joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001ab10
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x11a0]
mov eax, 0x12a0
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x1180], rax
xor edi, edi
mov r13d, r9d
mov r12, r8
mov r15, rdx
mov rbx, rcx
test rcx, rcx
je 0x18001ad81
xor edx, edx
lea rcx, [rbp + 0x980]
mov r8d, 0x800
call fcn.180113150
mov r8, rbx
lea rcx, [rbp + 0x980]
mov edx, 0x3ff
call fcn.1801259f0
mov rbx, 0xffffffffffffffff
lea rcx, [rbp + 0x980]
mov rax, rbx
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x18001ab91
cmp word [rbp + rax*2 + 0x97e], 0x5c
jne 0x18001abc3
lea rax, [rax*2 - 2]
cmp rax, 0x800
jae 0x18001ada4
mov word [rbp + rax + 0x980], di
lea r8, [rbp + 0x980]
mov edx, 0x3ff
lea rcx, [rbp + 0x180]
call fcn.1801259f0
test r15, r15
je 0x18001ac03
cmp word [r15], di
je 0x18001ac03
lea r8, [0x180155ad4]
mov edx, 0x3ff
lea rcx, [rbp + 0x180]
call fcn.180125a58
mov r8, r15
jmp 0x18001ac51
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18001ac46
lea rax, [rbp + 0x180]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], di
jne 0x18001ac20
test ebx, ebx
je 0x18001ac62
movsxd rax, ebx
movzx ecx, word [rbp + rax*2 + 0x17e]
cmp cx, 0x5c
je 0x18001ac4a
cmp cx, 0x3a
je 0x18001ac4a
jmp 0x18001ac62
test al, 0x10
je 0x18001ac62
lea r8, [0x180155a80]
mov edx, 0x3ff
lea rcx, [rbp + 0x180]
call fcn.180125a58
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18001ad81
mov ebx, dword [rbp + 0x1208]
mov qword [rsp + 0x1298], r14
mov r14d, dword [rbp + 0x1200]
nop word [rax + rax]
lea rdx, [0x180155a8c]
lea rcx, [rsp + 0x5c]
call fcn.1801153c8
test eax, eax
je 0x18001ad56
lea rdx, [0x180155a90]
lea rcx, [rsp + 0x5c]
call fcn.1801153c8
test eax, eax
je 0x18001ad56
lea rax, [rsp + 0x5c]
mov edx, 0x3ff
lea r9, [rbp + 0x980]
mov qword [rsp + 0x20], rax
lea r8, [0x180154c70]
lea rcx, [rbp + 0x180]
call fcn.18000f870
test byte [rsp + 0x30], 0x10
je 0x18001ad28
test ebx, ebx
je 0x18001ad56
mov dword [rsp + 0x28], ebx
lea rcx, [rbp + 0x180]
mov r9d, r13d
mov dword [rsp + 0x20], r14d
mov r8, r12
mov rdx, r15
call sym.SafeBase64.dll_DecryptFolder
mov edi, eax
jmp 0x18001ad56
mov r9d, r14d
lea rcx, [rbp + 0x180]
mov r8d, r13d
mov rdx, r12
call sym.SafeBase64.dll_SlfDecryptFile
mov edi, eax
test eax, eax
jne 0x18001ad56
lea rdx, [rbp + 0x180]
lea rcx, [0x180155ab8]
call sym.SafeBase64.dll_DbgPrintW
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18001aca0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r14, qword [rsp + 0x1298]
mov eax, edi
jmp 0x18001ad83
xor eax, eax
mov rcx, qword [rbp + 0x1180]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x12a0
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.18010fc24
int3
Function at 0x18001adb0
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x100
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, r8
mov r14, rdx
mov rbp, rcx
xor edx, edx
mov r8d, 0xa0
lea rcx, [rsp + 0x50]
call fcn.180113150
xor edx, edx
mov rcx, rbp
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test eax, eax
je 0x18001af81
mov ecx, ebx
call fcn.180115540
mov rsi, rax
test rax, rax
je 0x18001af81
mov r9, rax
mov r8d, ebx
xor edx, edx
mov rcx, rbp
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x18001af79
lea r9, [rsp + 0x40]
mov rcx, rsi
lea r8, [rsp + 0x30]
lea rdx, [0x180155ad8]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov ebp, eax
test eax, eax
je 0x18001af79
mov qword [rsp + 0x148], r15
xor r15d, r15d
test dword [rsp + 0x40], 0xfffffffc
mov ebx, r15d
jbe 0x18001af65
nop dword [rax]
mov rax, qword [rsp + 0x30]
lea r8, str.StringFileInfo_04x_04x_
mov ecx, ebx
movzx edx, word [rax + rcx*4 + 2]
movzx r9d, word [rax + rcx*4]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], edx
mov edx, 0x4f
call fcn.18000f870
lea r8, [0x180155ad4]
mov edx, 0x4f
lea rcx, [rsp + 0x50]
call fcn.180125a58
mov r8, r14
lea rcx, [rsp + 0x50]
mov edx, 0x4f
call fcn.180125a58
lea r9, [rsp + 0x44]
mov rcx, rsi
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov ebp, eax
test eax, eax
jne 0x18001aef0
mov eax, dword [rsp + 0x40]
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x18001ae70
jmp 0x18001af65
mov rdx, qword [rsp + 0x38]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x18001af00
cmp rax, 0x40
jae 0x18001af22
mov r8, rdx
mov rcx, rdi
mov edx, 0x3f
call fcn.1801259f0
jmp 0x18001af65
movups xmm0, xmmword [rdx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rdi + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rdi + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rdi + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rdi + 0x60], xmm0
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rdi + 0x70], xmm1
mov word [rdi + 0x7e], r15w
mov rcx, rsi
call fcn.180115548
mov r15, qword [rsp + 0x148]
mov eax, ebp
jmp 0x18001af83
mov rcx, rsi
call fcn.180115548
xor eax, eax
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x100
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18001b890
Capabilities:
Get disk information

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x6b0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov r14, rcx
lea rdx, [rsp + 0x40]
xor r15d, r15d
mov ecx, 0x103
mov ebp, r15d
mov word [rsp + 0x40], r15w
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x18001b9f4
mov eax, dword [0x180155c58]
mov qword [rsp + 0x6d8], rbx
lea rbx, [rsp + 0x40]
mov dword [rsp + 0x30], eax
movzx eax, word [0x180155c5c]
mov qword [rsp + 0x6e0], rsi
mov esi, r15d
mov word [rsp + 0x34], ax
movzx eax, word [rsp + 0x40]
mov qword [rsp + 0x6e8], rdi
mov r8d, 0x104
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x18001b9c0
lea rcx, [rsp + 0x260]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x18001b946
cmp eax, 0x104
jae 0x18001b9c0
mov r8d, eax
lea rdx, [rsp + 0x260]
mov rcx, r14
mov edi, eax
call fcn.180126bd0
test eax, eax
mov esi, r15d
sete sil
test eax, eax
jne 0x18001b9c0
lea rax, [r14 + rdi*2]
mov edx, 0x10b
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [0x180155c60]
lea rcx, [rsp + 0x480]
call fcn.18000f870
mov r9d, 0x104
lea r8, [rsp + 0x480]
mov edx, r9d
mov rcx, r14
call fcn.180126d84
mov ebp, 1
nop
movzx ecx, word [rbx]
add rbx, 2
test cx, cx
jne 0x18001b9c0
test esi, esi
jne 0x18001b9dc
movzx eax, word [rbx]
test ax, ax
jne 0x18001b911
mov rdi, qword [rsp + 0x6e8]
mov rsi, qword [rsp + 0x6e0]
mov rbx, qword [rsp + 0x6d8]
mov eax, ebp
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x6b0
pop r15
pop r14
pop rbp
ret

Function at 0x18001ba20
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rdx
xor edi, edi
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], edi
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x18001ba5c
cmp dword [rsp + 0x30], edi
je 0x18001baa2
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], 1
mov rcx, rbx
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], 1
xor r8d, r8d
mov rcx, rax
mov rbp, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
jne 0x18001baa6
xor eax, eax
jmp 0x18001bae5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x200
mov r8, rsi
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.PSAPI.DLL_GetMappedFileNameW]
mov ebx, eax
test eax, eax
je 0x18001bad1
mov rcx, rsi
call sym.SafeBase64.dll_DeviceName2FileName
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001bd60
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push rbp
push r14
sub rsp, 0xa98
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0xa70], rax
mov rbp, rdx
mov r8d, 0xe
lea rdx, str.DeviceSerial
mov r14, rcx
call fcn.180126bd0
test eax, eax
je 0x18001bf94
mov r8d, 0xe
lea rdx, str.DeviceUsbSer
mov rcx, r14
call fcn.180126bd0
test eax, eax
je 0x18001bf94
mov r8d, 0x19
lea rdx, str.DeviceLanmanRedirector_
mov rcx, r14
call fcn.180126bd0
test eax, eax
jne 0x18001be02
lea r8, [0x180155d74]
mov edx, 0x103
mov rcx, rbp
call fcn.1801259f0
lea r8, [r14 + 0x32]
mov edx, 0x103
mov rcx, rbp
call fcn.180125a58
mov eax, 1
jmp 0x18001bf46
mov r8d, 0xc
lea rdx, str.DeviceMup_
mov rcx, r14
call fcn.180126bd0
test eax, eax
jne 0x18001be47
lea r8, [0x180155d74]
mov edx, 0x103
mov rcx, rbp
call fcn.1801259f0
lea r8, [r14 + 0x18]
mov edx, 0x103
mov rcx, rbp
call fcn.180125a58
xor eax, eax
jmp 0x18001bf46
lea rdx, [rsp + 0x40]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x18001c003
cmp word [rsp + 0x40], 0
mov qword [rsp + 0xac0], rbx
mov qword [rsp + 0xa90], rsi
mov qword [rsp + 0xa88], rdi
lea rdi, [rsp + 0x40]
mov qword [rsp + 0xa80], r15
je 0x18001bf24
xor r15d, r15d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rdi + rax*2 + 2], r15w
lea rax, [rax + 1]
jne 0x18001bea0
mov word [rdi + 4], r15w
lea rdx, [rsp + 0x2a0]
mov r8d, 0x3e8
mov word [rsp + 0x2a0], r15w
mov rcx, rdi
lea rsi, [rdi + rax*2]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x18001bf8c
lea rax, [rsp + 0x2a0]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x18001bef0
test ebx, ebx
jle 0x18001bf15
movsxd r8, ebx
lea rdx, [rsp + 0x2a0]
mov rcx, r14
call fcn.180126bd0
test eax, eax
je 0x18001bf61
lea rdi, [rsi + 2]
cmp word [rsi + 2], r15w
jne 0x18001be93
xor eax, eax
mov rdi, qword [rsp + 0xa88]
mov rsi, qword [rsp + 0xa90]
mov rbx, qword [rsp + 0xac0]
mov r15, qword [rsp + 0xa80]
mov rcx, qword [rsp + 0xa70]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0xa98
pop r14
pop rbp
ret
mov r8, rdi
mov edx, 0x103
mov rcx, rbp
call fcn.1801259f0
movsxd rax, ebx
mov edx, 0x103
mov rcx, rbp
lea r8, [r14 + rax*2]
call fcn.180125a58
mov eax, 1
jmp 0x18001bf26
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001bf26
lea rax, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.HardwareDeviceMapSerialComm
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18001c003
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x2a0]
mov dword [rsp + 0x38], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18001c00a
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x18001bf46
lea r8, [rsp + 0x2a0]
mov edx, 0x103
mov rcx, rbp
call fcn.1801259f0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x18001bf46
Function at 0x18001c150
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rcx
xor edi, edi
mov dword [rcx + 0x208], edi
mov r8, rdx
mov edx, 0x103
call fcn.1801259f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rbx + 0x20c], eax
cmp eax, 0xffffffff
je 0x18001c1ac
test al, 7
je 0x18001c1ac
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [rbx + 0x208], 1
mov ecx, 0x28
call fcn.1800f3074
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18001c1df
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov rcx, rax
call fcn.1800f484c
jmp 0x18001c1e2
mov rax, rdi
mov qword [rbx + 0x210], rax
mov ecx, 0x28
call fcn.1800f3074
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18001c21c
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov rcx, rax
call fcn.1800f484c
jmp 0x18001c21f
mov rax, rdi
mov qword [rbx + 0x218], rax
mov ecx, 0x28
call fcn.1800f3074
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18001c25a
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov rcx, rax
call fcn.1800f484c
mov rdi, rax
mov qword [rbx + 0x220], rdi
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x18001c270
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
cmp dword [rcx + 0x208], 0
je 0x18001c2a2
mov edx, dword [rcx + 0x20c]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop
mov dword [rbx + 0x208], 0
xor edx, edx
lea r8, [rdx - 1]
mov rcx, qword [rbx + 0x210]
call fcn.1800f4ae0
nop
mov rcx, qword [rbx + 0x210]
test rcx, rcx
je 0x18001c2cd
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 8]
nop
xor edx, edx
lea r8, [rdx - 1]
mov rcx, qword [rbx + 0x218]
call fcn.1800f4ae0
nop
mov rcx, qword [rbx + 0x218]
test rcx, rcx
je 0x18001c2f8
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 8]
nop
xor edx, edx
lea r8, [rdx - 1]
mov rcx, qword [rbx + 0x220]
call fcn.1800f4ae0
nop
mov rcx, qword [rbx + 0x220]
test rcx, rcx
je 0x18001c323
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 8]
nop
add rsp, 0x30
pop rbx
ret
Function at 0x18001c330
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp dword [rsp + 0x2a0], 0
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
jne 0x18001c3d2
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.180113150
lea r14, str._none_value_
mov qword [rsp + 0x28], rbx
mov r8, r14
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r14 + rax*2 + 2]
jne 0x18001c3d2
add rax, 2
cmp rax, 0x13
je 0x18001c402
movzx ecx, word [rdx + rax*2]
cmp cx, word [r14 + rax*2]
je 0x18001c3b0
mov r9, rbx
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
jmp 0x18001c3e4

Function at 0x18001c410
Capabilities:
Read .ini file

Disassembly:
push rbx
push rdi
sub rsp, 0x258
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r10, r8
mov qword [rsp + 0x28], rcx
mov rax, rdx
mov dword [rsp + 0x20], 0x104
mov rbx, r9
lea rdi, str._none_value_
mov r8, rdi
lea r9, [rsp + 0x30]
mov rdx, r10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rax, 0xffffffffffffffff
movzx ecx, word [rbx + rax*2 + 2]
cmp cx, word [rdi + rax*2 + 2]
jne 0x18001c484
add rax, 2
cmp rax, 0x13
je 0x18001c4a0
movzx ecx, word [rbx + rax*2]
cmp cx, word [rdi + rax*2]
je 0x18001c464
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x258
pop rdi
pop rbx
ret
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, 1
jmp 0x18001c486
Function at 0x18001c500
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1240
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x1230], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x1000
call fcn.180113150
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.180113150
mov r8, rdi
lea rcx, [rsp + 0x230]
mov edx, 0x800
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
xor ebp, ebp
lea rax, [rsp + 0x230]
mov ebx, ebp
nop dword [rax + rax]
cmp word [rax], bp
jne 0x18001c58b
cmp bp, word [rax + 2]
je 0x18001c599
inc ebx
add rax, 2
cmp ebx, 0x800
jl 0x18001c580
mov rcx, qword [rdi + 0x210]
xor edx, edx
lea r8, [rdx - 1]
call fcn.1800f4ae0
lea eax, [rbx + 1]
movsxd rsi, eax
test eax, eax
jle 0x18001c607
mov rcx, rbp
mov rbx, rbp
nop dword [rax + rax]
movzx eax, word [rsp + rbx*2 + 0x230]
mov word [rsp + rcx*2 + 0x20], ax
inc rcx
test ax, ax
jne 0x18001c5ff
mov rcx, qword [rdi + 0x210]
lea r8, [rsp + 0x20]
mov rdx, qword [rcx + 0x10]
call fcn.1800f4a68
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180113150
mov rcx, rbp
inc rbx
cmp rbx, rsi
jl 0x18001c5c0
mov rax, qword [rdi + 0x210]
mov rcx, qword [rsp + 0x1230]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x1240]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18001cdf0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x18001cedb
xor ebp, ebp
cmp bp, word [rcx]
je 0x18001cedb
mov qword [rsp + 0x30], rbx
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rsi
mov rbx, r8
mov rsi, rcx
nop dword [rax + rax]
inc rbx
cmp word [rcx + rbx*2], bp
jne 0x18001ce30
add ebx, 0x10
cmp ebx, 0x104
jb 0x18001cec0
mov rax, qword [rcx]
cmp rax, qword [0x180155dd0]
je 0x18001cec0
mov ecx, ebx
mov eax, 2
mul rcx
lea rdx, [0x1801423a8]
cmovo rax, r8
mov rcx, rax
call fcn.18010fb14
mov rsi, rax
test rax, rax
jne 0x18001ce98
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea eax, [rbx - 1]
mov rcx, rsi
mov edx, eax
lea r8, [0x180155dd0]
mov ebp, 1
mov ebx, eax
call fcn.1801259f0
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call fcn.180125a58
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test ebp, ebp
je 0x18001ced7
mov rcx, rsi
call sym.SafeBase64.dll_SafeBase_free
mov eax, ebx
jmp 0x18001ce83
mov rbp, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x18001cef0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14d, edx
mov rdi, rcx
test rcx, rcx
je 0x18001cfe6
xor ebp, ebp
cmp bp, word [rcx]
je 0x18001cfe6
mov qword [rsp + 0x30], rbx
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rsi
mov rbx, r8
mov rsi, rcx
inc rbx
cmp word [rcx + rbx*2], bp
jne 0x18001cf31
add ebx, 0x10
cmp ebx, 0x104
jb 0x18001cfc8
mov rax, qword [rcx]
cmp rax, qword [0x180155dd0]
je 0x18001cfc8
mov ecx, ebx
mov eax, 2
mul rcx
lea rdx, [0x1801423a8]
cmovo rax, r8
mov rcx, rax
call fcn.18010fb14
mov rsi, rax
test rax, rax
jne 0x18001cfa0
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea eax, [rbx - 1]
mov rcx, rsi
mov edx, eax
lea r8, [0x180155dd0]
mov ebp, 1
mov ebx, eax
call fcn.1801259f0
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call fcn.180125a58
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ebx, eax
test ebp, ebp
je 0x18001cfe2
mov rcx, rsi
call sym.SafeBase64.dll_SafeBase_free
mov eax, ebx
jmp 0x18001cf85
mov rbp, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18001d000
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
je 0x18001d0e8
xor ebp, ebp
cmp bp, word [rcx]
je 0x18001d0e8
mov qword [rsp + 0x30], rbx
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rsi
mov rbx, r8
mov rsi, rcx
nop dword [rax + rax]
inc rbx
cmp word [rcx + rbx*2], bp
jne 0x18001d040
add ebx, 0x10
cmp ebx, 0x104
jb 0x18001d0cd
mov rax, qword [rcx]
cmp rax, qword [0x180155dd0]
je 0x18001d0cd
mov ecx, ebx
mov eax, 2
mul rcx
lea rdx, [0x1801423a8]
cmovo rax, r8
mov rcx, rax
call fcn.18010fb14
mov rsi, rax
test rax, rax
jne 0x18001d0a5
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea eax, [rbx - 1]
mov rcx, rsi
mov edx, eax
lea r8, [0x180155dd0]
mov ebp, 1
mov ebx, eax
call fcn.1801259f0
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call fcn.180125a58
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test ebp, ebp
je 0x18001d0e4
mov rcx, rsi
call sym.SafeBase64.dll_SafeBase_free
mov eax, ebx
jmp 0x18001d090
mov rbp, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x18001d100
Capabilities:
Move file

Disassembly:
push rbp
push rsi
push rdi
push r13
sub rsp, 0x28
mov r13d, r8d
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x18001d2bc
xor ebp, ebp
cmp bp, word [rcx]
je 0x18001d2bc
test rdx, rdx
je 0x18001d2bc
cmp bp, word [rdx]
je 0x18001d2bc
mov qword [rsp + 0x50], rbx
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x58], r12
mov rbx, r8
mov qword [rsp + 0x60], r14
mov r12d, ebp
mov qword [rsp + 0x20], r15
mov r14, rcx
mov r15, rdx
inc rbx
cmp word [rcx + rbx*2], bp
jne 0x18001d160
add ebx, 0x10
cmp ebx, 0x104
jb 0x18001d1d8
mov rax, qword [rcx]
cmp rax, qword [0x180155dd0]
je 0x18001d1d8
mov ecx, ebx
mov eax, 2
mul rcx
lea rdx, [0x1801423a8]
cmovo rax, r8
mov rcx, rax
call fcn.18010fb14
mov r14, rax
test rax, rax
je 0x18001d23a
lea ecx, [rbx - 1]
mov ebp, 1
mov ebx, ecx
lea r8, [0x180155dd0]
mov edx, ecx
mov rcx, rax
call fcn.1801259f0
mov r8, rdi
mov edx, ebx
mov rcx, r14
call fcn.180125a58
mov r8, 0xffffffffffffffff
mov rbx, r8
nop dword [rax + rax]
inc rbx
cmp word [rsi + rbx*2], r12w
jne 0x18001d1e0
add ebx, 0x10
cmp ebx, 0x104
jb 0x18001d28e
mov rcx, qword [rsi]
cmp rcx, qword [0x180155dd0]
je 0x18001d28e
mov ecx, ebx
mov eax, 2
mul rcx
lea rdx, [0x1801423a8]
cmovo rax, r8
mov rcx, rax
call fcn.18010fb14
mov r15, rax
test rax, rax
jne 0x18001d265
test ebp, ebp
je 0x18001d23a
mov rcx, r14
call sym.SafeBase64.dll_SafeBase_free
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r13
pop rdi
pop rsi
pop rbp
ret
lea eax, [rbx - 1]
mov rcx, r15
mov edx, eax
lea r8, [0x180155dd0]
mov r12d, 1
mov ebx, eax
call fcn.1801259f0
mov r8, rsi
mov edx, ebx
mov rcx, r15
call fcn.180125a58
mov r8d, r13d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
test ebp, ebp
je 0x18001d2ab
mov rcx, r14
call sym.SafeBase64.dll_SafeBase_free
test r12d, r12d
je 0x18001d2b8
mov rcx, r15
call sym.SafeBase64.dll_SafeBase_free
mov eax, ebx
jmp 0x18001d247
xor eax, eax
add rsp, 0x28
pop r13
pop rdi
pop rsi
pop rbp
ret