joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005430
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100000
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp r12d, 2
jl 0x14000550a
lea ebp, [r12 - 1]
cmp ebp, 2
jl 0x1400054de
add r12d, 0xfffffffe
mov ebx, 1
lea r13, [0x1400663e0]
mov rdi, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
lea r15, [0x14009cdd0]
nop dword [rax]
movsxd r14, ebx
mov rcx, qword [rsi + r14*8]
mov rdx, r13
call rdi
test eax, eax
je 0x1400054d0
mov rcx, qword [rsi + r14*8]
lea rdx, str.__force_use_module
call rdi
cmp r14d, r12d
jge 0x14000550a
test eax, eax
jne 0x14000550a
lea ebx, [r14 + 1]
mov rdx, qword [rsi + r14*8 + 8]
mov rcx, r15
call fcn.14000ae80
jmp 0x1400054d7
mov byte [0x14009cdc8], 1
add ebx, 1
cmp ebx, ebp
jl 0x140005490
movsxd rax, ebp
mov rdx, qword [rsi + rax*8]
lea rcx, [0x14009ce00]
call fcn.14000ae80
mov cl, byte [0x14009cdc8]
call fcn.1400028d0
test al, al
je 0x14000550a
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
ud2
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
ud2

Function at 0x140009230
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x14006a010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x1400092dc
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x1400092dc
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400092da
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x1400092f3
cmp eax, 1
je 0x1400092a7
test eax, eax
jne 0x1400092da
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x1400092d0
mov r9, qword [rsi + 0x80]
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x1400092da
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x1400092dc
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004f7f0
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov dil, 1
jmp 0x1400092dc
Function at 0x180001260
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1800012b0
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret

Function at 0x180001730
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180001780
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret

Function at 0x180001ae0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180001b30
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret
Function at 0x180002950
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1800029a0
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret

Function at 0x180002b90
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180002be0
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret
Function at 0x180002f30
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x220
movzx esi, dx
mov rdi, rcx
lea rdx, [rsp + 0x80]
mov ecx, 0x202
mov rbp, r9
mov r14, r8
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, eax
test eax, eax
je 0x180002f87
lea rcx, str.Could_not_initialise_Winsock:__x.
mov edx, eax
call fcn.180002b90
mov eax, ebx
jmp 0x1800030b8
xor eax, eax
lea rcx, str.Attempting_to_resolve__s
mov rdx, rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
movzx eax, si
mov dword [rsp + 0x58], 2
mov dword [rsp + 0x5c], reloc.WS2_32.dll_recvfrom
mov dword [rsp + 0x54], eax
call fcn.180002b90
mov rax, qword [0x180061448]
test rax, rax
jne 0x180002fe7
xor ecx, ecx
call fcn.1800037a0
mov qword [0x180061448], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rdi
call rax
mov ecx, eax
mov edi, eax
call qword [sym.imp.WS2_32.dll_WSASetLastError]
test edi, edi
je 0x18000305d
lea rcx, str.Unable_to_resolve_host_Error:__x.
mov edx, edi
call fcn.180002b90
mov qword [rsp + 0x30], 0
lea rbx, [0x180062a80]
mov r9d, 0x400
mov r8d, edi
xor edx, edx
mov ecx, 0x12ff
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
lea rcx, str.Error_msg:__s
mov rdx, rbx
call fcn.180002b90
mov rbx, qword [rsp + 0x40]
jmp 0x180003090
mov rbx, qword [rsp + 0x40]
mov eax, dword [rbx + 4]
cmp eax, 2
je 0x180003071
cmp eax, 0x17
je 0x180003084
jmp 0x180003090
mov rax, qword [rbx + 0x20]
mov ecx, dword [rax + 4]
mov dword [rsp + 0x48], ecx
mov rax, qword [rsp + 0x48]
mov qword [r14], rax
mov rax, qword [rbx + 0x20]
movups xmm0, xmmword [rax + 8]
movups xmmword [rbp], xmm0
mov rax, qword [0x180061450]
test rax, rax
jne 0x1800030ab
lea ecx, [rax + 2]
call fcn.1800037a0
mov qword [0x180061450], rax
mov rcx, rbx
call rax
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, edi
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1800037a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x270
cmp dword [0x180061440], 0
lea rax, [0x180003230]
lea rbx, str.getaddrinfo
mov qword [rsp + 0x28], rax
lea rax, str.getnameinfo
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x180003530]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
lea rax, str.freeaddrinfo
mov qword [rsp + 0x40], rax
lea rax, [fcn.1800031e0]
mov qword [rsp + 0x48], rax
jne 0x18000395a
lea rcx, [rsp + 0x160]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x180003950
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
mov qword [rsp + 0x280], rsi
call fcn.18002de6c
lea r8, str.ws2_32
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.18002d660
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180003882
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1800038e2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.18002de6c
lea r8, str.wship6
lea rcx, [rsp + 0x50]
mov edx, 0x10c
call fcn.18002d660
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180003948
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1800038e2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x180003948
mov qword [rsp + 0x288], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x180003937
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x1800038f1
mov rax, qword [rsp + 0x28]
mov qword [0x18005a0d8], rax
mov rax, qword [rsp + 0x38]
mov qword [0x18005a0e8], rax
mov rax, qword [rsp + 0x48]
mov qword [fcn.1800031e0], rax
jmp 0x180003940
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x280]
mov dword [0x180061440], 1
mov rbx, qword [rsp + 0x290]
movzx eax, bp
lea rcx, str.getaddrinfo
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
add rsp, 0x270
pop rbp
ret
Function at 0x180003bc0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
movzx ebp, r9w
mov qword [rdi], 0
mov r14d, r8d
mov r15d, edx
mov byte [r12], 0
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rsi, rax
test rax, rax
je 0x180003c98
cmp word [rax + 0x10], 2
mov qword [rsp + 0x40], rbx
jne 0x180003c5b
cmp word [rax + 0x12], 4
jne 0x180003c5b
mov rbx, qword [rax + 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x180003c5b
nop word [rax + rax]
mov r9d, dword [rcx]
movzx r8d, bp
mov edx, r14d
mov ecx, r15d
call fcn.180003b20
mov qword [rdi], rax
test rax, rax
je 0x180003c91
mov rcx, qword [rbx + 8]
add rbx, 8
lea rdi, [rax + 0x28]
test rcx, rcx
jne 0x180003c30
mov r8, qword [rsi]
mov r9d, 0x400
mov rcx, r12
lea edx, [r9 + 1]
call fcn.18002d91c
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov eax, 8
jmp 0x180003c72
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2af9
je 0x180003caf
dec eax
je 0x180003cbd
dec eax
je 0x180003cb6
dec eax
mov eax, 0x2af9
jmp 0x180003c77
mov eax, 0x2afb
jmp 0x180003c77
mov eax, 0x2afa
jmp 0x180003c77
Function at 0x180004490
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1800044e0
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret

Function at 0x1800048f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180004940
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret

Function at 0x180005450
Capabilities:
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x180061460]
xor ebx, ebx
call qword [rax + 0x2d8]
mov rdi, rax
test rax, rax
je 0x18000547e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x180005486
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.18002ce28
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180005500
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x180061460]
xor edi, edi
call qword [rax + 0x2d8]
mov rbx, rax
test rax, rax
je 0x18000554e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180005541
test al, 1
je 0x180005541
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180005556
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call fcn.18002ce28
mov rbx, qword [rsp + 0x30]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x180005580
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x10020
call fcn.18002ea10
sub rsp, rax
mov rax, qword [0x180061460]
call qword [rax + 0x2d8]
mov rbx, rax
test rax, rax
je 0x1800055c4
lea rdx, [rsp + 0x20]
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
test eax, eax
jne 0x1800055cf
call fcn.18002ce28
xor eax, eax
add rsp, 0x10020
pop rbx
ret
call fcn.18002ce28
mov rax, qword [0x180061460]
lea rcx, [rsp + 0x20]
call qword [rax + 0x2e0]
add rsp, 0x10020
pop rbx
ret

Function at 0x180005710
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r13
push r14
mov eax, 0x10290
call fcn.18002ea10
sub rsp, rax
mov r13, r8
mov rbx, rcx
mov r9, rcx
lea r8, [0x1800441fc]
lea rcx, [rsp + 0x280]
xor esi, esi
mov edx, 0x8000
mov edi, esi
call fcn.18002ea60
lea edx, [rsi + 0x2a]
mov rcx, rbx
call fcn.18002ec70
test rax, rax
jne 0x18000579d
lea r8, str._s
lea rcx, [rsp + 0x280]
mov r9, rbx
mov edx, 0x8000
call fcn.18002ea60
mov rcx, rbx
call fcn.18002ec00
mov rdi, rax
test rax, rax
jne 0x1800057c9
mov r14, qword [rsp + 0x102d8]
mov esi, 8
jmp 0x18000592f
mov edx, 0x5c
mov rcx, rbx
call fcn.18002ec70
mov r14, rax
test rax, rax
je 0x1800057c9
mov rcx, rbx
mov byte [rax], sil
call fcn.18002ec00
mov rdi, rax
test rax, rax
je 0x18000578b
mov byte [r14], 0x5c
lea rcx, [rsp + 0x280]
mov qword [rsp + 0x10288], r12
call fcn.180005580
mov r12, rax
test rax, rax
jne 0x1800057f6
mov r14, qword [rsp + 0x102d8]
lea esi, [rax + 8]
jmp 0x180005927
mov rcx, rax
mov rax, qword [0x180061460]
call qword [rax + 0x2d8]
mov r14, rax
test rax, rax
jne 0x18000581b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x180005927
lea rdx, [rsp + 0x30]
mov rcx, rax
mov qword [rsp + 0x102c0], rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
test rax, rax
jne 0x180005846
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x18000591f
mov qword [rsp + 0x10280], r15
nop
cmp rbp, 0xffffffffffffffff
je 0x1800058fe
mov rax, qword [0x180061460]
lea rcx, [rsp + 0x5c]
call qword [rax + 0x2e0]
mov rdx, qword [0x180061460]
lea rcx, [rsp + 0x264]
mov rbx, rax
call qword [rdx + 0x2e0]
mov edx, 0x8000
lea rcx, [rsp + 0x8280]
mov r15, rax
test rdi, rdi
je 0x1800058af
lea r8, str._s_s
mov r9, rdi
mov qword [rsp + 0x20], rbx
call fcn.18002ea60
jmp 0x1800058be
lea r8, [0x1800441fc]
mov r9, rbx
call fcn.18002ea60
lea r9, [rsp + 0x8280]
mov r8, r15
mov rdx, rbx
mov rcx, r13
call qword [rsp + 0x102c8]
mov rcx, rbx
call fcn.18002ce28
mov rcx, r15
call fcn.18002ce28
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180005850
jmp 0x180005906
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r12
call fcn.18002ce28
mov r15, qword [rsp + 0x10280]
mov rbp, qword [rsp + 0x102c0]
mov r12, qword [rsp + 0x10288]
mov rcx, rdi
call fcn.18002ce28
mov rcx, r14
call fcn.18002ce28
mov eax, esi
add rsp, 0x10290
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x180005960
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x10020
call fcn.18002ea10
sub rsp, rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x8000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x180005995
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x10020
pop rbx
ret
mov rax, qword [0x180061460]
lea rcx, [rsp + 0x20]
call qword [rax + 0x2e0]
mov qword [rbx], rax
test rax, rax
je 0x180005986
xor eax, eax
add rsp, 0x10020
pop rbx
ret

Function at 0x1800059c0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x180061460]
xor ebx, ebx
call qword [rax + 0x2d8]
mov rdi, rax
test rax, rax
je 0x1800059f0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800059f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.18002ce28
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180005a20
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x180061460]
mov rbx, rdx
xor edi, edi
call qword [rax + 0x2d8]
mov rcx, rbx
mov rsi, rax
mov rax, qword [0x180061460]
call qword [rax + 0x2d8]
mov rbx, rax
test rsi, rsi
je 0x180005a71
test rax, rax
je 0x180005a71
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x180005a79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rsi
call fcn.18002ce28
mov rcx, rbx
call fcn.18002ce28
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x180005ab0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x180061460]
mov rbx, rdx
xor edi, edi
call qword [rax + 0x2d8]
mov rcx, rbx
mov rsi, rax
mov rax, qword [0x180061460]
call qword [rax + 0x2d8]
mov rbx, rax
test rsi, rsi
je 0x180005b04
test rax, rax
je 0x180005b04
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180005b0c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rsi
call fcn.18002ce28
mov rcx, rbx
call fcn.18002ce28
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x1800060e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.18002d578
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180006130
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.1800320dc
lea r8, [0x1800439b8]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.18002d660
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18001aa90
add rsp, 0x438
ret
Function at 0x180007940
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x10280
call fcn.18002ea10
sub rsp, rax
mov rax, qword [rdx]
mov r14, r8
mov rbp, rcx
mov r9, rcx
mov rdi, rdx
lea r8, [0x1800441f0]
lea rcx, [rsp + 0x280]
mov edx, 0x8000
mov qword [rsp + 0x20], rax
call fcn.18002efd8
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180007a78
mov qword [rsp + 0x10290], rbx
movzx edx, word [rsp + 0x5c]
movzx ecx, word [rsp + 0x5e]
cmp dx, word [0x1800441e8]
jne 0x1800079cf
cmp cx, word [0x1800441ea]
je 0x180007a35
cmp dx, word [0x1800441b0]
jne 0x1800079ef
cmp cx, word [0x1800441b2]
jne 0x1800079ef
movzx eax, word [rsp + 0x60]
cmp ax, word [0x1800441b4]
je 0x180007a35
test byte [rsp + 0x30], 0x10
jne 0x180007a35
mov rbx, qword [rsp + 0x44]
mov rcx, rbx
call fcn.180006590
mov ecx, dword [rdi + 0x14]
cmp ecx, 0xffffffff
je 0x180007a0f
cmp ecx, eax
ja 0x180007a35
mov ecx, dword [rdi + 0x18]
cmp ecx, 0xffffffff
je 0x180007a1b
cmp ecx, eax
jb 0x180007a35
mov r9d, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rbx
call fcn.1800065d0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800079b3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x10290]
xor eax, eax
lea r11, [rsp + 0x10280]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x180007a5c
lea rcx, str._SEARCH__search_files:_FindFirstFileW_Failed.
call fcn.1800060e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180007a5e