joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180066870
Capabilities:
Read file on windows

Disassembly:
push rbx
push r12
sub rsp, 0x38
mov r12, rdx
mov rbx, rcx
test rcx, rcx
je 0x180066a8d
cmp byte [rcx], 0
je 0x180066a8d
mov edx, 0x2e
mov qword [rsp + 0x68], rdi
call fcn.1800f7e94
mov rdi, rax
test rax, rax
je 0x1800668d0
mov rcx, rax
call fcn.1800fd3f0
lea rcx, str..DOCX.XLSX.TXT.RTF.PPTX
mov rdx, rdi
call fcn.1800f4d08
test rax, rax
jne 0x1800668d0
mov rdi, qword [rsp + 0x68]
add rsp, 0x38
pop r12
pop rbx
ret
mov qword [rsp + 0x60], rsi
xor esi, esi
mov rdx, r12
mov rcx, rbx
mov dword [r12], esi
call fcn.1800666f0
mov edi, eax
test eax, eax
jne 0x180066943
mov ecx, 0x40001
mov qword [rsp + 0x58], rbp
call fcn.1800f9438
mov rbp, rax
test rax, rax
je 0x18006693e
xor edx, edx
mov r8d, 0x40000
mov rcx, rax
mov qword [rsp + 0x28], r14
call fcn.1800f4fb0
lea rdx, [0x180151a40]
mov rcx, rbx
call fcn.1800f7e24
mov r14, rax
test rax, rax
jne 0x180066955
mov rcx, rbp
call fcn.1800f93a8
xor eax, eax
mov r14, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x38
pop r12
pop rbx
ret
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x30], r13
lea r8d, [rdx + 2]
mov qword [rsp + 0x20], r15
call fcn.1800f7c3c
mov rcx, r14
call fcn.1800fdd00
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov r13d, eax
call fcn.1800f7c3c
cmp r13d, 0x40000
mov ebx, esi
mov dword [rsp + 0x50], ebx
jle 0x180066a25
mov r15d, r13d
nop dword [rax + rax]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9, r14
mov edx, 0x40000
mov r8d, 1
mov rcx, rbp
call fcn.1800f7b68
mov edx, 0x40000
mov rcx, rbp
call fcn.180066690
mov ebx, esi
movsxd rcx, ebx
mov rdx, r12
add rcx, rbp
call fcn.1800666f0
mov edi, eax
test eax, eax
jne 0x180066a6c
inc ebx
cmp ebx, 0x40000
jl 0x1800669d0
mov ebx, dword [rsp + 0x50]
lea r8d, [rax + 1]
mov edx, 0xffffff00
add ebx, 0x3ff00
mov rcx, r14
sub r15d, 0x3ff00
mov dword [rsp + 0x50], ebx
call fcn.1800f7c3c
cmp r15d, 0x40000
jg 0x1800669a0
sub r13d, ebx
test r13d, r13d
jle 0x180066a6c
movsxd rdx, r13d
mov r9, r14
mov r8d, 1
mov rcx, rbp
call fcn.1800f7b68
mov edx, r13d
mov rcx, rbp
call fcn.180066690
test r13d, r13d
jle 0x180066a6c
movsxd rcx, esi
mov rdx, r12
add rcx, rbp
call fcn.1800666f0
mov edi, eax
test eax, eax
jne 0x180066a6c
inc esi
cmp esi, r13d
jl 0x180066a51
mov rcx, r14
call fcn.1800f7504
mov rcx, rbp
call fcn.1800f93a8
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x30]
mov eax, edi
jmp 0x180066939
xor eax, eax
add rsp, 0x38
pop r12
pop rbx
ret
Function at 0x180066f70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rcx
lea rcx, [rsp + 0x32]
xor ebx, ebx
xor edx, edx
mov r8d, 0x410
mov word [rsp + 0x30], bx
call fcn.1800f4fb0
xor eax, eax
mov word [rsp + 0x20], bx
mov qword [rsp + 0x22], rax
test rdi, rdi
je 0x1800671f6
cmp bx, word [rdi]
je 0x1800671f6
lea r8d, [rbx + 4]
lea rdx, [0x18015d278]
mov rcx, rdi
call fcn.1800fcd4c
test eax, eax
je 0x1800671f4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800671f4
test al, 0x10
jne 0x1800671f4
lea rdx, [rsp + 0x30]
mov r8d, 0x208
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea rcx, [rsp + 0x30]
call fcn.1800fcb98
lea edx, [rbx + 0x2e]
lea rcx, [rsp + 0x30]
call fcn.1800fb920
test rax, rax
je 0x18006703f
lea r8d, [rbx + 4]
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.1800fb8d8
cmp bx, word [rsp + 0x20]
jne 0x180067050
mov eax, 1
jmp 0x1800671f6
lea rdx, [rsp + 0x20]
lea rcx, str..LNK.PIF
call fcn.1800fb870
test rax, rax
jne 0x1800671f4
or rcx, 0xffffffffffffffff
lea rdi, [0x180259c90]
lea rdx, [0x180259c90]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.1800fcd4c
test eax, eax
jne 0x1800670ae
lea rdx, [rsp + 0x20]
lea rcx, str..DLL.EXE.SYS.CLB.TLB.DRV.OCX.MUI.IME.TTF.TTC.CPL.WAV.MB.IMD.CWD.PF.NLS.CON.OVL.REM.MAN
call fcn.1800fb870
test rax, rax
jne 0x1800671f4
lea rdx, str.LOCAL_SETTINGS_
lea rcx, [rsp + 0x30]
call fcn.1800fb870
test rax, rax
jne 0x1800671f4
lea rdx, str.COMMON_
lea rcx, [rsp + 0x30]
call fcn.1800fb870
test rax, rax
jne 0x1800671f4
lea rdx, str.NETHOOD_
lea rcx, [rsp + 0x30]
call fcn.1800fb870
test rax, rax
jne 0x1800671f4
lea rdx, str.COOKIES_
lea rcx, [rsp + 0x30]
call fcn.1800fb870
test rax, rax
jne 0x1800671f4
lea rdx, str.COMMON_FILES_
lea rcx, [rsp + 0x30]
call fcn.1800fb870
test rax, rax
jne 0x1800671f4
lea rdx, str.APPLICATION_DATA_
lea rcx, [rsp + 0x30]
call fcn.1800fb870
test rax, rax
jne 0x1800671f4
lea rdx, str.TORTOISESVN_
lea rcx, [rsp + 0x30]
call fcn.1800fb870
test rax, rax
jne 0x1800671f4
lea rdx, str.PAGEFILE.SYS
lea rcx, [rsp + 0x30]
call fcn.1800fb870
test rax, rax
jne 0x1800671f4
lea rdx, str.QQ_
lea rcx, [rsp + 0x30]
call fcn.1800fb870
test rax, rax
jne 0x1800671c0
lea rdx, str.MSN_MESSENGER_
lea rcx, [rsp + 0x30]
call fcn.1800fb870
test rax, rax
jne 0x1800671c0
lea rdx, str.Messenger_
lea rcx, [rsp + 0x30]
call fcn.1800fb870
test rax, rax
je 0x180067046
lea rdx, str.MYRECEIVEFILE_
lea rcx, [rsp + 0x30]
call fcn.1800fb870
test rax, rax
jne 0x180067046
lea rdx, [rsp + 0x20]
lea rcx, str..WMA.DLL.DAT.EXE.INI.HTM.XML.SYS.VXD.GIF.0.TLG.DB.TXL.OCX.BMP.SWF.ICO.TS.MAN.CUR.VBS.WAV.CWD.WMA
call fcn.1800fb870
test rax, rax
je 0x180067046
xor eax, eax
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rdi
ret
Function at 0x180067da9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rdx, rdx
je 0x180067ef3
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x670
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test rbx, rbx
je 0x180067ecf
lea rcx, [rsp + 0x551]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x550], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x550]
sub rcx, rdi
nop word [rax + rax]
movzx eax, byte [rdi]
inc rdi
mov byte [rcx + rdi - 1], al
test al, al
jne 0x180067e10
lea rcx, [rsp + 0x441]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x440], al
call fcn.1800f4fb0
lea rcx, [rsp + 0x440]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
mov byte [rcx + rbx - 1], al
test al, al
jne 0x180067e50
xor ecx, ecx
mov dword [rsp + 0x230], esi
mov dword [rsp + 0x234], 1
mov rdx, rcx
movzx eax, byte [rsp + rdx + 0x550]
inc rdx
mov byte [rsp + rdx + 0x237], al
test al, al
jne 0x180067e75
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0x440]
inc rcx
mov byte [rsp + rcx + 0x33b], al
test al, al
jne 0x180067e90
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x230]
mov r8d, 0x210
call fcn.1800f6e10
mov rcx, qword [0x1801e1b08]
lea rdx, [rsp + 0x20]
call fcn.18003c810
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1800f4f80
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
repz ret
Function at 0x180067f00
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x4a0
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rsi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x270], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x160]
mov rdx, rsi
sub rcx, rsi
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x180067f80
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rsi - 2], 0x5c
je 0x180067fbc
lea rdi, [rsp + 0x160]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180151570]
mov word [rdi - 1], ax
xor ecx, ecx
nop
movzx eax, byte [rsp + rcx + 0x160]
inc rcx
mov byte [rsp + rcx + 0x26f], al
test al, al
jne 0x180067fc0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x270]
repne scasb al, byte [rdi]
mov eax, dword [0x18015d30c]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
mov dword [rdi - 1], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x180068012
xor eax, eax
jmp 0x1800680e4
test byte [rsp + 0x20], 0x10
je 0x1800680c1
lea rsi, [rsp + 0x4c]
lea rdi, [0x180151958]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x1800680c3
lea rsi, [rsp + 0x4c]
lea rdi, [0x18015d308]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x1800680c3
lea rcx, [rsp + 0x381]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x380], 0
call fcn.1800f4fb0
xor edx, edx
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x160]
inc rdx
mov byte [rsp + rdx + 0x37f], al
test al, al
jne 0x180068070
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x380]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x4c]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1800680a0
lea rcx, [rsp + 0x380]
mov rdx, rbx
call fcn.180067f00
jmp 0x1800680c3
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180068012
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rbx]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1800f4f80
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180068110
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x4a0
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rsi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x270], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x160]
mov rdx, rsi
sub rcx, rsi
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x180068190
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rsi - 2], 0x5c
je 0x1800681cc
lea rdi, [rsp + 0x160]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180151570]
mov word [rdi - 1], ax
xor ecx, ecx
nop
movzx eax, byte [rsp + rcx + 0x160]
inc rcx
mov byte [rsp + rcx + 0x26f], al
test al, al
jne 0x1800681d0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x270]
repne scasb al, byte [rdi]
mov eax, dword [0x18015d30c]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
mov dword [rdi - 1], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x180068222
xor eax, eax
jmp 0x1800682f4
test byte [rsp + 0x20], 0x10
je 0x1800682d1
lea rsi, [rsp + 0x4c]
lea rdi, [0x180151958]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x1800682d3
lea rsi, [rsp + 0x4c]
lea rdi, [0x18015d308]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x1800682d3
lea rcx, [rsp + 0x381]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x380], 0
call fcn.1800f4fb0
xor edx, edx
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x160]
inc rdx
mov byte [rsp + rdx + 0x37f], al
test al, al
jne 0x180068280
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x380]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x4c]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1800682b0
lea rcx, [rsp + 0x380]
mov rdx, rbx
call fcn.180068110
jmp 0x1800682d3
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180068222
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rbx]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1800f4f80
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180068390
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x16c8
call fcn.180124410
sub rsp, rax
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x16b0], rax
test rcx, rcx
je 0x1800684fe
cmp byte [rcx], 0
je 0x1800684fe
mov rdx, rcx
lea rcx, [rsp + 0x50]
mov r8d, 0x165c
mov qword [rsp + 0x16d8], rbx
mov qword [rsp + 0x16c0], rdi
call fcn.1800f6e10
xor ebx, ebx
lea rcx, str..PipeVrvExportSetEvent
xor r9d, r9d
mov qword [rsp + 0x30], rbx
lea edx, [rbx + 3]
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180068475
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x18015d3d0]
mov edx, eax
call fcn.18005ce60
mov edx, dword [rsp + 0x50]
lea r9, [rsp + 0x14a4]
lea r8, [rsp + 0x54]
lea rcx, [0x18015d3a8]
call fcn.18005cd20
xor eax, eax
mov rbx, qword [rsp + 0x16d8]
mov rdi, qword [rsp + 0x16c0]
mov rcx, qword [rsp + 0x16b0]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x16c8
ret
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r8d, 0x165c
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
test eax, eax
jne 0x1800684d1
mov edx, dword [rsp + 0x50]
lea r9, [rsp + 0x14a4]
lea r8, [rsp + 0x54]
lea rcx, [0x18015d380]
call fcn.18005cd20
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x18015d358]
mov edx, eax
call fcn.18005ce60
xor eax, eax
jmp 0x18006844d
mov edx, dword [rsp + 0x50]
lea r9, [rsp + 0x14a4]
lea r8, [rsp + 0x54]
lea rcx, [0x18015d338]
call fcn.18005cd20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x18006844d
lea rcx, [0x18015d310]
call fcn.18005ce60
xor eax, eax
mov rcx, qword [rsp + 0x16b0]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x16c8
ret
Function at 0x180068530
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x40], rax
movsx ebx, cl
xor eax, eax
lea rdx, [0x18015ccac]
lea rcx, [rsp + 0x30]
mov r8d, ebx
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov byte [rsp + 0x39], al
call fcn.1800f509c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x1800685ac
cmp eax, 3
je 0x1800685ac
lea r8, [rsp + 0x30]
lea rcx, [0x18015cc88]
mov edx, 0x9f85
call fcn.18005cd20
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x50
pop rbx
ret
xor eax, eax
lea rdx, [0x18015cc84]
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x21], rax
mov byte [rsp + 0x29], al
call fcn.1800f509c
cmp byte [0x1801e00a8], 0
je 0x180068637
lea rcx, [0x1801e00a8]
call fcn.1800fd3f0
lea rcx, [rsp + 0x20]
call fcn.1800fd3f0
lea rdx, [rsp + 0x20]
lea rcx, [0x1801e00a8]
call fcn.1800f4d08
test rax, rax
je 0x180068648
lea r9, [rsp + 0x20]
lea r8, [0x1801e00a8]
lea rcx, [0x18015cc50]
mov edx, 0x9f91
call fcn.18005cd20
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x50
pop rbx
ret
lea rcx, [0x18015d418]
mov edx, 0x9f97
call fcn.18005cd20
lea r9, [rsp + 0x20]
lea r8, [0x1801e00a8]
lea rcx, [0x18015cc20]
mov edx, 0x9f99
call fcn.18005cd20
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x50
pop rbx
ret

Function at 0x180068680
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x140], rax
movsx ebx, cl
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.1800f4fb0
xor eax, eax
lea rdx, [0x18015cdfc]
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x21], rax
mov byte [rsp + 0x29], al
call fcn.1800f509c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x180068730
lea rcx, [rsp + 0x30]
call fcn.1800fd3f0
lea r8, [rsp + 0x30]
lea rcx, [0x18015d478]
mov edx, 0x9fd8
call fcn.18005cd20
lea rdx, str.DEVICEEDPEDISKEDPEDISK
lea rcx, [rsp + 0x30]
call fcn.1800f4d08
test rax, rax
je 0x180068730
mov eax, 1
jmp 0x180068732
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x150
pop rbx
ret
Function at 0x180068860
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x40], rax
movsx ebx, cl
xor eax, eax
lea rdx, [0x18015ccac]
lea rcx, [rsp + 0x30]
mov r8d, ebx
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x31], rax
mov byte [rsp + 0x39], al
call fcn.1800f509c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x1800688c1
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x50
pop rbx
ret
xor eax, eax
lea rdx, [0x18015cc84]
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x21], rax
mov byte [rsp + 0x29], al
call fcn.1800f509c
cmp byte [0x1801e00a8], 0
je 0x18006891a
lea rcx, [0x1801e00a8]
call fcn.1800fd3f0
lea rcx, [rsp + 0x20]
call fcn.1800fd3f0
lea rdx, [rsp + 0x20]
lea rcx, [0x1801e00a8]
call fcn.1800f4d08
test rax, rax
je 0x1800688ac
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x50
pop rbx
ret
Function at 0x180068a40
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor eax, eax
mov rbp, rcx
or rcx, 0xffffffffffffffff
mov rdi, rdx
mov r13d, r8d
mov rbx, rdx
repne scasb al, byte [rdi]
not rcx
lea rax, [rcx - 1]
cdqe
cmp byte [rax + rdx - 1], 0x5c
jne 0x180068a81
mov byte [rax + rdx - 1], 0
mov edx, 0x2e
mov rcx, rbp
call fcn.1800f7e94
mov edx, 0x2e
mov rcx, rbx
mov r12, rax
call fcn.1800f7e94
xor esi, esi
xor edi, edi
mov r11, rax
test r12, r12
je 0x180068ad1
test rax, rax
je 0x180068ad1
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
mov rdi, r11
not rcx
lea rsi, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
test r13d, r13d
je 0x180068be5
test esi, esi
je 0x180068af0
cmp esi, 4
jg 0x180068af0
test edi, edi
je 0x180068af0
cmp edi, 4
jle 0x180068be5
mov edx, 0x5c
mov rcx, rbp
call fcn.1800f7e94
test rax, rax
je 0x180068be5
test edi, edi
jle 0x180068ba5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
je 0x180068b3d
mov edx, 0x5c
mov rcx, rbx
call fcn.1800f7e94
or rcx, 0xffffffffffffffff
mov rdi, rax
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
jmp 0x180068b3f
xor edx, edx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea eax, [rcx - 1]
lea r8, [rcx - 1]
sub eax, edx
xor edx, edx
cdqe
sub r8, rax
lea rcx, [rax + rbx]
call fcn.1800f4fb0
mov edx, 0x5c
mov rcx, rbp
call fcn.1800f7e94
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov r11, rax
xor eax, eax
repne scasb al, byte [rdi]
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [r11 + rdx]
inc rdx
mov byte [rdi + rdx - 2], cl
test cl, cl
jne 0x180068b90
jmp 0x180068c80
mov edx, 0x5c
mov rcx, rbp
call fcn.1800f7e94
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov r11, rax
xor eax, eax
repne scasb al, byte [rdi]
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [r11 + rdx]
inc rdx
mov byte [rdi + rdx - 2], cl
test cl, cl
jne 0x180068bd0
jmp 0x180068c80
lea eax, [rsi - 1]
cmp eax, 3
ja 0x180068c80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
je 0x180068c20
mov edx, 0x5c
mov rcx, rbx
call fcn.1800f7e94
or rcx, 0xffffffffffffffff
mov rdi, rax
xor eax, eax
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
jmp 0x180068c22
xor edx, edx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea eax, [rcx - 1]
lea r8, [rcx - 1]
sub eax, edx
xor edx, edx
movsxd rcx, eax
sub r8, rcx
lea rdi, [rcx + rbx]
mov rcx, rdi
call fcn.1800f4fb0
mov edx, 0x5c
mov rcx, rbp
call fcn.1800f7e94
or rcx, 0xffffffffffffffff
mov r11, rax
xor eax, eax
repne scasb al, byte [rdi]
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [r11 + rdx]
inc rdx
mov byte [rdi + rdx - 2], cl
test cl, cl
jne 0x180068c70
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x18006a540
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov r9d, 3
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18006a608
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea rdx, str.ProxyEnable
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rsp + 0x30], 0
je 0x18006a5fd
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
lea rdx, str.ProxyEnable
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x30]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
call fcn.18006a480
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x50
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x58
ret
Function at 0x18006fc70
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x680
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x670], rax
lea rcx, [rsp + 0x252]
xor ebx, ebx
xor edx, edx
mov r8d, 0x410
mov word [rsp + 0x250], bx
call fcn.1800f4fb0
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x208
mov byte [rsp + 0x40], bl
call fcn.1800f4fb0
cmp dword [0x18021adec], ebx
je 0x18006fdb0
cmp dword [0x1802599dc], ebx
je 0x18006fdb0
cmp dword [0x1801e1bdc], ebx
jne 0x18006fdb0
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x690], rdi
xor eax, eax
lea rdx, [0x18021ae6c]
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x18006fda8
mov rcx, rbx
nop
movzx eax, word [rcx + rdx]
add rcx, 2
mov word [rsp + rcx + 0x24e], ax
test ax, ax
jne 0x18006fd10
xor eax, eax
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], rbx
lea rdi, [rsp + 0x250]
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x250]
repne scasw ax, word [rdi]
mov rax, qword [str.tempie]
or r9d, 0xffffffff
mov qword [rdi - 2], rax
mov rax, qword [0x18015db70]
xor edx, edx
mov qword [rdi + 6], rax
lea rax, [rsp + 0x40]
xor ecx, ecx
mov dword [rsp + 0x28], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.1800f6de4
test eax, eax
je 0x18006fd9b
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rsp + 0x250]
call fcn.180065db0
mov rdi, qword [rsp + 0x690]
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.1800f4f80
add rsp, 0x680
pop rbx
ret