8d
xor edx, edx
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf
mov ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
inc eax
movsxd rbx, eax
lea r8, [rsp + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14000c140
nop
mov rcx, qword [r14]
or rcx, 1
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
mov r9, qword [rsp + 0xa0]
mov r8, rbx
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf
mov ecx, dword [0x14002a2b8]
mov rax, qword gs:[0x58]
mov edx, 8
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov rax, qword [rsi]
test rax, rax
jne 0x14000c569
lea ecx, [rdi + 2]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rax
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputws
lea ecx, [rdi + 2]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdx, rax
lea ecx, [rdi + 0xa]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputwc
jmp 0x14000c572
mov rcx, rbx
call qword [0x140019470]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x140029d50], 0
je 0x14000c5c9
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rdi, qword [0x140029d48]
cmp rdi, rax
jne 0x14000c5a0
cmp qword [rsi], 0
je 0x14000c5c9
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, qword [rsp + 0xa0]
mov rdx, rdi
mov rcx, qword [r14]
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfwprintf
mov ecx, 0xa
mov rdx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputwc
nop
test rbx, rbx
je 0x14000c607
mov rax, qword [rsp + 0x58]
sub rax, rbx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000c5fe
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c61d
mov rcx, rbx
call fcn.140013f50
nop
mov rcx, rbp
call sub.KERNEL32.dll_LeaveCriticalSection
nop
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn
nop
int3

Function at 0x14000e0a0
Capabilities:
Query environment variable

Disassembly:
movzx eax, byte [str.d38cc827_e34f_4453_9df4_1e796e9f1d07]
cmp al, 0x65
je 0x14000e0ae
xor al, al
ret
jmp fcn.14000fab0
Function at 0x14000ed00
Capabilities:
Create directory
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140029568]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14000edbb
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14000ed42
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400056f0
xor edx, edx
mov rcx, rbx
call fcn.140010560
test al, al
je 0x14000edbb
lea rdx, str..net
mov rcx, rbx
call fcn.14000cd10
xor edx, edx
mov rcx, rbx
call fcn.140010560
test al, al
je 0x14000ed89
mov al, 1
jmp 0x14000edbd
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14000ed96
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000edaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000edbb
xor edx, edx
mov rcx, rbx
call fcn.140010560
jmp 0x14000edbd
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140014070
add rsp, 0x240
pop rbx
ret
Function at 0x14000fab0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, rcx
mov rsi, rdx
xor ecx, ecx
mov rax, rdx
cmp qword [rdx + 0x18], 8
mov qword [rdx + 0x10], rcx
jb 0x14000fad9
mov rax, qword [rdx]
mov word [rax], cx
xor r8d, r8d
mov rcx, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x14000fb35
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x14000fb22
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14000fb10
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
mov rdx, rbp
call fcn.14000c460
xor al, al
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbx
mov eax, 2
mul r14
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x38], rdi
cmovo rax, rbx
mov rcx, rax
call fcn.1400140cc
mov r8d, r14d
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x14000fba0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14000fb82
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
mov rdx, rbp
call fcn.14000c460
xor al, al
jmp 0x14000fbc2
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14000fba0
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.1400056f0
mov rcx, rdi
call fcn.140013f50
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180001280
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor r15d, r15d
mov rbx, rcx
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dil, 0x41
mov ebp, 0xf
mov esi, eax
mov r14d, 1
nop
test r14b, sil
je 0x1800013d3
mov qword [rsp + 0x48], rbp
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x31], r15b
movsx eax, dil
movzx eax, al
mov byte [rsp + 0x30], al
lea rax, [r14 + 2]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov word [rax + r14], 0x5c3a
mov byte [rax + r14 + 2], r15b
lea rax, [rsp + 0x30]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], rbp
mov byte [rax], r15b
mov rdx, qword [rsp + 0x48]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm1
cmp rdx, rbp
jbe 0x18000136d
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001368
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000140e
call fcn.18000445c
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x18000138b
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1800038b0
add qword [rbx + 8], 0x20
jmp 0x18000139b
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, rbx
call fcn.180003f50
mov rdx, qword [rsp + 0x68]
cmp rdx, rbp
jbe 0x1800013d3
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800013ce
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001414
call fcn.18000445c
shr esi, 1
inc dil
cmp dil, 0x5a
jle 0x1800012d0
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180004400
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1800082f4
int3
call fcn.1800082f4
int3
Function at 0x180001420
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x18], 0xf
mov rbx, rcx
mov r9, qword [rcx + 0x10]
jbe 0x18000144f
mov rdx, qword [rcx]
add r9, rdx
jmp 0x180001455
add r9, rbx
mov rdx, rbx
xor edi, edi
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x38], xmm0
movdqu xmmword [rsp + 0x48], xmm1
cmp rdx, r9
jne 0x18000147e
mov eax, 7
mov word [rsp + 0x38], di
mov qword [rsp + 0x50], rax
jmp 0x180001490
sub r9, rdx
lea rcx, [rsp + 0x38]
call fcn.180003bd0
mov rax, qword [rsp + 0x50]
cmp rax, 7
movaps xmmword [rsp + 0x60], xmm6
lea rcx, [rsp + 0x38]
cmova rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x180001585
mov rcx, qword [rsp + 0x20]
xorps xmm6, xmm6
shr rcx, 0x14
test rcx, rcx
js 0x1800014d9
cvtsi2sd xmm6, rcx
jmp 0x1800014ee
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm6, rax
addsd xmm6, xmm6
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x180001530
mov rcx, qword [rsp + 0x38]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000152b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001647
call fcn.18000445c
mov rdx, qword [rbx + 0x18]
movdqa xmm0, xmmword [0x18001aeb0]
mov word [rsp + 0x38], di
movdqu xmmword [rsp + 0x48], xmm0
cmp rdx, 0xf
jbe 0x18000157d
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x180001578
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180001647
mov rcx, r8
call fcn.18000445c
movaps xmm0, xmm6
jmp 0x180001618
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x1800015c7
mov rcx, qword [rsp + 0x38]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800015c2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001647
call fcn.18000445c
mov rdx, qword [rbx + 0x18]
movdqa xmm0, xmmword [0x18001aeb0]
mov word [rsp + 0x38], di
movdqu xmmword [rsp + 0x48], xmm0
cmp rdx, 0xf
jbe 0x180001610
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18000160b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180001647
mov rcx, r8
call fcn.18000445c
movsd xmm0, qword [0x18001aea0]
movaps xmm6, xmmword [rsp + 0x60]
mov byte [rbx], dil
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180004400
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
call fcn.1800082f4
int3
Function at 0x180001650
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rcx + 0x18], 0xf
mov rbx, rcx
mov r9, qword [rcx + 0x10]
jbe 0x180001682
mov rdx, qword [rcx]
add r9, rdx
jmp 0x180001688
add r9, rbx
mov rdx, rbx
xor edi, edi
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm1
cmp rdx, r9
jne 0x1800016b1
mov eax, 7
mov word [rsp + 0x40], di
mov qword [rsp + 0x58], rax
jmp 0x1800016c3
sub r9, rdx
lea rcx, [rsp + 0x40]
call fcn.180003bd0
mov rax, qword [rsp + 0x58]
cmp rax, 7
movaps xmmword [rsp + 0x70], xmm6
lea rax, [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
cmova rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x1800017d5
mov eax, dword [rsp + 0x34]
xorps xmm6, xmm6
mov ecx, dword [rsp + 0x30]
imul rcx, rax
mov eax, dword [rsp + 0x38]
imul rcx, rax
test rcx, rcx
js 0x180001721
cvtsi2sd xmm6, rcx
jmp 0x180001736
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm6, rax
addsd xmm6, xmm6
mov rdx, qword [rsp + 0x58]
mulsd xmm6, qword [0x18001ae90]
cmp rdx, 7
jbe 0x180001780
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000177b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000189a
call fcn.18000445c
mov rdx, qword [rbx + 0x18]
movdqa xmm0, xmmword [0x18001aeb0]
mov word [rsp + 0x40], di
movdqu xmmword [rsp + 0x50], xmm0
cmp rdx, 0xf
jbe 0x1800017cd
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800017c8
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000189a
mov rcx, r8
call fcn.18000445c
movaps xmm0, xmm6
jmp 0x180001868
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x180001817
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001812
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000189a
call fcn.18000445c
mov rdx, qword [rbx + 0x18]
movdqa xmm0, xmmword [0x18001aeb0]
mov word [rsp + 0x40], di
movdqu xmmword [rsp + 0x50], xmm0
cmp rdx, 0xf
jbe 0x180001860
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18000185b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000189a
mov rcx, r8
call fcn.18000445c
movsd xmm0, qword [0x18001aea0]
movaps xmm6, xmmword [rsp + 0x70]
mov byte [rbx], dil
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180004400
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
call fcn.1800082f4
int3
Function at 0x180001ba0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
movsd xmm0, qword [str._unknown_]
mov rbx, rdx
movzx eax, word [0x18001ac18]
mov rdi, rcx
xor edx, edx
movsd qword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x3a]
mov word [rsp + 0x38], ax
mov r8d, 0xfa
call fcn.1800119a0
test rbx, rbx
je 0x180001c2e
lea r9, [rsp + 0x20]
mov r8d, 8
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x180001c2e
mov rdx, qword [rsp + 0x28]
lea r8, [rsp + 0x30]
mov r9d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
xor esi, esi
lea rax, [rsp + 0x30]
xorps xmm0, xmm0
mov rbx, 0xffffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], sil
jne 0x180001c50
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x180001d55
cmp rbx, 0xf
ja 0x180001c97
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x30]
mov qword [rdi + 0x18], 0xf
mov rcx, rdi
call fcn.180011d60
mov byte [rbx + rdi], sil
jmp 0x180001d23
mov rax, rbx
or rax, 0xf
cmp rax, rbp
jbe 0x180001cd0
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180004420
test rax, rax
je 0x180001d49
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x180001d04
mov ecx, 0x16
mov rbp, rax
cmp rax, rcx
cmovb rbp, rcx
lea rcx, [rbp + 1]
test rcx, rcx
je 0x180001d04
cmp rcx, 0x1000
jb 0x180001cfc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180001d4f
jmp 0x180001cb1
call fcn.180004420
mov rsi, rax
mov r8, rbx
mov qword [rdi], rsi
lea rdx, [rsp + 0x30]
mov qword [rdi + 0x10], rbx
mov rcx, rsi
mov qword [rdi + 0x18], rbp
call fcn.180011d60
mov byte [rsi + rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180004400
mov rbx, qword [rsp + 0x180]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret
call fcn.1800082f4
int3
call fcn.180001240
int3
call fcn.180001260
int3

Function at 0x180001d60
Capabilities:
Enumerate process modules

Disassembly:
push rbx
mov eax, 0x2050
call fcn.180011810
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rcx
mov dword [rsp + 0x2030], 0
lea rcx, [rsp + 0x30]
mov edx, 0x2000
lea r8, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
mov r8d, 0x2008
lea rdx, [rsp + 0x30]
mov rcx, rbx
test eax, eax
je 0x180001dc4
mov eax, dword [rsp + 0x20]
shr eax, 2
mov dword [rsp + 0x2034], eax
call fcn.180011d60
mov rax, rbx
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.180004400
add rsp, 0x2050
pop rbx
ret