joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003210
Capabilities:
Terminate process

Disassembly:
jmp 0x18002e7d0
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1800032b0
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1800348e8
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x18009aad0]
mov ecx, 4
lea r8, [0x18009aac8]
lea rdx, str.FlsAlloc
call fcn.1800341a0
mov rbx, rax
test rax, rax
je 0x18003492b
mov rcx, rax
call fcn.180002969
mov rcx, rdi
call rbx
jmp 0x180034931
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180003576
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x180019000
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
lea r9, [rsp + 0x58]
xor eax, eax
mov dword [rsp + 0x58], 0
cmp byte [r8], al
mov rbx, r8
mov dword [rsp + 0x50], 4
setne al
xor r8d, r8d
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 0
setne cl
mov byte [rbx], cl
add rsp, 0x30
pop rbx
ret

Function at 0x180003774
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1800687e0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x18009c8c8]
mov ecx, 5
lea r8, [0x18009c8c0]
lea rdx, str.FlsGetValue
call fcn.180068010
mov rdi, rax
test rax, rax
je 0x180068822
mov rcx, rax
call qword [section..00cfg]
mov ecx, ebx
call rdi
jmp 0x18006882a
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800038a5
Capabilities:
Create thread

Disassembly:
jmp 0x18003eb7c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, edx
mov rsi, rcx
test r8, r8
jne 0x18003ebac
call fcn.180002d1f
mov dword [rax], 0x16
call fcn.180003dd7
xor eax, eax
jmp 0x18003ec2c
mov rdx, r9
mov rcx, r8
call fcn.18003e8f4
mov rbx, rax
test rax, rax
je 0x18003ebfc
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x18003e650]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
jne 0x18003ec3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800037e7
xor edi, edi
test rbx, rbx
je 0x18003ec29
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x18003ec12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18003ec21
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.180004552
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18003ec4c
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
xor ebx, ebx
jmp 0x18003ebfe

Function at 0x180003a35
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x18006884c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x18009c8d8]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 6
lea r8, [0x18009c8d0]
call fcn.180068010
mov rsi, rax
test rax, rax
je 0x180068899
mov rcx, rax
call qword [section..00cfg]
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x1800688a4
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180003b84
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x180068708
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x18009c8a8]
mov ecx, 3
lea r8, [0x18009c8a0]
lea rdx, str.FlsAlloc
call fcn.180068010
mov rbx, rax
test rax, rax
je 0x18006874c
mov rcx, rax
call qword [section..00cfg]
mov rcx, rdi
call rbx
jmp 0x180068752
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180003f53
Capabilities:
Parse pe header

Disassembly:
jmp 0x180063cd8
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x180063940

Function at 0x180004291
Capabilities:
Print debug messages

Disassembly:
jmp 0x180087ce0
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.180002f1d
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x180087d33
test rbx, rbx
je 0x180087d24
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x180087d33
mov edi, 4
jmp 0x180087ddc
call fcn.1800015af
test al, al
jne 0x180087d50
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x180087ddc
test bpl, bpl
je 0x180087db3
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x180087a98]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180087ddc
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x180087dad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180087ddc
mov edi, dword [rsp + 0x44]
jmp 0x180087da5
call fcn.180004124
test al, al
jne 0x180087dc4
bts esi, 0x15
xor ecx, ecx
jmp 0x180087dcc
call fcn.1800020f4
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.180003616
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret

Function at 0x18000435e
Capabilities:
Delete registry key

Disassembly:
jmp 0x18002ac60
sub rsp, 0x298
mov rax, qword [0x1800b75c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x258
call fcn.180002d29
lea rdx, str._shellexContextMenuHandlersQYMenu64
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, str.88B30659_E446_4019_A63B_3B07426E782F
lea rdx, str.CLSID_sInprocServer32
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, str.88B30659_E446_4019_A63B_3B07426E782F
lea rdx, str.CLSID_sSettings
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, str.88B30659_E446_4019_A63B_3B07426E782F
lea rdx, str.CLSID_s
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18000411a
add rsp, 0x298
ret
Function at 0x180004642
Capabilities:
Delete file

Disassembly:
jmp 0x180014e10
push rbx
sub rsp, 0x20
cmp byte [rcx], 0
mov rbx, rcx
jne 0x180014e26
mov al, 1
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rdi
mov rdi, qword [rcx + 8]
mov rcx, rdi
call fcn.18000386e
cmp eax, 0xffffffff
je 0x180014e68
test al, 0x10
jne 0x180014e68
test al, 1
je 0x180014e68
and eax, 0xfffffffe
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x180014e68
mov rdi, qword [rsp + 0x30]
xor al, 1
mov byte [rbx], al
sete al
add rsp, 0x20
pop rbx
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdi, qword [rsp + 0x30]
test eax, eax
setne al
xor al, 1
mov byte [rbx], al
sete al
add rsp, 0x20
pop rbx
ret

Function at 0x18000483b
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x180018b00
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rsi, r8
mov rdi, rdx
mov r15, rcx
mov rcx, r8
call fcn.180001406
xor r12d, r12d
mov r14d, r12d
mov qword [rsp + 0x40], r12
mov ebp, r12d
mov qword [rsp + 0x48], r12
mov dword [rsp + 0xa8], r12d
mov dword [rsp + 0x90], r12d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xa8]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x180018b89
cmp eax, 0xea
jne 0x180018bdd
mov ebx, dword [rsp + 0x90]
test rbx, rbx
je 0x180018bb0
mov qword [rsp + 0x48], r12
mov ecx, ebx
call fcn.180002da6
mov r14, rax
mov qword [rsp + 0x40], rax
mov ebp, ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x30], r12d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x180018c93
mov eax, dword [rsp + 0x90]
mov edi, eax
cmp rax, rbp
ja 0x180018bf7
test al, 1
je 0x180018c01
mov ebx, 0x80004005
jmp 0x180018c93
lea rcx, [rsp + 0x50]
call fcn.180001c44
nop
shr rdi, 1
je 0x180018c85
mov rax, r12
mov ebx, 2
nop dword [rax]
cmp word [r14 + rbx - 2], 0
jne 0x180018c7b
lea rdx, [rax + r14]
lea rcx, [rsp + 0x50]
call fcn.1800034b8
mov ecx, 0x10
call fcn.180001c85
mov qword [rsp + 0xa8], rax
test rax, rax
je 0x180018c60
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.180003e18
mov rbp, rax
jmp 0x180018c63
mov rbp, r12
mov rcx, rsi
call fcn.1800021ad
mov ecx, dword [rsi + 8]
mov rax, qword [rsi]
mov qword [rax + rcx*8], rbp
inc dword [rsi + 8]
mov rax, rbx
add rbx, 2
sub rdi, 1
jne 0x180018c20
mov ebx, r12d
mov rcx, qword [rsp + 0x50]
call fcn.180001316
nop
mov rcx, r14
call fcn.180001316
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180004877
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
jmp 0x1800190f0
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1800b75c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
lea rax, [rsp + 0x50]
mov rcx, qword [rcx]
xor ebp, ebp
mov r9d, 0x2001f
mov qword [rsp + 0x48], rbp
xor r8d, r8d
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x20], rax
mov rsi, rdx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x180019224
mov rcx, qword [rsp + 0x48]
mov ebx, ebp
test rcx, rcx
je 0x18001915d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x48], rcx
test ebx, ebx
jne 0x180019224
lea rax, [rsp + 0x58]
mov dword [rsp + 0x40], 0x105
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180019201
nop word [rax + rax]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.180004877
mov ebx, eax
test eax, eax
jne 0x180019224
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x40], 0x105
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1800191b0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180019216
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180019234
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18000411a
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x180008844
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1800b75c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x38]
mov rdi, rcx
lea rdx, str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x180008950
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov esi, 0x104
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x180008941
cmp dword [rsp + 0x30], 2
mov byte [rsp + 0x143], bl
jne 0x180008905
lea rcx, [rsp + 0x40]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
cmp eax, 0x103
setbe bl
jmp 0x180008941
lea rdx, [rsp + 0x40]
mov ecx, ebx
sub rdx, rdi
lea rax, [rsi + 0x7ffffefa]
cmp rax, rbx
je 0x18000892d
mov al, byte [rdx + rdi]
cmp al, bl
je 0x18000892d
mov byte [rdi], al
inc rdi
sub rsi, 1
jne 0x18000890f
cmp rsi, rbx
jne 0x18000893a
dec rdi
mov ecx, 0x8007007a
cmp ecx, ebx
mov byte [rdi], bl
setge bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x180008952
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18000411a
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180014350
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x180014372
mov al, 1
jmp 0x1800143c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180014383
xor al, al
jmp 0x1800143c4
lea rcx, [rsp + 0x28]
call fcn.18000216c
lea rcx, [rsp + 0x50]
call fcn.180001c44
nop
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180003562
test al, al
jne 0x1800143ad
xor bl, bl
jmp 0x1800143b7
mov ebx, dword [rsp + 0x48]
shr ebx, 4
and bl, 1
mov rcx, qword [rsp + 0x50]
call fcn.180001316
movzx eax, bl
add rsp, 0x60
pop rbx
ret
Function at 0x180014550
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1800b75c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, r9
mov rsi, r8
movzx ebp, dl
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ebx, [rax*4]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor edi, ebx
shl edi, 0xc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
xor ebx, edi
xor r12d, r12d
mov edi, r12d
lea r13d, [r12 + 0x2e]
nop
mov rdx, r15
mov rcx, rsi
call fcn.1800034b8
test bpl, bpl
je 0x1800146de
mov ecx, ebx
mov eax, ebx
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x1800145d8
add ecx, 0x30
jmp 0x1800145db
add ecx, 0x37
mov word [rsp + 0x20], cx
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x1800145f2
add ecx, 0x30
jmp 0x1800145f5
add ecx, 0x37
mov word [rsp + 0x22], cx
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x18001460c
add ecx, 0x30
jmp 0x18001460f
add ecx, 0x37
mov word [rsp + 0x24], cx
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x180014626
add ecx, 0x30
jmp 0x180014629
add ecx, 0x37
mov word [rsp + 0x26], cx
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x180014640
add ecx, 0x30
jmp 0x180014643
add ecx, 0x37
mov word [rsp + 0x28], cx
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x18001465a
add ecx, 0x30
jmp 0x18001465d
add ecx, 0x37
mov word [rsp + 0x2a], cx
mov ecx, eax
and ecx, 0xf
shr eax, 4
cmp ecx, 0xa
jae 0x180014674
add ecx, 0x30
jmp 0x180014677
add ecx, 0x37
mov word [rsp + 0x2c], cx
cmp eax, 0xa
jae 0x180014686
add eax, 0x30
jmp 0x180014689
add eax, 0x37
mov word [rsp + 0x2e], ax
mov word [rsp + 0x30], r12w
test r14, r14
je 0x1800146be
mov eax, dword [rsi + 8]
cmp dword [rsi + 0xc], eax
jne 0x1800146a9
mov rcx, rsi
call fcn.180004020
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
mov word [rcx + rdx*2], r13w
inc edx
mov word [rcx + rdx*2], r12w
mov dword [rsi + 8], edx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800025bd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 2
mov ecx, 1
cmove eax, ecx
add ebx, eax
mov bpl, 1
test r14, r14
je 0x1800146f5
lea rdx, str..tmp
mov rcx, rsi
call fcn.1800025bd
mov rcx, qword [rsi]
call fcn.180001ea6
test al, al
je 0x18001470e
mov ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180014746
test r14, r14
je 0x180014725
mov rdx, qword [rsi]
xor r8d, r8d
mov rcx, r14
call fcn.1800045f2
test al, al
jmp 0x180014732
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180014760
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x180014746
cmp eax, 0xb7
jne 0x180014751
inc edi
cmp edi, 0x64
jb 0x1800145b0
mov rax, qword [rsi]
mov dword [rsi + 8], r12d
mov word [rax], r12w
xor al, al
jmp 0x180014762
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18000411a
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180014e10
Capabilities:
Delete file
Set file attributes

Disassembly:
jmp 0x180014e10
push rbx
sub rsp, 0x20
cmp byte [rcx], 0
mov rbx, rcx
jne 0x180014e26
mov al, 1
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rdi
mov rdi, qword [rcx + 8]
mov rcx, rdi
call fcn.18000386e
cmp eax, 0xffffffff
je 0x180014e68
test al, 0x10
jne 0x180014e68
test al, 1
je 0x180014e68
and eax, 0xfffffffe
mov rcx, rdi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x180014e68
mov rdi, qword [rsp + 0x30]
xor al, 1
mov byte [rbx], al
sete al
add rsp, 0x20
pop rbx
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdi, qword [rsp + 0x30]
test eax, eax
setne al
xor al, 1
mov byte [rbx], al
sete al
add rsp, 0x20
pop rbx
ret
Function at 0x180015fd0
Capabilities:
Get file attributes

Disassembly:
jmp 0x180015fd0
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800165e0
Capabilities:
Get file size

Disassembly:
jmp 0x1800165e0
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [rcx]
mov rdi, rdx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x180016619
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x180016619
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rsp + 0x30]
mov rax, rbx
shl rcx, 0x20
mov al, 1
add rcx, rbx
mov rbx, qword [rsp + 0x38]
mov qword [rdi], rcx
add rsp, 0x20
pop rdi
ret

Function at 0x180016980
Capabilities:
Read file on windows

Disassembly:
jmp 0x180016980
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov rsi, r9
mov dword [r9], ebp
mov ebx, r8d
mov rdi, rdx
mov r14, rcx
nop dword [rax]
nop word [rax + rax]
cmp ebx, dword [0x1800b700c]
lea r9, [rsp + 0x60]
mov rcx, qword [r14]
mov r8d, ebx
cmova r8d, dword [0x1800b700c]
mov rdx, rdi
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x60]
add dword [rsi], ecx
test eax, eax
je 0x1800169f6
test ecx, ecx
je 0x1800169f2
add rdi, rcx
mov eax, ecx
sub ebx, ecx
jne 0x1800169b0
mov al, 1
jmp 0x1800169f8
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180018410
Capabilities:
Create process on windows

Disassembly:
jmp 0x180018410
mov rax, rsp
push r14
sub rsp, 0x120
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r9
mov rbp, r8
mov r14, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebx, ebx
test rcx, rcx
je 0x180018458
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x180018458
mov qword [rdi], rbx
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.18000109b
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x88]
call fcn.1800185f0
nop
mov r8d, 0x20
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1800012e4
nop
mov r8, rbp
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1800042aa
nop
mov rcx, qword [rsp + 0x78]
call fcn.180001316
nop
mov rcx, qword [rsp + 0x88]
call fcn.180001316
nop
mov rcx, qword [rsp + 0x50]
call fcn.180001316
mov dword [rsp + 0xb0], 0x68
mov qword [rsp + 0xb8], rbx
xorps xmm0, xmm0
movdqa xmmword [rsp + 0xc0], xmm0
mov dword [rsp + 0xec], ebx
mov word [rsp + 0xf2], bx
mov qword [rsp + 0xf8], rbx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x180018544
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18001855d
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x98]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x60]
call fcn.180001316
mov eax, ebx
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret