joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180052ab0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
movaps xmmword [rax - 0x28], xmm6
xor r14d, r14d
cmp byte [0x1800d1863], r14b
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
je 0x180052cd6
mov rax, qword [0x1800d2060]
test rax, rax
jne 0x180052b91
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov r10, rbx
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180052b76
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x180052b76
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rax, [rsi + rdx*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x180052b72
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x180052b4f
cmp r11d, 0x95466b05
je 0x180052c0b
test edx, edx
jne 0x180052b33
mov rax, qword [r10]
mov r10, rax
cmp rax, rbx
je 0x180052b87
cmp qword [rax + 0x30], r14
jne 0x180052b0f
mov rax, r14
mov qword [0x1800d2060], rax
mov ecx, dword [0x1800d0444]
call rax
test ax, ax
jns 0x180052cd6
call fcn.18004d014
mov rbx, rax
test rax, rax
je 0x180052cd6
cmp dword [0x1800d0470], 1
jne 0x180052cd6
movss xmm9, dword [0x1800d1430]
lea rcx, [rbp - 0x50]
movss xmm6, dword [0x1800d1434]
xor r8d, r8d
mulss xmm9, dword [0x180059b1c]
mov rdx, rax
mulss xmm6, dword [0x180059b1c]
call fcn.18004ccd4
mov ecx, dword [0x1800d1874]
sub ecx, 1
je 0x180052c30
sub ecx, 1
je 0x180052c28
cmp ecx, 1
jne 0x180052c42
mov r8d, ecx
jmp 0x180052c36
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x180052b8a
mov r8d, 8
jmp 0x180052c36
mov r8d, 7
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.18004ccd4
movsd xmm8, qword [rbp - 0x50]
lea rdx, [rbp - 0x50]
mov ebx, dword [rbp - 0x48]
lea rcx, [rbp + 0x20]
movsd qword [rbp - 0x50], xmm8
mov dword [rbp - 0x48], ebx
call fcn.180052084
movss xmm0, dword [rbp + 0x24]
cvtps2pd xmm1, xmm6
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movsd xmm1, qword [0x180061898]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movsd xmm1, qword [0x180061898]
movaps xmm7, xmm0
movss xmm0, dword [rbp + 0x20]
cvtps2pd xmm0, xmm0
cvtps2pd xmm2, xmm9
subsd xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm7, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
mov eax, dword [0x1800d0448]
lea ecx, [rax + rax*4]
add ecx, ecx
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x180052cd6
lea rcx, [rbp - 0x50]
movsd qword [rbp - 0x50], xmm8
mov dword [rbp - 0x48], ebx
call fcn.18004c8f8
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180053580
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x1800d13c0]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800536ef
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1800536ef
mov eax, dword [0x1800d13fc]
mov rdx, qword [rax + rcx]
test rdx, rdx
je 0x1800536ef
cmp qword [rcx + 0x30], 0
je 0x1800536ef
mov rax, qword [0x1800d13c8]
mov r8, qword [rax]
test r8, r8
je 0x1800536ef
cmp qword [r8 + 0x10], 0
je 0x1800536ef
cmp byte [0x1800d18dc], 0
je 0x180053617
cmp byte [0x1800d1429], 0
movss xmm0, dword [0x1800d0710]
je 0x18005360f
movss dword [rdx + 0xd40], xmm0
jmp 0x180053617
movss dword [rdx + 0xcf0], xmm0
mov eax, dword [0x1800d1420]
cmp byte [rax + rcx], 0x40
je 0x1800536ef
movss xmm0, dword [0x18005b8a8]
comiss xmm0, dword [rcx + 0x280]
ja 0x1800536ef
mov rax, qword [0x1800d2060]
test rax, rax
jne 0x1800536e1
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800536c6
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x1800536c6
mov esi, dword [r9 + 0x20]
dec ecx
mov ebx, 0x811c9dc5
mov edi, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x1800536c2
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x1800536a5
cmp ebx, 0x95466b05
je 0x1800536ff
test ecx, ecx
jne 0x180053687
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x1800536d8
cmp qword [rax + 0x30], 0
jne 0x180053663
xor eax, eax
mov qword [0x1800d2060], rax
mov ecx, 0xa0
call rax
mov byte [0x1800d1900], 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x1800536da
Function at 0x1800562a4
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1800d07c0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x18005620c]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x18005631b
mov qword [rsp + 0x20], 0xc8
lea rdx, [rsp + 0x30]
lea rcx, [0x18005620c]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.180047e2c
mov rcx, rax
call fcn.180048098
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1800562e8
mov r8d, 0x80
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800568e0
add rsp, 0xd8
ret
Function at 0x180001030
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x18004d080]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, r8
mov rbx, rdx
lea rcx, [rsp + 0x52]
xor esi, esi
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x50], si
call fcn.180023da0
lea r8, str.softwareTECOcular.3_agentdebug
lea rdx, str._s_s
lea rcx, [rsp + 0x50]
mov r9, rbx
call fcn.180001240
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x38], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1800010cd
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18000110e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180021890
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180001140
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
lea r8, [rsp + 0x38]
xor ebx, ebx
mov rcx, 0xffffffff80000002
mov rsi, rdx
mov qword [rsp + 0x38], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x18000118f
lea r8, [rsp + 0x38]
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180001229
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x68]
cmp r11d, 2
jb 0x18000121e
add r11d, 2
mov eax, 2
mov dword [rsp + 0x68], r11d
shr r11d, 1
mov ecx, r11d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.18000fb64
mov rbx, rax
test rax, rax
je 0x18000121e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180001860
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x180001893
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1800018d7
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x1800018d2
cmp rbx, r11
jae 0x1800018d7
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x1800018c0
cmp rbx, r11
jb 0x1800018db
xor eax, eax
jmp 0x1800018e7
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180003a00
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov rbx, rcx
lea rdx, [rcx + 8]
mov r8d, 1
lea rcx, [rsp + 0x38]
call fcn.180010994
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
test eax, eax
je 0x180003a8f
test rsi, rsi
je 0x180003a8f
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r11d, r11d
mov dword [rsp + 0x60], r11d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x60]
mov rdx, rsi
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [rsp + 0x38]
call fcn.180010958
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x180005200
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
jne 0x180005269
lea rax, [rcx + 8]
mov r9, rcx
lea r8, [0x180005320]
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call fcn.180022874
mov qword [rbx + 0x10], rax
test rax, rax
je 0x180005269
mov edx, dword [rbx + 0x38]
mov dword [rbx + 0x18], 1
test edx, edx
je 0x180005254
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x180005280
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
jne 0x180005298
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [rbx + 0x28]
mov r9d, dword [rbx + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
lea ecx, [r8 + 2]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x1800052e4
mov edx, dword [rbx + 0x34]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1800052e9
jmp 0x1800052f5
cmp eax, 1
je 0x1800052f5
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [rbx + 0x18], 0
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180008270
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [rbx + 0x556c], 0
mov edi, eax
je 0x180008416
mov eax, dword [rbx + 0x5570]
cmp edi, eax
jb 0x1800082a9
add eax, 0x3e8
cmp edi, eax
jbe 0x180008416
mov ecx, dword [rbx + 0x5580]
cmp edi, ecx
jb 0x1800082c1
lea eax, [rcx + 0x1f4]
cmp eax, edi
jae 0x180008416
cmp edi, ecx
jae 0x1800082cc
mov edi, 0x1f4
jmp 0x1800082ce
sub edi, ecx
mov edx, dword [rbx + 0x5568]
imul edx, edi
add rdx, qword [rbx + 0x5560]
cmp rdx, qword [rbx + 0x5558]
jge 0x180008416
mov rax, qword [rbx + 0x5540]
mov qword [rbx + 0x5560], rdx
mov qword [rsp + 0x60], rbp
mov rbp, qword [rbx + 0x5548]
add rax, rdx
mov qword [rsp + 0x68], rsi
imul rax, rax, 0xffff
cqo
idiv rbp
cmp dword [0x180054458], 0
mov rsi, rax
je 0x180008350
mov ecx, dword [rbx + 0x5534]
lea r9, str.CIFOCMS::SetProgressBarPos__nPos_:__d__m_dwCurrentPos_:__d_
lea r8, str.ifocms
mov dword [rsp + 0x28], ecx
lea rcx, [0x180054358]
or edx, 0xffffffff
mov dword [rsp + 0x20], eax
call fcn.180004760
cmp esi, 0xffffffff
jne 0x18000837e
inc dword [rbx + 0x5534]
mov rcx, qword [rbx + 0x240]
test rcx, rcx
je 0x1800083a9
movsxd r8, dword [rbx + 0x5534]
xor r9d, r9d
mov edx, 0x46a
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1800083a9
cmp esi, dword [rbx + 0x5534]
je 0x1800083a9
mov dword [rbx + 0x5534], esi
mov rcx, qword [rbx + 0x240]
test rcx, rcx
je 0x1800083a9
movsxd r8, esi
xor r9d, r9d
mov edx, 0x46a
call qword [sym.imp.USER32.dll_SendMessageW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x5580], eax
cmp dword [0x180054458], 0
je 0x18000840c
mov rax, qword [rbx + 0x5560]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x38], rbp
add rax, qword [rbx + 0x5540]
lea r9, str.LoadFackBar__m_dwSecondsSize_:__d___dwTickCount_:__d____I64u__I64u____d_
lea r8, str.ifocms
lea rcx, [0x180054358]
or edx, 0xffffffff
imul rax, rax, 0xffff
mov qword [rsp + 0x30], rax
mov eax, dword [rbx + 0x5568]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.180004760
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov eax, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180008430
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x258
mov rax, qword [0x18004d080]
xor rax, rsp
mov qword [rsp + 0x240], rax
test rdx, rdx
jne 0x180008468
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180021890
add rsp, 0x258
ret
movabs rax, 0x5c003a0041
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x20], rax
movzx eax, word [rdx]
mov qword [rsp + 0x250], rdi
mov word [rsp + 0x20], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
movzx ebx, word [rsp + 0x20]
mov edi, eax
cmp bx, 0x41
je 0x1800084b9
cmp bx, 0x42
je 0x1800084b9
cmp bx, 0x61
je 0x1800084b9
cmp bx, 0x62
jne 0x18000852d
xor eax, eax
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], ax
call fcn.180023da0
mov eax, dword [0x18003fde4]
lea r11, [rsp + 0x28]
mov dword [r11], eax
movzx eax, word [0x18003fde8]
lea rdx, [rsp + 0x30]
mov word [r11 + 4], ax
lea rcx, [rsp + 0x28]
mov r8d, 0x104
mov word [rsp + 0x28], bx
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea rcx, [rsp + 0x30]
call fcn.180034aa4
lea rdx, str.floppy
lea rcx, [rsp + 0x30]
call fcn.180022004
mov ecx, 2
test rax, rax
cmovne edi, ecx
mov rbx, qword [rsp + 0x260]
mov eax, edi
mov rdi, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180021890
add rsp, 0x258
ret
Function at 0x180009720
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x18004d080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
test rcx, rcx
jne 0x18000974a
xor eax, eax
jmp 0x180009901
mov qword [rsp + 0x2a8], rdi
lea rcx, [rsp + 0x52]
mov qword [rsp + 0x278], r12
xor r12d, r12d
xor edx, edx
mov r8d, 0x20a
mov word [rsp + 0x50], r12w
call fcn.180023da0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jae 0x1800098f1
mov r8d, ecx
lea rcx, [rsp + 0x50]
mov rdx, rbx
mov qword [rsp + 0x270], r13
call fcn.180021fbc
mov r13d, 0x5c
lea rcx, [rsp + 0x50]
mov edx, r13d
call fcn.18002209c
test rax, rax
je 0x1800098e9
mov word [rax], r12w
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x298], rbp
lea rdi, [rsp + 0x50]
xor eax, eax
mov qword [rsp + 0x2a0], rsi
repne scasw ax, word [rdi]
mov esi, r12d
mov edi, r12d
not rcx
lea rbp, [rcx - 1]
lea rcx, [rsp + 0x50]
call fcn.180002940
mov ebx, 1
test eax, eax
jne 0x18000984d
xor eax, eax
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x50]
xor edx, edx
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x18000984d
cmp dword [rsp + 0x20], 0xffffffff
jne 0x180009867
lea rcx, [rsp + 0x50]
mov edx, r13d
inc edi
call fcn.18002209c
test rax, rax
je 0x180009869
mov word [rax], r12w
jmp 0x1800097f6
mov esi, ebx
test edi, edi
je 0x1800098d7
test esi, esi
je 0x1800098d7
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, ebp
jae 0x1800098d3
nop dword [rax]
lea eax, [rcx + 1]
cmp word [rsp + rax*2 + 0x50], r12w
je 0x1800098d3
mov eax, ecx
lea rcx, [rsp + 0x50]
xor edx, edx
mov word [rsp + rax*2 + 0x50], r13w
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1800098d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, ebp
jb 0x180009890
mov eax, ebx
jmp 0x1800098d9
mov ebx, r12d
mov eax, ebx
jmp 0x1800098d9
xor eax, eax
mov rbp, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x2a0]
mov r13, qword [rsp + 0x270]
mov rdi, qword [rsp + 0x2a8]
mov r12, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180021890
add rsp, 0x280
pop rbx
ret
Function at 0x180009e40
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rax, rdx
mov rbx, rcx
mov edi, ebp
test rcx, rcx
je 0x180009faa
cmp dword [0x180054344], ebp
jne 0x180009faa
cmp dword [rcx + 0x18], ebp
jne 0x180009faa
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180009fa5
xor eax, eax
lea rdx, [rsp + 0x54]
mov rcx, rsi
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], eax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rsi
mov dword [rsp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x180054458], ebp
je 0x180009f07
mov rax, qword [rsp + 0x50]
lea r9, str.SetProgressBarPos__1___d_
lea r8, str.ifocms
lea rcx, [0x180054358]
or edx, 0xffffffff
mov qword [rsp + 0x20], rax
call fcn.180004760
mov rax, qword [rsp + 0x50]
mov r8, qword [rbx + 0x5548]
mov rcx, rax
sub rcx, qword [rbx + 0x5538]
mov qword [rbx + 0x5538], rax
add qword [rbx + 0x5540], rcx
mov rdx, qword [rbx + 0x5540]
test r8, r8
jle 0x180009fa0
test rcx, rcx
jne 0x180009f58
imul rdx, rdx, 0xffff
mov rcx, rbx
mov rax, rdx
cqo
idiv r8
mov rdx, rax
call fcn.180007990
jmp 0x180009fa0
mov rcx, qword [rbx + 0x5578]
add rcx, qword [rbx + 0x5560]
cmp rcx, rax
jg 0x180009f9a
imul rdx, rdx, 0xffff
mov rcx, rbx
mov rax, rdx
cqo
idiv r8
mov rdx, rax
call fcn.180007990
mov qword [rbx + 0x5560], rbp
mov qword [rbx + 0x5558], rbp
mov qword [rbx + 0x5578], rbp
mov dword [rbx + 0x556c], ebp
mov edi, 1
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov dword [0x180054344], ebp
mov rbp, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x180009fd0
Capabilities:
Get disk size
Get file size

Disassembly:
mov r11, rsp
push rbx
push rsi
sub rsp, 0x278
mov rax, qword [0x18004d080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
mov ebx, 1
test rcx, rcx
je 0x18000a0fd
test rdx, rdx
je 0x18000a0fd
mov qword [r11 + 0x18], rbp
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov r8d, ebx
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov qword [r11 - 0x18], rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000a0ed
xor eax, eax
lea rdx, [rsp + 0x44]
mov rcx, rdi
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp qword [rsp + 0x40], rbp
je 0x18000a0e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], bp
call fcn.180023da0
lea rcx, [rsp + 0x50]
mov r8d, 0x103
mov rdx, rsi
call fcn.180021fbc
lea edx, [rbx + 0x5b]
lea rcx, [rsp + 0x50]
call fcn.18002209c
test rax, rax
je 0x18000a0b0
mov word [rax], bp
xor eax, eax
lea r9, [rsp + 0x48]
lea rcx, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov r11, qword [rsp + 0x48]
test r11, r11
je 0x18000a0ed
cmp qword [rsp + 0x40], r11
jb 0x18000a0ed
mov ebx, ebp
jmp 0x18000a0ed
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x270]
mov rbp, qword [rsp + 0x2a0]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180021890
add rsp, 0x278
pop rsi
pop rbx
ret