joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x18002a1e8]
mov rcx, qword [0x18002a1f8]
call qword [rax + 0x288]
mov rax, qword gs:[0x30]
xor r11d, r11d
mov rsi, qword [0x18002a1f8]
xor r10d, r10d
mov r9, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
mov rbx, qword [rcx + 0x18]
mov ecx, r10d
test r10d, r10d
je 0x180001073
sub ecx, 1
je 0x180001067
cmp ecx, 1
jne 0x18000107d
lea rdx, [rbx + 0x30]
lea r11d, [rcx + 0x1f]
jmp 0x18000107a
lea rdx, [rbx + 0x20]
mov r11d, reloc.OLEAUT32.dll_SafeArrayGetDim
jmp 0x18000107a
lea rdx, [rbx + 0x10]
xor r11d, r11d
mov r9, rdx
mov r8, qword [rdx]
cmp r8, r9
je 0x1800010b7
mov edi, r11d
mov rax, r8
mov rdx, r8
sub rax, rdi
cmp qword [rax + 0x30], rsi
jne 0x1800010ac
mov rcx, qword [r8 + 8]
mov rax, qword [r8]
mov qword [rcx], rax
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rax, qword [r8]
mov r8, rax
cmp rax, r9
jne 0x180001088
inc r10d
cmp r10d, 3
jl 0x18000104b
call fcn.1800017c4
mov rax, qword [0x18002a1e8]
xor ecx, ecx
call qword [rax + 0x1d8]
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800010e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x330
mov rbx, rcx
cmp edx, 1
jne 0x180001238
xor r8d, r8d
mov edx, 0x96000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x18002ad68], rax
call fcn.18000cff4
mov rcx, rbx
mov qword [0x18002a1f8], rbx
mov dword [0x18002a1f0], 1
call fcn.18001b0dc
mov edx, 0x298
lea rcx, [0x180023dd0]
mov r8d, 5
call fcn.18000cf3c
xor r8d, r8d
mov qword [0x18002a1e8], rax
mov edx, 0x1d0
lea rcx, [0x180023f20]
call fcn.18000cf3c
mov ecx, 0x129b
mov qword [0x18002a1e0], rax
call fcn.18000ddc0
mov rcx, rax
mov qword [rsp + 0x358], rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x358]
cmp eax, 0xffffffff
je 0x1800011a3
call fcn.18000dd5c
xor eax, eax
jmp 0x180001227
call fcn.18000dd5c
xor ebx, ebx
mov edi, reloc.OLEAUT32.dll_SafeArrayLock
movzx eax, word [0x18002400c]
lea rcx, [rsp + 0x33]
mov word [rsp + 0x30], ax
xor edx, edx
mov al, byte [0x18002400e]
mov r8d, 0xfd
mov byte [rsp + 0x32], al
call sub.msvcrt.dll_memset
xor edx, edx
mov word [rsp + 0x130], bx
mov r8d, 0x1fe
lea rcx, [rsp + 0x132]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x130]
mov dword [rsp + 0x28], 0xff
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub rdi, 1
jne 0x1800011af
mov eax, 1
mov rbx, qword [rsp + 0x340]
add rsp, 0x330
pop rdi
ret
test edx, edx
jne 0x180001222
mov rax, qword [0x18002a1e8]
mov ecx, 0xaa
call qword [rax + 0x178]
jmp 0x18000119c
Function at 0x18000127c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rcx, qword [0x18002ad68]
xor ebx, ebx
test rcx, rcx
jne 0x18000129b
mov edi, ebx
jmp 0x1800012ad
mov edx, 8
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov rcx, qword [0x18002a250]
cmp word [rcx + 0x242], 0x3a
jne 0x1800012f2
movzx eax, word [rcx + 0x240]
mov word [rsp + 0x20], ax
movzx eax, word [rcx + 0x242]
mov word [rsp + 0x22], ax
movzx eax, word [rcx + 0x244]
lea rcx, [rsp + 0x20]
mov word [rsp + 0x24], ax
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov qword [rdi], 2
lea r14, [rdi + 8]
call fcn.180003390
mov ecx, 0x923
mov qword [r14], rax
call fcn.18000ddc0
mov rcx, qword [0x18002a250]
xor r8d, r8d
add rcx, 0x240
mov qword [rsp + 0x68], rax
mov rdx, rax
call fcn.18000d5c0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rsi, rax
call fcn.18000dd5c
mov rax, qword [0x18002a1e8]
mov rcx, rsi
call qword [rax + 0x110]
cmp eax, 0xffffffff
je 0x180001382
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.1800157f4
test rax, rax
jne 0x18000136b
mov rax, rbx
jmp 0x180001373
mov rcx, rax
call fcn.18000fa40
lea rsi, [rdi + 0x10]
mov dword [rdi], 3
mov qword [rsi], rax
jmp 0x180001386
lea rsi, [rdi + 0x10]
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x70]
call fcn.18000c798
mov rcx, qword [r14]
test rcx, rcx
je 0x1800013c8
mov r8d, dword [rcx]
mov eax, ebx
test r8d, r8d
je 0x1800013c8
mov rdx, qword [rcx + 8]
mov ecx, eax
add rcx, rcx
cmp dword [rdx + rcx*8], 0x3b
je 0x1800013c1
inc eax
cmp eax, r8d
jb 0x1800013ad
jmp 0x1800013c8
cmp qword [rdx + rcx*8 + 8], rbx
jne 0x1800013d6
call fcn.180003264
test eax, eax
je 0x1800013d6
or ebx, 0xffffffff
jmp 0x1800013de
mov rcx, rdi
call fcn.1800023c4
mov rcx, r14
call fcn.18000fb5c
mov rcx, rsi
call fcn.18000fb5c
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1800014c4
Capabilities:
Set current directory

Disassembly:
push rbx
sub rsp, 0x60
mov ecx, 0x16a0
call fcn.18000dd80
mov rcx, rax
mov qword [rsp + 0x70], rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rax, [0x18002ac8c]
cmp rbx, rax
je 0x1800014ff
or rdx, 0xffffffffffffffff
lea rcx, [rsp + 0x70]
call fcn.18000c798
mov r8, qword [0x18002a250]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
mov r8d, dword [r8 + 0xac]
call fcn.18000ef48
mov qword [0x18002b780], rax
test rax, rax
jne 0x180001534
or eax, 0xffffffff
jmp 0x180001631
call fcn.1800176f8
mov ecx, 0x31
mov dword [rsp + 0x70], ebx
call fcn.18000f450
test eax, eax
jne 0x180001584
mov rax, qword [0x18002a250]
cmp dword [rax + 0x218], 3
je 0x180001584
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x1800031a0]
mov rax, qword [0x18002a1e8]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [rax + pe_nt_image_headers64]
call fcn.18000170c
mov dword [0x18002ac70], eax
test eax, eax
je 0x1800015f3
sub eax, 1
je 0x1800015fc
sub eax, 1
je 0x18000162f
cmp eax, 1
jne 0x18000162f
mov rax, qword [0x18002a250]
lea rcx, [rsp + 0x30]
mov edx, dword [rax + 0xac]
add edx, 4
call fcn.1800109e8
lea rcx, [rsp + 0x30]
call fcn.180011390
mov rcx, qword [0x18002a250]
mov edx, 0x1d4c0
mov ecx, dword [rcx + 0xac]
call fcn.180002d50
mov qword [0x18002a230], rax
call fcn.180001400
jmp 0x180001611
call fcn.18000127c
test eax, eax
js 0x18000162f
mov rax, qword [0x18002a250]
cmp dword [rax + 0xa4], 1
je 0x180001611
call fcn.180017618
mov rax, qword [0x18002a1e8]
lea rdx, [0x180001254]
mov ecx, 1
call qword [rax + 0x230]
call fcn.180002af4
xor eax, eax
add rsp, 0x60
pop rbx
ret
Function at 0x1800091e0
Capabilities:
Create directory

Disassembly:
push rbp
push rbx
push rsi
push r14
push r15
lea rbp, [rsp - 0x9a0]
sub rsp, 0xaa0
and dword [rbp + 0x9d0], 0
lea eax, [rcx - 1]
mov r8, rdx
mov ebx, ecx
cmp eax, 1
jbe 0x180009213
or eax, 0xffffffff
jmp 0x1800093f7
lea rdx, [rbp + 0x9d0]
mov rcx, r8
call fcn.1800166f4
mov qword [rsp + 0x30], rax
mov rsi, rax
test rax, rax
jne 0x180009237
lea eax, [rsi - 2]
jmp 0x1800093f7
mov rcx, qword [0x18002a250]
xor edx, edx
add rcx, 0xb0
je 0x18000925a
cmp byte [rcx], dl
je 0x18000925a
mov rax, rcx
inc rax
inc edx
cmp byte [rax], 0
jne 0x180009250
xor r8d, r8d
call fcn.180014404
lea rdx, [rbp - 0x30]
lea ecx, [rbx + rax]
call fcn.18001bc10
mov r9d, SafeArrayGetDim
lea rax, [rbp - 0x30]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8d, [r9 - 2]
lea ecx, [r9 - 0xa]
call fcn.18000d0a4
movsxd rcx, eax
lea rdx, [0x18002423c]
mov eax, 0x2e
xor r8d, r8d
mov word [rsp + rcx*2 + 0x48], ax
mov rcx, qword [0x18002a250]
add rcx, 0x458
call fcn.18000d5c0
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x50]
mov rcx, rax
lea rdx, [0x180024194]
mov rbx, rax
call fcn.18000d5c0
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, qword [0x18002a250]
mov r9b, 2
add rdx, 0xb0
mov r8d, 2
mov rcx, r15
call fcn.180015898
mov qword [rbp + 0x9e0], rax
mov r14, rax
test rax, rax
jne 0x180009321
lea ebx, [rax - 4]
jmp 0x1800093b2
mov r8d, dword [rbp + 0x9d0]
mov rdx, rsi
mov rcx, rax
call fcn.180015c8c
test eax, eax
jns 0x18000933e
mov ebx, 0xfffffffb
jmp 0x1800093b2
lea rcx, [rbp + 0x9e0]
call fcn.1800159b8
mov rcx, qword [0x18002a250]
lea r8, [rsp + 0x50]
add rcx, 0x458
lea rdx, [0x180024194]
xor r9d, r9d
call fcn.18000d5c0
mov rdx, rax
mov qword [rbp + 0x9e8], rax
mov rcx, r15
call fcn.18000e160
mov ebx, eax
lea rcx, [rbp + 0x9e8]
mov rdx, 0xfffffffffffffffe
sar ebx, 0x1f
call fcn.18000c798
and ebx, 0xfffffff9
jne 0x1800093a7
mov ecx, 0x2deb8b96
call fcn.180008a80
jmp 0x1800093c3
test ebx, ebx
jns 0x1800093c3
mov r14, qword [rbp + 0x9e0]
test r14, r14
je 0x1800093c3
lea rcx, [rbp + 0x9e0]
call fcn.1800159b8
mov edx, dword [rbp + 0x9d0]
lea rcx, [rsp + 0x30]
call fcn.18000c798
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x38]
call fcn.18000c798
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x40]
call fcn.18000c798
mov eax, ebx
add rsp, 0xaa0
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret
Function at 0x18000c3c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov rcx, qword [0x18002ad68]
xor ebx, ebx
test rcx, rcx
je 0x18000c4b3
mov esi, 0x126
lea edx, [rbx + 8]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18000c4b3
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x31
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, str.memoirs
mov edx, 0x3ab0b4
mov ecx, 0xf2fb8
call qword [sym.imp.KERNEL32.dll_GetNumberFormatA]
test eax, eax
jne 0x18000c44c
mov eax, ebx
lea rcx, [rsp + 0x30]
inc eax
inc rcx
cmp eax, 0x25
jb 0x18000c440
jmp 0x18000c45d
mov ecx, ebx
lea rdx, [rsp + 0x30]
inc ecx
inc rdx
cmp ecx, 0x31
jb 0x18000c453
lea r8, [0x180028240]
mov r9, rdi
sub r8, rdi
movabs rax, 0x47ae147ae147ae15
mov rcx, rbx
mul rbx
mov rax, rbx
inc rbx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0x19
sub rcx, rax
lea rax, [0x180024270]
mov al, byte [rcx + rax]
xor al, byte [r8 + r9]
mov byte [r9], al
inc r9
sub rsi, 1
jne 0x18000c46a
mov rax, rdi
jmp 0x18000c4b5
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x18000cd48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov edi, dword [rcx + 0x3c]
mov r15d, edx
mov r10, rcx
mov eax, dword [rdi + rcx + 0x88]
test eax, eax
je 0x18000cdd0
lea r11, [rcx + rax]
xor esi, esi
mov ebx, dword [r11 + 0x20]
mov ebp, dword [r11 + 0x24]
add rbx, rcx
mov r14d, dword [r11 + 0x1c]
add rbp, rcx
add r14, rcx
cmp dword [r11 + 0x18], esi
jbe 0x18000cdd0
mov ecx, dword [rbx]
mov edx, 0
add rcx, r10
je 0x18000cdb2
cmp byte [rcx], dl
je 0x18000cdb2
mov rax, rcx
inc rax
inc edx
cmp byte [rax], 0
jne 0x18000cda8
xor r8d, r8d
call fcn.180014404
xor eax, 0xa235cb91
cmp eax, r15d
je 0x18000cdec
inc esi
add rbx, 4
cmp esi, dword [r11 + 0x18]
jb 0x18000cd95
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
movzx ecx, word [rbp + rsi*2]
mov ebx, dword [r14 + rcx*4]
add rbx, r10
cmp rbx, r11
jb 0x18000cea8
mov eax, dword [rdi + r10 + 0x8c]
add rax, r11
cmp rbx, rax
jae 0x18000cea8
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov rdx, rbx
lea rax, [rsp + 0x20]
sub rdx, rcx
mov cl, byte [rdx + rax]
cmp cl, 0x2e
je 0x18000ce42
test cl, cl
je 0x18000ce42
mov byte [rax], cl
inc r8d
inc rax
cmp r8d, 0x40
jb 0x18000ce28
mov sil, byte [r8 + rbx]
lea eax, [r8 + 1]
mov edi, eax
lea rcx, [rsp + 0x20]
mov byte [rsp + rax + 0x20], 0x64
lea eax, [r8 + 2]
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r8 + 3]
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r8 + 4]
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + r8 + 0x20], 0x2e
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18000cdd0
test sil, sil
lea rdx, [rdi + rbx]
mov rcx, rax
cmove rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000cdd0
jmp 0x18000cdd2
mov rax, rbx
jmp 0x18000cdd2
Function at 0x18000cf3c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r10d, r8d
lea r11, [0x180028500]
imul r9, r10, 0x21
xor ebx, ebx
mov dword [rsp + 0x60], 0xa235cb91
mov edi, edx
mov rsi, rcx
mov r8d, ebx
movzx eax, byte [r9 + r11]
test al, al
je 0x18000cfa9
lea r8, [rsp + 0x20]
mov edx, ebx
sub r9, r8
lea rcx, [rsp + 0x20]
add r11, r9
mov r8d, eax
mov r9d, eax
mov rax, rdx
inc rdx
and eax, 3
mov al, byte [rsp + rax + 0x60]
xor al, byte [r11 + rcx + 1]
mov byte [rcx], al
inc rcx
sub r9, 1
jne 0x18000cf8c
mov byte [rsp + r8 + 0x20], bl
lea rcx, [rsp + 0x20]
cmp r10d, 5
jne 0x18000cfc1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x18000cfca
mov rax, qword [0x18002a1e8]
call qword [rax]
test rax, rax
je 0x18000cfdf
mov r8, rax
mov edx, edi
mov rcx, rsi
call fcn.18000ceb0
mov rbx, rax
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x18000d9e4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r15
sub rsp, 0x90
lea rax, [rax - 0x78]
mov r10d, r9d
mov r9, qword [rsp + 0xd0]
mov r11, r8
mov qword [rsp + 0x28], rax
mov edi, edx
mov r12, rcx
xor ebx, ebx
mov dword [rax], ebx
mov r8d, r10d
mov eax, dword [rsp + 0xd8]
mov rdx, r11
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.180010f98
mov qword [rsp + 0x38], rax
mov r15, rax
test rax, rax
jne 0x18000da50
lea rax, [0x18002ac8c]
jmp 0x18000db43
mov ebp, dword [rsp + 0xe0]
mov esi, ebp
cmp ebp, edi
jae 0x18000da7b
lea r8, [r12 + rbp]
xor edx, edx
mov eax, esi
div dword [rsp + 0x30]
mov al, byte [r8]
cmp byte [rdx + r15], al
je 0x18000dabb
inc esi
inc r8
cmp esi, edi
jb 0x18000da61
xor r9d, r9d
mov dword [rsp + 0x28], 0x31
lea rax, [rsp + 0x40]
mov ecx, 0x3ac4
lea r8, str.about
mov qword [rsp + 0x20], rax
lea edx, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_GetNumberFormatA]
test eax, eax
jne 0x18000db1c
lea rax, [rsp + 0x40]
inc ebx
inc rax
cmp ebx, 0x25
jb 0x18000daaf
jmp 0x18000db2b
sub esi, ebp
je 0x18000da7b
mov rcx, qword [0x18002ad68]
test rcx, rcx
je 0x18000db09
lea r8d, [rsi + 1]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18000db09
mov r8, rax
mov r9d, esi
xor edx, edx
mov eax, ebp
div dword [rsp + 0x30]
mov al, byte [rdx + r15]
xor al, byte [rbp + r12]
inc ebp
mov byte [r8], al
inc r8
sub r9, 1
jne 0x18000dae8
jmp 0x18000db32
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.18000c798
jmp 0x18000da44
lea rcx, [rsp + 0x40]
inc ebx
inc rcx
cmp ebx, 0x31
jb 0x18000db21
lea rdi, [0x18002ac8c]
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.18000c798
mov rax, rdi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rdi
ret
Function at 0x18000db60
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rax - 0x47]
sub rsp, 0x90
lea rax, [rbp - 0x31]
mov r10d, r9d
mov r9, qword [rbp + 0x6f]
mov r11, r8
mov qword [rsp + 0x28], rax
mov edi, edx
mov eax, dword [rbp + 0x77]
mov r13, rcx
xor ebx, ebx
mov dword [rsp + 0x20], eax
mov r8d, r10d
mov dword [rbp - 0x31], ebx
mov rdx, r11
xor ecx, ecx
mov r14d, ebx
call fcn.180010f98
mov qword [rbp - 0x29], rax
mov r12, rax
test rax, rax
jne 0x18000dbcf
lea rax, [0x18002accc]
jmp 0x18000dd1b
mov esi, dword [rbp + 0x7f]
mov r8d, esi
cmp esi, edi
jae 0x18000dc01
lea r9, [rsi + r13]
xor edx, edx
mov eax, r8d
div dword [rbp - 0x31]
mov al, byte [r9]
cmp byte [rdx + r12], al
je 0x18000dbfb
inc r8d
inc r9
cmp r8d, edi
jb 0x18000dbdd
jmp 0x18000dc01
mov r14d, r8d
sub r14d, esi
mov edi, 0x31
lea rax, [rbp - 0x21]
mov dword [rsp + 0x28], edi
lea r8, str.having
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0x773
lea ecx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetNumberFormatA]
test eax, eax
jne 0x18000dc43
mov eax, ebx
lea rcx, [rbp - 0x21]
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x25
jb 0x18000dc35
jmp 0x18000dc57
mov ecx, ebx
lea rdx, [rbp - 0x21]
lea eax, [rcx + 0xa]
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, edi
jb 0x18000dc49
test r14d, r14d
je 0x18000dcbd
mov rcx, qword [0x18002ad68]
test rcx, rcx
je 0x18000dcac
lea r8d, [r14 + 1]
mov edx, 8
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18000dcac
mov r8, rax
mov r9d, r14d
xor edx, edx
mov eax, esi
div dword [rbp - 0x31]
mov al, byte [rdx + r12]
xor al, byte [rsi + r13]
inc esi
movzx eax, al
mov word [r8], ax
lea r8, [r8 + 2]
sub r9, 1
jne 0x18000dc88
jmp 0x18000dd0c
mov edx, dword [rbp - 0x31]
lea rcx, [rbp - 0x29]
call fcn.18000c798
jmp 0x18000dbc3
lea rax, [rbp - 0x21]
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, str.MjnUJbuyIOJ
mov edx, 0xc76
mov ecx, 0x8c4
call qword [sym.imp.KERNEL32.dll_GetNumberFormatA]
test eax, eax
jne 0x18000dcf8
lea rax, [rbp - 0x21]
inc ebx
inc rax
cmp ebx, 0x25
jb 0x18000dcec
jmp 0x18000dd05
lea rcx, [rbp - 0x21]
inc ebx
inc rcx
cmp ebx, edi
jb 0x18000dcfc
lea rdi, [0x18002accc]
mov edx, dword [rbp - 0x31]
lea rcx, [rbp - 0x29]
call fcn.18000c798
mov rax, rdi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
Function at 0x18000de00
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov rdi, rdx
xor r8d, r8d
lea rdx, [0x1800243a4]
mov r14d, r9d
mov r13, rcx
call fcn.18000d5c0
xor ebx, ebx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18000dffb
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x210], rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000dfea
mov r12d, dword [rbp + 0x220]
mov r15d, dword [rbp + 0x218]
cmp word [rbp - 0x74], 0x2e
jne 0x18000dea6
movzx eax, word [rbp - 0x72]
test ax, ax
je 0x18000dfc4
cmp ax, 0x2e
jne 0x18000dea6
cmp word [rbp - 0x70], bx
je 0x18000dfc4
mov eax, dword [rsp + 0x60]
test al, 0x10
je 0x18000deb6
test r14b, 2
jne 0x18000debc
jmp 0x18000df2b
test r14b, 4
je 0x18000df2b
mov r15, qword [rbp + 0x208]
mov rsi, qword [rbp + 0x200]
mov rax, qword [0x18002a260]
lea rcx, [rbp - 0x74]
mov rdx, qword [rdi]
call qword [rax + 0x30]
test eax, eax
je 0x18000df05
mov r8, r15
lea rdx, [rsp + 0x60]
mov rcx, r13
call rsi
test eax, eax
je 0x18000df10
test r12d, r12d
je 0x18000df05
mov rax, qword [0x18002a1e8]
mov ecx, r12d
call qword [rax + 0x188]
inc ebx
add rdi, 8
cmp ebx, 1
jb 0x18000deca
mov eax, dword [rsp + 0x60]
xor ebx, ebx
mov rsi, qword [rbp + 0x210]
mov r15d, dword [rbp + 0x218]
mov rdi, qword [rbp + 0x1e8]
test al, 0x10
je 0x18000dfc4
test r14b, 1
je 0x18000dfc4
xor r9d, r9d
lea r8, [rbp - 0x74]
lea rdx, [0x180024194]
mov rcx, r13
call fcn.18000d5c0
mov qword [rsp + 0x50], rax
mov rbx, rax
test rax, rax
je 0x18000dfc2
test r15d, r15d
je 0x18000df75
mov rax, qword [0x18002a1e8]
mov ecx, r15d
call qword [rax + 0x188]
mov rax, qword [rbp + 0x208]
mov r9d, r14d
mov dword [rsp + 0x40], r12d
mov r8d, 1
mov dword [rsp + 0x38], r15d
mov rdx, rdi
and qword [rsp + 0x30], 0
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x200]
mov qword [rsp + 0x20], rax
call fcn.18000de00
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x50]
call fcn.18000c798
xor ebx, ebx
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18000de82
mov rax, qword [0x18002a1e8]
mov rcx, rsi
call qword [rax + 0x108]
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x58]
call fcn.18000c798
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x18000e160
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18002a1e8]
xor r8d, r8d
mov rbp, rdx
mov rsi, rcx
xor edi, edi
call qword [rax + 0x240]
test eax, eax
jne 0x18000e248
xor edx, edx
mov word [rsp + 0x30], di
mov r8d, 0x206
lea rcx, [rsp + 0x32]
call sub.msvcrt.dll_memset
mov ecx, 0x91b
call fcn.18000ddc0
mov rcx, qword [0x18002a250]
lea edx, [rdi + 1]
add rcx, 0x668
mov qword [rsp + 0x260], rax
mov r8d, 0xf4240
mov rbx, rax
call fcn.18001bd58
mov r9, rbp
mov dword [rsp + 0x20], eax
mov r8, rbx
lea rcx, [rsp + 0x30]
mov edx, 0x103
call fcn.180010c4c
lea rcx, [rsp + 0x260]
call fcn.18000dd5c
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x18000e231
mov rax, qword [0x18002a1e8]
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [rax + 0x240]
test eax, eax
jne 0x18000e236
or edi, 0xffffffff
jmp 0x18000e258
mov rax, qword [0x18002a1e8]
mov rcx, rsi
call qword [rax + 0x238]
jmp 0x18000e258
mov rdx, qword [0x18002a1e8]
mov rcx, rsi
call qword [rdx + 0x238]
lea r11, [rsp + 0x240]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18000e274
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x260
mov edx, 0x80
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call sub.msvcrt.dll_memset
mov r8d, 0x200
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1800146a8
mov rax, qword [0x18002a1e8]
mov rcx, rbx
call qword [rax + 0x238]
test eax, eax
je 0x18000e2ce
mov eax, 1
jmp 0x18000e352
mov rcx, qword [0x18002a250]
or r8d, 0xffffffff
add rcx, 0x668
mov edx, 0xf0000000
call fcn.18001bd58
mov r9d, eax
lea r8, [0x1800243ac]
mov edx, 0x20
lea rcx, [rsp + 0x20]
call fcn.180010c4c
xor r9d, r9d
lea r8, [rsp + 0x20]
lea rdx, [0x180024380]
mov rcx, rbx
call fcn.18000d5c0
mov qword [rsp + 0x278], rax
test rax, rax
je 0x18000e350
mov rdx, rax
mov rcx, rbx
call fcn.18000e160
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x278]
mov ebx, eax
call fcn.18000c798
test ebx, ebx
jns 0x18000e2c4
xor eax, eax
add rsp, 0x260
pop rbx
ret

Function at 0x18000eee8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
mov rcx, qword [0x18002ad68]
test rcx, rcx
jne 0x18000ef07
mov eax, ebx
jmp 0x18000ef3c
mov r8d, dword [rdi]
mov edx, 8
inc r8d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18000ef3c
cmp dword [rdi], ebx
jbe 0x18000ef3c
mov ecx, ebx
and ecx, 3
mov edx, ebx
inc ebx
mov cl, byte [rcx + rdi + 0x108]
xor cl, byte [rdx + rdi + 4]
mov byte [rdx + rax], cl
cmp ebx, dword [rdi]
jb 0x18000ef21
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret