joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013298
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
movups xmm0, xmmword [r8]
mov r14, rcx
xor edi, edi
lea rcx, [rbp + 0x38]
mov qword [rbp - 0x20], rdi
movdqu xmmword [rbp - 0x10], xmm0
mov rbx, rdx
mov qword [rbp - 0x18], rdi
call fcn.140015c8c
mov edx, 0x1800
lea rcx, [rbp + 0x38]
call fcn.140015f1c
mov rsi, rax
test rax, rax
je 0x140013338
lea rax, [rbp + 0x30]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea r8d, [rdi + 2]
lea rdx, [rbp - 0x10]
mov dword [rsp + 0x20], 0x1800
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x140013338
movsxd rbx, dword [rsi + 8]
test ebx, ebx
js 0x140013326
lea edx, [rbx + rbx]
lea rcx, [rbp - 0x20]
call fcn.140004194
mov rdi, qword [rbp - 0x20]
mov r8, rbx
mov dword [rbp - 0x18], ebx
lea rdx, [rsi + 0xc]
mov rcx, rdi
call fcn.14001b680
movups xmm0, xmmword [rbp - 0x20]
lea rcx, [rbp + 0x38]
movdqu xmmword [r14], xmm0
call fcn.140015cac
mov rbx, qword [rsp + 0x70]
mov rax, r14
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret

Function at 0x140016178
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
cmp byte [0x140028a80], dil
jne 0x140016240
mov word [rsp + 0x30], di
lea rcx, [0x140028ac0]
mov dword [rsp + 0x28], 0x6e616d65
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0x218
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], di
lea rcx, [0x140028b40]
mov dword [rsp + 0x28], 0x6e616d65
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0x418
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], di
lea rcx, [0x140028bc0]
mov dword [rsp + 0x28], 0x6e616d65
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0x818
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov word [rsp + 0x30], di
lea rcx, [0x140028c40]
mov dword [rsp + 0x28], 0x6e616d65
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0x1018
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExInitializeNPagedLookasideList]
mov byte [0x140028a80], 1
add rsp, 0x40
pop rdi
ret

Function at 0x14001724c
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x140027350]
xor rax, rsp
mov qword [rsp + 0x90], rax
and dword [rsp + 0x20], 0
mov rbx, rcx
and dword [rsp + 0x24], 0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
call fcn.140017cf8
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.1400173b0
movups xmm0, xmmword [rsp + 0x80]
mov rax, rbx
movdqu xmmword [rbx], xmm0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14001b600
add rsp, 0xa0
pop rbx
ret
Function at 0x1400038f4
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 5]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 5
jb 0x1400038fa
mov rax, rcx
ret

Function at 0x140003910
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x4a]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0x25
jb 0x140003916
mov rax, rcx
ret

Function at 0x140003934
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 8]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 4
jb 0x14000393a
mov rax, rcx
ret
Function at 0x2fc4c6410
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4c6e12
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4e9108]
test eax, eax
je 0x2fc4c6eaa
lea rax, [0x2fc4e90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4e9110]
mov qword [rbp - 8], rax
jmp 0x2fc4c6e8e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c6e82
cmp qword [rbp - 0x10], 0
je 0x2fc4c6e82
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c6e48
lea rax, [0x2fc4e90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c6eab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c6fb0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c6fd8
mov eax, 0
jmp 0x2fc4c7026
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c7001
mov eax, 0
jmp 0x2fc4c7026
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c7021
mov eax, 0
jmp 0x2fc4c7026
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c702c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c70aa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c70a1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c70a1
mov rax, qword [rbp - 8]
jmp 0x2fc4c70bf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c7074
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c5e10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4c6812
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4e9108]
test eax, eax
je 0x2fc4c68aa
lea rax, [0x2fc4e90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4e9110]
mov qword [rbp - 8], rax
jmp 0x2fc4c688e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4c6882
cmp qword [rbp - 0x10], 0
je 0x2fc4c6882
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4c6848
lea rax, [0x2fc4e90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4c68ab
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4c69b0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4c69d8
mov eax, 0
jmp 0x2fc4c6a26
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4c6a01
mov eax, 0
jmp 0x2fc4c6a26
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4c6a21
mov eax, 0
jmp 0x2fc4c6a26
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4c6a2c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4c6aaa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4c6aa1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4c6aa1
mov rax, qword [rbp - 8]
jmp 0x2fc4c6abf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4c6a74
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000c008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x14000c008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14000c008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000c008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x180001e90
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x58
mov rax, qword [0x18006f080]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180001f4a
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, [0x18005b650]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x180001ef9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180024b70
add rsp, 0x58
ret
xor eax, eax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x180001ee1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x80000000
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180024b70
add rsp, 0x58
ret

Function at 0x180007800
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x18006f080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x28], 0x101
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1800078bd
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.18001a5c0
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x30]
cmova rdx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.18001d5b0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1800078e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800078b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007901
call fcn.180024bcc
jmp 0x1800078e5
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
xor r8d, r8d
lea rdx, [0x18005b648]
mov rcx, rbx
call fcn.180006470
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180024b70
add rsp, 0x270
pop rbx
ret
call fcn.18002bd24
int3
Function at 0x180007910
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x18006f080]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x28], 0x10
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x1800079cf
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.18001a5c0
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x30]
cmova rdx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.18001d5b0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1800079f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800079c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007a10
call fcn.180024bcc
jmp 0x1800079f7
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
xor r8d, r8d
lea rdx, [0x18005b648]
mov rcx, rbx
call fcn.180006470
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180024b70
add rsp, 0x80
pop rbx
ret
call fcn.18002bd24
int3
Function at 0x1800080e0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x18006f080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor r15d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebp, eax
xorps xmm0, xmm0
test eax, eax
jne 0x180008147
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
xor r8d, r8d
lea rdx, [0x18005b648]
mov rcx, rsi
call fcn.180006470
jmp 0x180008233
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
lea r14, [rbp*2]
cmp r14, 0x1000
jb 0x18000818c
lea rcx, [r14 + 0x27]
cmp rcx, r14
jbe 0x180008333
call fcn.180024b90
test rax, rax
je 0x18000832d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800081a1
test r14, r14
je 0x18000819e
mov rcx, r14
call fcn.180024b90
mov rdi, rax
jmp 0x1800081a1
mov rdi, r15
mov qword [rsp + 0x50], rdi
lea rbx, [r14 + rdi]
mov qword [rsp + 0x60], rbx
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.18004ae20
mov qword [rsp + 0x58], rbx
mov rdx, rdi
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x18000825d
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
xor r8d, r8d
lea rdx, [0x18005b648]
mov rcx, rsi
call fcn.180006470
nop
test rdi, rdi
je 0x180008233
sub rbx, rdi
sar rbx, 1
add rbx, rbx
mov rax, rdi
cmp rbx, 0x1000
jb 0x180008228
add rbx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000832d
mov rdx, rbx
mov rcx, rdi
call fcn.180024bcc
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180024b70
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.18001a5c0
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x30]
cmova rdx, qword [rsp + 0x30]
mov rcx, rsi
call fcn.18001d5b0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1800082d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800082d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008327
call fcn.180024bcc
movdqa xmm0, xmmword [0x180064c10]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r15w
test rdi, rdi
je 0x180008233
sub rbx, rdi
sar rbx, 1
add rbx, rbx
mov rax, rdi
cmp rbx, 0x1000
jb 0x180008228
add rbx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000832d
jmp 0x180008228
call fcn.18002bd24
nop
call fcn.18002bd24
int3
call fcn.180001280
int3
Function at 0x180008b50
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
lea rcx, [rsp + 0x50]
call fcn.180007910
nop
cmp qword [rax + 0x18], 0xf
jbe 0x180008b74
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x180008b92
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180006470
nop
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r8, qword [rsp + 0x30]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, dword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
lea rcx, [rdi + 1]
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.18002520c
mov rbx, rax
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r8, qword [rsp + 0x30]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rbx + rdi*2], si
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x180008c6a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008c65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008d12
call fcn.180024bcc
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x180008cb6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008cb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008d0c
call fcn.180024bcc
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180008cf8
test rbx, rbx
je 0x180008ce4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov al, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.18002bd24
nop
call fcn.18002bd24
nop
int3
Function at 0x180008e40
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov dword [rsp + 0x30], esi
cmp qword [rcx + 0x18], 0xf
jbe 0x180008e5f
mov rcx, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rcx + r8], sil
jne 0x180008e80
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.180006470
nop
mov dword [rsp + 0x30], 1
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, dword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
lea rcx, [rdi + 1]
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.18002520c
mov rbx, rax
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rbx + rdi*2], si
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180008f33
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180008f33
xor bl, bl
jmp 0x180008f35
mov bl, 1
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x180008f6e
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008f69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008f86
call fcn.180024bcc
test bl, bl
setne al
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
call fcn.18002bd24
int3

Function at 0x180008f90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0xf
jbe 0x180008f9e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180008fb3
shr eax, 4
and al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret