joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4dc82c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dc8aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dc8a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dc8a1
mov rax, qword [rbp - 8]
jmp 0x2fc4dc8bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dc874
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dcde0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4dd7e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc502108]
test eax, eax
je 0x2fc4dd87a
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc502110]
mov qword [rbp - 8], rax
jmp 0x2fc4dd85e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dd852
cmp qword [rbp - 0x10], 0
je 0x2fc4dd852
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dd818
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dd87b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dd980
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dd9a8
mov eax, 0
jmp 0x2fc4dd9f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dd9d1
mov eax, 0
jmp 0x2fc4dd9f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dd9f1
mov eax, 0
jmp 0x2fc4dd9f6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dd9fc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dda7a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dda71
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dda71
mov rax, qword [rbp - 8]
jmp 0x2fc4dda8f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dda44
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180027380
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x60], r8
mov dword [rsp + 0x3c], 0x6062eb44
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x24], eax
sub eax, 0x98e8316e
je 0x1800275de
jmp 0x1800273b6
mov eax, dword [rsp + 0x24]
sub eax, 0xb931e037
je 0x1800275f3
jmp 0x1800273ca
mov eax, dword [rsp + 0x24]
sub eax, 0xd874f6bf
je 0x1800275c6
jmp 0x1800273de
mov eax, dword [rsp + 0x24]
sub eax, 0xdc11aa14
je 0x18002758f
jmp 0x1800273f2
mov eax, dword [rsp + 0x24]
sub eax, 0x33dedc3
je 0x180027524
jmp 0x180027406
mov eax, dword [rsp + 0x24]
sub eax, 0x6725530
je 0x1800275a9
jmp 0x18002741a
mov eax, dword [rsp + 0x24]
sub eax, 0x730b7fb
je 0x18002757a
jmp 0x18002742e
mov eax, dword [rsp + 0x24]
sub eax, 0x754d06e
je 0x18002753b
jmp 0x180027442
mov eax, dword [rsp + 0x24]
sub eax, 0x15364924
je 0x18002760b
jmp 0x180027456
mov eax, dword [rsp + 0x24]
sub eax, 0x292888fc
je 0x1800274c2
jmp 0x18002746a
mov eax, dword [rsp + 0x24]
sub eax, 0x6062eb44
je 0x1800274ab
jmp 0x18002747e
mov eax, dword [rsp + 0x24]
sub eax, 0x6081e763
je 0x180027555
jmp 0x180027492
mov eax, dword [rsp + 0x24]
sub eax, 0x7aeed782
je 0x1800274e3
jmp 0x1800274a6
jmp 0x18002761a
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x3c], 0x292888fc
jmp 0x18002761a
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x3c], 0x7aeed782
jmp 0x18002761a
mov rcx, qword [rsp + 0x70]
call fcn.1800191e0
mov dword [rsp + 0x4c], eax
mov r8d, dword [rsp + 0x4c]
mov ecx, 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
mov eax, 0xdc11aa14
mov ecx, 0x33dedc3
cmp qword [rsp + 0x40], 0
cmove eax, ecx
mov dword [rsp + 0x3c], eax
jmp 0x18002761a
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x3c], 0x754d06e
jmp 0x18002761a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x84], eax
mov dword [rsp + 0x3c], 0x6081e763
jmp 0x18002761a
mov rcx, qword [rsp + 0x78]
mov edx, dword [rsp + 0x84]
lea r8, [0x18006d9e8]
call fcn.18001b470
mov dword [rsp + 0x3c], 0x730b7fb
jmp 0x18002761a
mov dword [rsp + 0x6c], 0xffffffff
mov dword [rsp + 0x3c], 0xb931e037
jmp 0x18002761a
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x3c], 0x6725530
jmp 0x18002761a
mov rcx, qword [rsp + 0x88]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x3c], 0xd874f6bf
jmp 0x18002761a
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x3c], 0x98e8316e
jmp 0x18002761a
mov dword [rsp + 0x6c], 0
mov dword [rsp + 0x3c], 0xb931e037
jmp 0x18002761a
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x94], eax
mov dword [rsp + 0x3c], 0x15364924
jmp 0x18002761a
mov eax, dword [rsp + 0x94]
add rsp, 0x98
ret
jmp 0x18002739e
Function at 0x180028760
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x30], rcx
mov rax, qword [0x1800760a8]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x28], 0x762f8806
mov eax, dword [rbp - 0x28]
mov dword [rbp - 0x34], eax
sub eax, 0x86314d95
je 0x1800288ef
jmp 0x180028799
mov eax, dword [rbp - 0x34]
sub eax, 0x95e50840
je 0x1800288b4
jmp 0x1800287ac
mov eax, dword [rbp - 0x34]
sub eax, 0xb0c80b24
je 0x18002891f
jmp 0x1800287bf
mov eax, dword [rbp - 0x34]
sub eax, 0xd1c92f1f
je 0x1800288d3
jmp 0x1800287d2
mov eax, dword [rbp - 0x34]
sub eax, 0x27fb4b7e
je 0x18002890b
jmp 0x1800287e5
mov eax, dword [rbp - 0x34]
sub eax, 0x655bdbbf
je 0x1800288e3
jmp 0x1800287f8
mov eax, dword [rbp - 0x34]
sub eax, 0x730ebba6
je 0x1800288ff
jmp 0x18002880b
mov eax, dword [rbp - 0x34]
sub eax, 0x7623dbc4
je 0x1800288a0
jmp 0x18002881e
mov eax, dword [rbp - 0x34]
sub eax, 0x762f8806
je 0x180028836
jmp 0x180028831
jmp 0x180028942
mov rcx, qword [rbp - 0x30]
mov eax, 0x10
call fcn.18006c5e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov eax, 0x30
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x40]
mov rdx, rsp
mov qword [rbp - 0x20], rdx
mov qword [rax], rcx
mov rcx, qword [rbp - 0x20]
xor edx, edx
mov r8d, 0x30
sub rsp, 0x20
call sub.msvcrt.dll_memset
add rsp, 0x20
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
add rsp, 0x20
mov dword [rbp - 0x28], 0x7623dbc4
jmp 0x180028942
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x28], 0x95e50840
jmp 0x180028942
mov rax, qword [rbp - 0x18]
movzx edx, word [rax]
mov eax, 0x86314d95
mov ecx, 0xd1c92f1f
cmp edx, 0
cmove eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x180028942
mov byte [rbp - 0x21], 1
mov dword [rbp - 0x28], 0x655bdbbf
jmp 0x180028942
mov dword [rbp - 0x28], 0x27fb4b7e
jmp 0x180028942
mov byte [rbp - 0x21], 0
mov dword [rbp - 0x28], 0x730ebba6
jmp 0x180028942
mov dword [rbp - 0x28], 0x27fb4b7e
jmp 0x180028942
mov al, byte [rbp - 0x21]
and al, 1
mov byte [rbp - 9], al
mov dword [rbp - 0x28], 0xb0c80b24
jmp 0x180028942
mov al, byte [rbp - 9]
and al, 1
movzx eax, al
mov dword [rbp - 0x44], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.18006c560
mov eax, dword [rbp - 0x44]
mov rsp, rbp
pop rbp
ret
jmp 0x180028783
Function at 0x18002f540
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rax, qword [0x1800760a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x44], 0x3a865d10
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x24], eax
sub eax, 0x8285720c
je 0x18002f5c6
jmp 0x18002f582
mov eax, dword [rsp + 0x24]
sub eax, 0xb332e7b9
je 0x18002f609
jmp 0x18002f596
mov eax, dword [rsp + 0x24]
sub eax, 0x3a865d10
je 0x18002f5af
jmp 0x18002f5aa
jmp 0x18002f62f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x44], 0x8285720c
jmp 0x18002f62f
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x60]
call fcn.180019bd0
lea rcx, [rsp + 0x60]
call fcn.18002f930
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [rsp + 0x44], 0xb332e7b9
jmp 0x18002f62f
lea rcx, [rsp + 0x60]
call fcn.180018960
xor eax, eax
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18006c560
mov eax, dword [rsp + 0x20]
add rsp, 0x78
ret
jmp 0x18002f56a
Function at 0x18002f640
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x60], r8
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], rcx
mov rax, qword [0x1800760a8]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x44], 0x3dea421c
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x64], eax
sub eax, 0x930ae547
je 0x18002f7ed
jmp 0x18002f687
mov eax, dword [rbp - 0x64]
sub eax, 0x996677a9
je 0x18002f82e
jmp 0x18002f69a
mov eax, dword [rbp - 0x64]
sub eax, 0xc3f5e8eb
je 0x18002f81a
jmp 0x18002f6ad
mov eax, dword [rbp - 0x64]
sub eax, 0x1b164073
je 0x18002f84f
jmp 0x18002f6c0
mov eax, dword [rbp - 0x64]
sub eax, 0x286d7f77
je 0x18002f777
jmp 0x18002f6d3
mov eax, dword [rbp - 0x64]
sub eax, 0x3dea421c
je 0x18002f711
jmp 0x18002f6e6
mov eax, dword [rbp - 0x64]
sub eax, 0x46ffe1b2
je 0x18002f7b2
jmp 0x18002f6f9
mov eax, dword [rbp - 0x64]
sub eax, 0x6a6df341
je 0x18002f85b
jmp 0x18002f70c
jmp 0x18002f878
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x60]
mov eax, 0x10
mov qword [rbp - 0x70], rax
call fcn.18006c5e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x30], rax
mov eax, 0x1000
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov r8, rsp
mov qword [rbp - 0x28], r8
call fcn.18006c5e0
sub rsp, rax
mov rax, qword [rbp - 0x58]
mov r8, rsp
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x30]
mov qword [rax], rcx
mov dword [rbp - 0x44], 0x286d7f77
jmp 0x18002f878
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
xor edx, edx
mov r8d, 0x1000
sub rsp, 0x20
call sub.msvcrt.dll_memset
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov dword [rax], 0
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x44], 0x46ffe1b2
jmp 0x18002f878
mov rdx, qword [rbp - 0x18]
mov ecx, 0x800
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp - 0x20]
mov dword [rax], ecx
mov rdx, qword [rbp - 0x20]
mov eax, 0x6a6df341
mov ecx, 0x930ae547
cmp dword [rdx], 0
cmova eax, ecx
mov dword [rbp - 0x44], eax
jmp 0x18002f878
mov rax, qword [rbp - 0x38]
mov dword [rax + 0x20], 0x13
mov rcx, qword [rbp - 0x38]
mov edx, 0x800
sub rsp, 0x20
call fcn.18001a3b0
add rsp, 0x20
mov dword [rbp - 0x44], 0xc3f5e8eb
jmp 0x18002f878
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x44], 0x996677a9
jmp 0x18002f878
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x10]
sub rsp, 0x20
call fcn.18001abb0
add rsp, 0x20
mov dword [rbp - 0x44], 0x1b164073
jmp 0x18002f878
mov dword [rbp - 0x44], 0x6a6df341
jmp 0x18002f878
xor eax, eax
mov dword [rbp - 0x74], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.18006c560
mov eax, dword [rbp - 0x74]
mov rsp, rbp
pop rbp
ret
jmp 0x18002f671
Function at 0x180048240
Capabilities:
Delete file

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 0x28], rcx
mov rax, qword [0x1800760a8]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x20], 0xe089a412
mov eax, dword [rbp - 0x20]
mov dword [rbp - 0x2c], eax
sub eax, 0x8c862ec3
je 0x180048397
jmp 0x180048279
mov eax, dword [rbp - 0x2c]
sub eax, 0xa2a94245
je 0x18004838b
jmp 0x18004828c
mov eax, dword [rbp - 0x2c]
sub eax, 0xc794d752
je 0x1800483f7
jmp 0x18004829f
mov eax, dword [rbp - 0x2c]
sub eax, 0xcb2ed292
je 0x1800483e5
jmp 0x1800482b2
mov eax, dword [rbp - 0x2c]
sub eax, 0xd262599a
je 0x1800483c3
jmp 0x1800482c5
mov eax, dword [rbp - 0x2c]
sub eax, 0xe089a412
je 0x180048316
jmp 0x1800482d8
mov eax, dword [rbp - 0x2c]
sub eax, 0xe811928d
je 0x180048378
jmp 0x1800482eb
mov eax, dword [rbp - 0x2c]
sub eax, 0x5f93f0c5
je 0x18004835d
jmp 0x1800482fe
mov eax, dword [rbp - 0x2c]
sub eax, 0x674bc08e
je 0x180048341
jmp 0x180048311
jmp 0x180048415
mov rcx, qword [rbp - 0x28]
mov eax, 0x10
call fcn.18006c5e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov qword [rax], rcx
mov dword [rbp - 0x20], 0x674bc08e
jmp 0x180048415
mov rax, qword [rbp - 0x18]
cmp qword [rax], 0
sete al
and al, 1
mov byte [rbp - 0xe], al
mov dword [rbp - 0x20], 0x5f93f0c5
jmp 0x180048415
mov dl, byte [rbp - 0xe]
mov eax, 0x8c862ec3
mov ecx, 0xe811928d
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x20], eax
jmp 0x180048415
mov dword [rbp - 0x1c], 0xffffffff
mov dword [rbp - 0x20], 0xa2a94245
jmp 0x180048415
mov dword [rbp - 0x20], 0xcb2ed292
jmp 0x180048415
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rsp, 0x20
cmp eax, 1
sete al
and al, 1
mov byte [rbp - 0xd], al
mov dword [rbp - 0x20], 0xd262599a
jmp 0x180048415
mov al, byte [rbp - 0xd]
mov dl, byte [rbp - 0xd]
mov eax, 0xffffffff
xor ecx, ecx
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0x20], 0xcb2ed292
jmp 0x180048415
mov eax, dword [rbp - 0x1c]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x20], 0xc794d752
jmp 0x180048415
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x30], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.18006c560
mov eax, dword [rbp - 0x30]
mov rsp, rbp
pop rbp
ret
jmp 0x180048263
Function at 0x180048420
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x3c], 0x89d67fb2
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x2c], eax
sub eax, 0x89d67fb2
je 0x1800484ee
jmp 0x180048449
mov eax, dword [rsp + 0x2c]
sub eax, 0x966a8f39
je 0x1800485b4
jmp 0x18004845d
mov eax, dword [rsp + 0x2c]
sub eax, 0xb13f899d
je 0x18004853b
jmp 0x180048471
mov eax, dword [rsp + 0x2c]
sub eax, 0xb5b635de
je 0x180048505
jmp 0x180048485
mov eax, dword [rsp + 0x2c]
sub eax, 0xcb042a61
je 0x18004851c
jmp 0x180048499
mov eax, dword [rsp + 0x2c]
sub eax, 0x11372dbd
je 0x180048550
jmp 0x1800484ad
mov eax, dword [rsp + 0x2c]
sub eax, 0x3cc1b74c
je 0x180048574
jmp 0x1800484c1
mov eax, dword [rsp + 0x2c]
sub eax, 0x3ed04899
je 0x18004855d
jmp 0x1800484d5
mov eax, dword [rsp + 0x2c]
sub eax, 0x4f3166a3
je 0x18004859f
jmp 0x1800484e9
jmp 0x1800485bd
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 0xb5b635de
jmp 0x1800485bd
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x3c], 0xcb042a61
jmp 0x1800485bd
mov rdx, qword [rsp + 0x50]
mov eax, 0x3ed04899
mov ecx, 0xb13f899d
cmp rdx, 0
cmove eax, ecx
mov dword [rsp + 0x3c], eax
jmp 0x1800485bd
mov dword [rsp + 0x4c], 0xffffffff
mov dword [rsp + 0x3c], 0x11372dbd
jmp 0x1800485bd
mov dword [rsp + 0x3c], 0x4f3166a3
jmp 0x1800485bd
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x3c], 0x3cc1b74c
jmp 0x1800485bd
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, eax
mov eax, 0xffffffff
xor ecx, ecx
cmp edx, 1
cmove eax, ecx
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x3c], 0x4f3166a3
jmp 0x1800485bd
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x3c], 0x966a8f39
jmp 0x1800485bd
mov eax, dword [rsp + 0x64]
add rsp, 0x68
ret
jmp 0x180048431
Function at 0x1800485d0
Capabilities:
Create directory

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x30], rcx
mov rax, qword [0x1800760a8]
xor rax, rbp
mov qword [rbp - 8], rax
mov dword [rbp - 0x28], 0x1b67fa96
mov eax, dword [rbp - 0x28]
mov dword [rbp - 0x34], eax
sub eax, 0xa79d3127
je 0x180048732
jmp 0x180048609
mov eax, dword [rbp - 0x34]
sub eax, 0xa8e2858e
je 0x180048726
jmp 0x18004861c
mov eax, dword [rbp - 0x34]
sub eax, 0xb6841f0e
je 0x1800486dc
jmp 0x18004862f
mov eax, dword [rbp - 0x34]
sub eax, 0xdbc0c932
je 0x180048796
jmp 0x180048642
mov eax, dword [rbp - 0x34]
sub eax, 0xeecb1fc6
je 0x180048713
jmp 0x180048655
mov eax, dword [rbp - 0x34]
sub eax, 0xf3087b45
je 0x180048784
jmp 0x180048668
mov eax, dword [rbp - 0x34]
sub eax, 0x1b67fa96
je 0x1800486a6
jmp 0x18004867b
mov eax, dword [rbp - 0x34]
sub eax, 0x232f3924
je 0x1800486f8
jmp 0x18004868e
mov eax, dword [rbp - 0x34]
sub eax, 0x4b48a9c2
je 0x180048762
jmp 0x1800486a1
jmp 0x1800487b4
mov rcx, qword [rbp - 0x30]
mov eax, 0x10
call fcn.18006c5e0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov qword [rax], rcx
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x28], 0xb6841f0e
jmp 0x1800487b4
mov rax, qword [rbp - 0x18]
cmp rax, 0
sete al
and al, 1
mov byte [rbp - 0xe], al
mov dword [rbp - 0x28], 0x232f3924
jmp 0x1800487b4
mov dl, byte [rbp - 0xe]
mov eax, 0xa79d3127
mov ecx, 0xeecb1fc6
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x1800487b4
mov dword [rbp - 0x24], 0xffffffff
mov dword [rbp - 0x28], 0xa8e2858e
jmp 0x1800487b4
mov dword [rbp - 0x28], 0xf3087b45
jmp 0x1800487b4
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
xor eax, eax
mov edx, eax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add rsp, 0x20
cmp eax, 1
sete al
and al, 1
mov byte [rbp - 0xd], al
mov dword [rbp - 0x28], 0x4b48a9c2
jmp 0x1800487b4
mov al, byte [rbp - 0xd]
mov dl, byte [rbp - 0xd]
mov eax, 0xffffffff
xor ecx, ecx
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x28], 0xf3087b45
jmp 0x1800487b4
mov eax, dword [rbp - 0x24]
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x28], 0xdbc0c932
jmp 0x1800487b4
mov eax, dword [rbp - 0xc]
mov dword [rbp - 0x38], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
sub rsp, 0x20
call fcn.18006c560
mov eax, dword [rbp - 0x38]
mov rsp, rbp
pop rbp
ret
jmp 0x1800485f3
Function at 0x180049a50
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x24], 0x11ff34
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
sub eax, 0xc443acfe
je 0x180049b60
jmp 0x180049a79
mov eax, dword [rsp + 0x20]
sub eax, 0x11ff34
je 0x180049af6
jmp 0x180049a8d
mov eax, dword [rsp + 0x20]
sub eax, 0x1e8c2c88
je 0x180049b49
jmp 0x180049aa1
mov eax, dword [rsp + 0x20]
sub eax, 0x24a4e686
je 0x180049b2c
jmp 0x180049ab5
mov eax, dword [rsp + 0x20]
sub eax, 0x3730d01c
je 0x180049b8a
jmp 0x180049ac9
mov eax, dword [rsp + 0x20]
sub eax, 0x3cc161c1
je 0x180049b0d
jmp 0x180049add
mov eax, dword [rsp + 0x20]
sub eax, 0x713c73fb
je 0x180049b7d
jmp 0x180049af1
jmp 0x180049b8f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x24], 0x3cc161c1
jmp 0x180049b8f
mov rax, qword [rsp + 0x30]
cmp rax, 0
setne al
and al, 1
mov byte [rsp + 0x3f], al
mov dword [rsp + 0x24], 0x24a4e686
jmp 0x180049b8f
mov dl, byte [rsp + 0x3f]
mov eax, 0x3730d01c
mov ecx, 0x1e8c2c88
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x24], eax
jmp 0x180049b8f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 0xc443acfe
jmp 0x180049b8f
mov rdx, qword [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x24], 0x713c73fb
jmp 0x180049b8f
mov dword [rsp + 0x24], 0x3730d01c
jmp 0x180049b8f
add rsp, 0x48
ret
jmp 0x180049a61