joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003604
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov ebp, r8d
xor esi, esi
mov r15, rdx
mov rdi, rcx
cmp esi, ebp
jae 0x1800036eb
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rdi + 0x20]
lea r14, [rdi + 0x38]
mov r8d, ebp
mov edx, esi
sub r8d, esi
mov qword [rsp + 0x20], r14
add rdx, r15
lea r9, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1800036df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x3e5
jne 0x1800036df
cmp byte [rdi + 0x74], 0
mov rcx, qword [rdi + 0x50]
je 0x1800036a1
mov rax, qword [rdi + 0x30]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x30], rcx
or r9d, 0xffffffff
mov qword [rsp + 0x38], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
jmp 0x1800036aa
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
test eax, eax
jne 0x1800036cb
mov rcx, qword [rdi + 0x20]
lea r8, [rsp + 0x78]
xor r9d, r9d
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x1800036df
jmp 0x1800036d0
cmp ebx, 0xffffffff
jne 0x1800036da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1800036df
mov ebx, 0x3e3
add esi, dword [rsp + 0x78]
test ebx, ebx
je 0x180003629
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x180003840
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180017dd0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003850
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180017f20]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003860
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180018070]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003870
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800181c0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003880
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180018310]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003890
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180018460]
xor edx, edx
jmp fcn.180002ac8

Function at 0x1800038a0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800185b0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x1800038b0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180018700]
xor edx, edx
jmp fcn.180002ac8

Function at 0x1800038c0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180018850]
xor edx, edx
jmp fcn.180002ac8

Function at 0x1800038d0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800189a0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x1800038e0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180018af0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x1800038f0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180018c40]
xor edx, edx
jmp fcn.180002ac8
Function at 0x180003900
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180018d90]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003910
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180018ee0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003920
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180019030]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003930
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180019180]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003940
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800192d0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003950
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180019420]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003960
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180019570]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003970
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800196c0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003980
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180019810]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003990
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180019960]
xor edx, edx
jmp fcn.180002ac8

Function at 0x1800039a0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180019ab0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x1800039b0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180019c00]
xor edx, edx
jmp fcn.180002ac8

Function at 0x1800039c0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180019d50]
xor edx, edx
jmp fcn.180002ac8

Function at 0x1800039d0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180019ea0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x1800039e0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180019ff0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x1800039f0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001a140]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003a00
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001a290]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003a10
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001a3e0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003a20
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001a530]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003a30
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001a680]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003a40
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001a7d0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003a50
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001a920]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003a60
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001aa70]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003a70
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001abc0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003a80
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001ad10]
xor edx, edx
jmp fcn.180002ac8
Function at 0x180003a90
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001ae60]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003aa0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001afb0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ab0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001b100]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ac0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001b250]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ad0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001b3a0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ae0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001b4f0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003af0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001b640]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003b00
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001b790]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003b10
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001b8e0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003b20
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001ba30]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003b30
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001bb80]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003b40
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001bcd0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003b50
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001be20]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003b60
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001bf70]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003b70
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001c0c0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003b80
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001c210]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003b90
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001c360]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ba0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001c4b0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003bb0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001c600]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003bc0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001c750]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003bd0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001c8a0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003be0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001c9f0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003bf0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001cb40]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003c00
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001cc90]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003c10
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001cde0]
xor edx, edx
jmp fcn.180002ac8
Function at 0x180003c20
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001cf30]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003c30
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001d080]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003c40
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001d1d0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003c50
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001d320]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003c60
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001d470]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003c70
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001d5c0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003c80
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001d710]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003c90
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001d860]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ca0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001d9b0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003cb0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001db00]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003cc0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001dc50]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003cd0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001dda0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ce0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001def0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003cf0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001e040]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003d00
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001e190]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003d10
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001e2e0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003d20
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001e430]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003d30
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001e580]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003d40
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001e6d0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003d50
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001e820]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003d60
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001e970]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003d70
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001eac0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003d80
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001ec10]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003d90
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001ed60]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003da0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001eeb0]
xor edx, edx
jmp fcn.180002ac8
Function at 0x180003db0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001f000]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003dc0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001f150]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003dd0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001f2a0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003de0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001f3f0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003df0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001f540]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003e00
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001f690]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003e10
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001f7e0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003e20
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001f930]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003e30
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001fa80]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003e40
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001fbd0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003e50
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001fd20]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003e60
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001fe70]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003e70
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x18001ffc0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003e80
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180020110]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003e90
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180020260]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ea0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800203b0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003eb0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180020500]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ec0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180020650]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ed0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800207a0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ee0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800208f0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ef0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180020a40]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003f00
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180020b90]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003f10
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180020ce0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003f20
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180020e30]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003f30
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180020f80]
xor edx, edx
jmp fcn.180002ac8
Function at 0x180003f40
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800210d0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003f50
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021220]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003f60
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021370]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003f70
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800214c0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003f80
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021610]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003f90
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021760]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003fa0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800218b0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003fb0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021a00]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003fc0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021b50]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003fd0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021ca0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003fe0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021df0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180003ff0
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180021f40]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180004000
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180022090]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180004010
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x1800221e0]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180004020
Capabilities:
Check if file exists

Disassembly:
lea r8, [0x180022330]
xor edx, edx
jmp fcn.180002ac8

Function at 0x180004030
Capabilities:
Check if file exists

Disassembly:
lea r8, str.test.cs_X1X3X2.Y1yY.Z3z1Z
xor edx, edx
jmp fcn.180002ac8
Function at 0x180004214
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x280
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x288], rbx
mov qword [rbp + 0x290], rsi
mov qword [rbp + 0x298], rdi
mov rax, qword [0x180031008]
xor rax, rbp
mov qword [rbp + 0x250], rax
or rbx, 0xffffffffffffffff
mov r14, rcx
xor r15d, r15d
inc rbx
cmp word [rcx + rbx*2], r15w
jne 0x180004256
lea rsi, [rbx + 0x107]
lea rax, [rsi + rsi]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x18000427e
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180005160
sub rsp, rcx
lea rdi, [rsp + 0x20]
test rdi, rdi
jne 0x18000429e
xor al, al
jmp 0x180004378
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.18000164c
lea r8, [0x180022c38]
mov rdx, rsi
mov rcx, rdi
call fcn.18000157c
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000436a
inc rbx
lea rbx, [rdi + rbx*2]
lea r8, [rbp + 0x2c]
mov edx, 0x106
mov rcx, rbx
call fcn.18000164c
test byte [rbp], 0x10
je 0x180004339
movzx ecx, word [rbp + 0x2c]
cmp cx, word [0x180022c40]
movzx eax, word [rbp + 0x2e]
jne 0x180004310
cmp ax, word [0x180022c42]
je 0x180004342
cmp cx, word [0x180022c44]
jne 0x18000432f
cmp ax, word [0x180022c46]
jne 0x18000432f
movzx eax, word [rbp + 0x30]
cmp ax, word [0x180022c48]
je 0x180004342
mov rcx, rdi
call fcn.180004214
jmp 0x180004342
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180004360
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
or rsi, 0xffffffffffffffff
cmp rsi, 0xffffffffffffffff
jne 0x1800042df
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
mov rcx, qword [rbp + 0x250]
xor rcx, rbp
call fcn.1800051d0
mov rbx, qword [rbp + 0x288]
mov rsi, qword [rbp + 0x290]
mov rdi, qword [rbp + 0x298]
lea rsp, [rbp + 0x260]
pop r15
pop r14
pop rbp
ret

Function at 0x1800043ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x1800043c8
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800043c8
test al, 0x10
je 0x1800043c8
mov al, 1
jmp 0x1800043ca
xor al, al
add rsp, 0x28
ret
Function at 0x1800012b0
Capabilities:
Encode data using xor

Disassembly:
endbr64
xor rax, rax
xor r10, r10
cmp r8, 0
je 0x18000130d
cmp r8, 0x10
jne 0x1800012f0
mov r10, qword [rcx]
mov r11, qword [rcx + 8]
mov r8d, 1
xor r10, qword [rdx]
xor r11, qword [rdx + 8]
or r10, r11
cmovne rax, r8
repz ret
mov r10b, byte [rcx]
lea rcx, [rcx + 1]
xor r10b, byte [rdx]
lea rdx, [rdx + 1]
or al, r10b
dec r8
jne 0x1800012f0
neg rax
shr rax, 0x3f
repz ret

Function at 0x180001500
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x180001520
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x180001520
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret