joyce8/EMBER2024-capa huggingface dataset:
Function at 0x794370
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x80], rcx
nop
lea rcx, [rbp + 0x58]
lea rdx, [0x007945a8]
call fcn.0040fd00
mov dword [rbp + 0x54], 0x8c4de1
mov byte [rbp + 0x53], 0
cmp qword [0x0085fe68], 0xffffffffff70e9a4
jge 0x7943e3
cmp byte [0x0085fe65], 0
mov rcx, qword [rbp + 0x58]
lea rdx, [0x007945bc]
call fcn.00411180
test eax, eax
je 0x794408
cmp qword [0x0085fe68], 0xffffffffffffffff
jge 0x794408
mov byte [0x0085fe65], 1
mov ecx, 0x183d16
mov edx, 0x183516
call fcn.0078b350
mov ecx, eax
call fcn.004350e0
mov qword [rbp + 0x60], rax
mov ecx, 0x13228c
mov edx, 0x131a8c
call fcn.0078b350
mov ecx, eax
call fcn.004350e0
mov qword [rbp + 0x68], rax
nop
mov ecx, 0x164806
mov edx, 0x164006
call fcn.0078b350
mov ecx, eax
mov rdx, qword [rbp + 0x60]
call sub.kernel32.dll_GetTempPathW
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x60]
call fcn.00410ba0
lea rcx, [rbp + 0x38]
lea rdx, [0x007945d4]
mov r8d, 0x1980b7
call fcn.0078b4d0
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
call fcn.00410ea0
mov rcx, qword [rbp + 0x40]
call fcn.00433f40
lea rcx, [rbp + 0x30]
lea rdx, [0x0079462c]
mov r8d, 0x1cb6a0
call fcn.0078b4d0
mov rcx, qword [rbp + 0x30]
call fcn.00410b10
mov rcx, rax
mov rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x68]
call sub.shell32.dll_FindExecutableW
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x68]
call fcn.00410ba0
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x60]
call fcn.00410ba0
lea rcx, [rbp + 0x20]
lea rdx, [0x00794674]
mov r8d, 0x123099
call fcn.0078b4d0
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
call fcn.00410ea0
mov rcx, qword [rbp + 0x28]
call fcn.00434610
jmp 0x79451e
mov rcx, qword [rbp + 0x60]
call fcn.00435150
mov rcx, qword [rbp + 0x68]
call fcn.00435150
nop
lea rcx, [rbp + 0x20]
mov edx, 5
call fcn.0040f730
lea rcx, [rbp + 0x58]
call fcn.0040f650
mov rax, qword [rbp + 0x80]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x79a390
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x50], rcx
nop
cmp byte [0x0085fe65], 0
sete al
mov byte [rbp + 0x37], al
jmp 0x79a3c1
cmp byte [0x0085fe64], 0
jne 0x79a3ca
cmp byte [0x0085fe64], 0
jne 0x79a3b8
nop
cmp qword [0x0085fe68], 0xaba1b
jle 0x79a3e3
movzx rax, byte [0x0085fe65]
mov byte [rbp + 0x37], al
cmp byte [rbp + 0x37], 0
je 0x79a3fa
cmp qword [0x0085fe70], 0xffffffffffe5fa65
jl 0x79a491
mov rcx, qword [rbp + 0x50]
call fcn.0040f650
nop
mov ecx, 0x1e88be
mov edx, 0x1e80be
call fcn.0078b350
mov ecx, eax
call fcn.004350e0
mov qword [rbp + 0x38], rax
mov ecx, 0x1523f6
mov edx, 0x151bf6
call fcn.0078b350
mov ecx, eax
mov rdx, qword [rbp + 0x38]
call sub.kernel32.dll_GetTempPathW
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x38]
call fcn.00410ba0
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax]
mov dl, 1
call fcn.00434230
test al, al
jne 0x79a473
mov rcx, qword [rbp + 0x50]
call fcn.005538c0
jmp 0x79a473
lea rcx, [rbp + 0x20]
mov rax, qword [rbp + 0x50]
mov rdx, qword [rax]
call fcn.0043e9b0
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x20]
call fcn.0040fc80
nop
lea rcx, [rbp + 0x20]
call fcn.0040f650
mov rax, qword [rbp + 0x50]
lea rsp, [rbp + 0x40]
pop rbp
ret

Function at 0x79c120
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x70], rcx
mov rcx, qword [rbp + 0x70]
call fcn.0040f7e0
nop
mov ecx, 0x7f0fe9
mov eax, 0x68b26b
mov edx, 0xffa20ce9
sub edx, eax
movsxd rdx, edx
cmp qword [0x0085fe70], rdx
jge 0x79c175
sub ecx, 0xb533
cmp ecx, eax
setne cl
mov byte [0x0085fe64], cl
mov ecx, eax
xor edx, edx
or dl, byte [0x0085fe64]
test dl, dl
je 0x79c190
test ecx, ecx
jge 0x79c190
test eax, eax
jle 0x79c18f
test eax, eax
jg 0x79c18b
nop
lea rcx, [rbp + 0x48]
lea rdx, [0x0079c26c]
mov r8d, 0x11bc9f
call fcn.0078b4d0
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x70]
call fcn.00792500
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0x38]
call fcn.0040fd00
cmp qword [rbp + 0x70], 0
je 0x79c204
mov rcx, qword [rbp + 0x48]
call fcn.00410b10
mov rbx, rax
mov rcx, qword [rbp + 0x70]
call fcn.00410b10
xor ecx, ecx
mov rdx, rbx
mov r8, rax
lea r9, [0x0079c2aa]
lea rax, [0x0079c2aa]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 5
call sub.shell32.dll_ShellExecuteW
nop
lea rcx, [rbp + 0x38]
call fcn.0040f650
lea rcx, [rbp + 0x48]
call fcn.0040f650
lea rcx, [rbp + 0x70]
call fcn.0040f650
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret
Function at 0x7d1040
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0xa0
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0xb0], rcx
nop
lea rcx, [rbp + 0x88]
lea rdx, [0x007d138c]
call fcn.0040fd00
mov dword [rbp + 0x84], 0x3e8c29
mov byte [rbp + 0x83], 1
cmp qword [0x00863c90], 0xffffffffff9b459a
jge 0x7d10da
mov eax, dword [0x00863c98]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
setl al
test byte [rbp + 0x83], al
je 0x7d1130
cmp byte [0x00863c8c], 0
je 0x7d1130
mov dword [rbp + 0x84], 0x1d4db2
mov ecx, 0x731033
mov eax, dword [rbp + 0x84]
cdq
idiv ecx
cmp edx, 0x1f2eea
sete al
mov byte [0x00863c8c], al
add dword [rbp + 0x84], 1
cmp dword [rbp + 0x84], 0x4c4c99
jne 0x7d10ff
nop
mov rcx, qword [rbp + 0x88]
lea rdx, [0x007d13c8]
call fcn.00411180
test eax, eax
je 0x7d1158
cmp qword [0x00863c90], 0xffffffffffffffff
jge 0x7d1158
mov byte [0x00863c8d], 1
cmp qword [0x00863ca8], 0
je 0x7d117a
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [0x00863ca8]
call fcn.0040fc80
jmp 0x7d12d4
nop
mov rcx, 0xffffffffffec302d
mov edx, 0x13d7d3
call fcn.0078b350
mov ecx, eax
call fcn.004350e0
mov qword [rbp + 0x90], rax
mov ecx, 0x15e1f6
mov edx, 0x15d9f6
call fcn.0078b350
mov ecx, eax
mov rdx, qword [rbp + 0x90]
call sub.kernel32.dll_GetTempPathW
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0x90]
call fcn.00410ba0
mov rax, qword [rbp + 0xb0]
mov rcx, qword [rax]
mov dl, 1
call fcn.00434230
test al, al
jne 0x7d1201
mov rcx, qword [rbp + 0xb0]
call fcn.005538c0
jmp 0x7d1201
nop
mov qword [rbp + 0x98], 0
lea rcx, [rbp + 0x50]
mov rax, qword [rbp + 0xb0]
mov rdx, qword [rax]
call fcn.0043e9b0
lea rcx, [rbp + 0x78]
call fcn.007d0410
lea rcx, [rbp + 0x40]
lea rdx, [0x007d13e8]
mov r8d, 0x1c449d
call fcn.0078b4d0
lea rcx, [rbp + 0x78]
lea rdx, [rbp + 0x48]
mov r8, qword [rbp + 0x40]
xor r9, r9
movzx rax, byte [0x007d142c]
mov byte [rsp + 0x20], al
call fcn.004423c0
lea rcx, [rbp + 0x98]
mov rdx, qword [rbp + 0x50]
mov r8, qword [rbp + 0x48]
call fcn.00410f70
mov ecx, 0x76126d
call fcn.004098b0
mov dword [rbp + 0x74], eax
lea rcx, [rbp + 0x68]
mov edx, dword [rbp + 0x74]
call fcn.004335a0
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x98]
mov r8, qword [rbp + 0x68]
call fcn.00410f70
mov rcx, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0x38]
call fcn.0043e9b0
nop
lea rcx, [rbp + 0x98]
call fcn.0040f650
lea rcx, [0x00863ca8]
mov rax, qword [rbp + 0xb0]
mov rdx, qword [rax]
call fcn.0040fc80
nop
lea rcx, [rbp + 0x38]
mov edx, 4
call fcn.0040f730
lea rcx, [rbp + 0x68]
call fcn.0040f650
lea rcx, [rbp + 0x78]
call fcn.0040f650
lea rcx, [rbp + 0x88]
call fcn.0040f650
mov rax, qword [rbp + 0xb0]
lea rsp, [rbp + 0xa0]
pop rbp
ret
Function at 0x7d19d0
Capabilities:
Create process on windows

Disassembly:
push rbp
sub rsp, 0x100
mov rbp, rsp
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], rdx
mov rcx, qword [rbp + 0x110]
call fcn.0040f7e0
nop
nop
mov ecx, 0x1b2100
mov edx, 0x1b2100
call fcn.0078b350
mov byte [rbp + 0x6f], al
lea rcx, [rbp + 0x70]
mov edx, 0x18
movzx r8, byte [rbp + 0x6f]
call fcn.0040b9f0
mov rcx, 0xffffffffffee97e3
mov edx, 0x11681d
call fcn.0078b350
mov byte [rbp + 0x6e], al
lea rcx, [rbp + 0x90]
mov edx, 0x68
movzx r8, byte [rbp + 0x6e]
call fcn.0040b9f0
mov dword [rbp + 0x90], 0x68
lea rcx, [rbp + 0x110]
call fcn.0040ff60
xor ecx, ecx
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
setne al
mov byte [rbp + 0xff], al
cmp byte [rbp + 0xff], 0
je 0x7d1b41
mov rcx, 0xffffffffffe3f351
mov edx, 0x1d1e1f
call fcn.0078b350
mov rcx, qword [rbp + 0x70]
mov edx, eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [rbp + 0x8c], eax
cmp dword [rbp + 0x8c], 0
jne 0x7d1b16
mov rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0xf8]
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
setne al
mov byte [rbp + 0xff], al
mov rax, qword [rbp + 0x118]
mov ecx, dword [rbp + 0xf8]
mov dword [rax], ecx
jmp 0x7d1b1d
mov byte [rbp + 0xff], 0
mov rcx, qword [rbp + 0x70]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0x78]
call sub.kernel32.dll_CloseHandle
jmp 0x7d1b40
nop
lea rcx, [rbp + 0x110]
call fcn.0040f650
movzx rax, byte [rbp + 0xff]
lea rsp, [rbp + 0x100]
pop rbp
ret
Function at 0x7d1b90
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rdx
mov rcx, qword [rbp + 0x88]
call fcn.0040f7e0
nop
mov dword [rbp + 0x48], 0x1c9d59
mov dword [rbp + 0x4c], 0x391f7a
mov eax, 0xff68114d
sub eax, dword [rbp + 0x4c]
movsxd rax, eax
cmp qword [0x00863c98], rax
jge 0x7d1bf6
mov eax, dword [rbp + 0x48]
sub eax, 0x432162
cmp eax, dword [rbp + 0x4c]
setne al
mov byte [0x00863c8c], al
mov dword [rbp + 0x48], 0x104d2c
mov byte [rbp + 0x47], 1
cmp byte [rbp + 0x47], 0
je 0x7d1c1a
cmp dword [rbp + 0x48], 0
jge 0x7d1c1a
cmp dword [rbp + 0x4c], 0
jle 0x7d1c19
cmp dword [rbp + 0x4c], 0
jg 0x7d1c13
nop
mov rcx, qword [rbp + 0x80]
call fcn.0040f650
call fcn.004452a0
mov rcx, rax
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x88]
call fcn.00444690
mov rcx, 0xffffffffffe24b28
mov edx, 0x1db4e9
call fcn.0078b350
mov dword [rbp + 0x6c], eax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
je 0x7d1c6d
mov rax, qword [rbp + 0x38]
mov rax, qword [rax - 8]
mov qword [rbp + 0x38], rax
xor eax, eax
mov ecx, dword [rbp + 0x38]
mov dword [rbp + 0x5c], eax
cmp dword [rbp + 0x5c], ecx
jg 0x7d1c9d
sub ecx, eax
add ecx, 1
mov rax, qword [rbp + 0x50]
movsxd rdx, dword [rbp + 0x5c]
lea rax, [rax + rdx]
movzx rdx, byte [rbp + 0x6c]
xor byte [rax], dl
add dword [rbp + 0x5c], 1
sub ecx, 1
test ecx, ecx
jne 0x7d1c7f
nop
mov rcx, 0xffffffffffe80c60
mov edx, 0x17f39f
call fcn.0078b350
mov rcx, qword [0x006f90f0]
mov dl, 1
mov r8d, eax
call fcn.006fa7f0
mov qword [rbp + 0x60], rax
nop
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x30], rax
cmp qword [rbp + 0x30], 0
je 0x7d1ce0
mov rax, qword [rbp + 0x30]
mov rax, qword [rax - 8]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x50]
mov rax, qword [rbp + 0x30]
lea r9, [rax - 1]
call fcn.006fa280
jmp 0x7d1d06
mov rcx, qword [rbp + 0x60]
call fcn.0040c450
nop
lea rcx, [rbp + 0x50]
mov rdx, qword [0x00406450]
call fcn.00413f20
lea rcx, [rbp + 0x88]
call fcn.0040f650
mov rax, qword [rbp + 0x80]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x7e5600
Capabilities:
Create process on windows
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x38], rbp
mov dword [rbp + 0xa0], ecx
mov dword [rbp + 0xa8], edx
nop
mov rcx, 0xffffffffffea403b
mov edx, 0x15bfc5
call fcn.0078b350
mov ecx, dword [rbp + 0xa0]
cmp rcx, rax
jle 0x7e567e
mov rcx, 0xffffffffffe3dce9
mov edx, 0x1c2317
call fcn.0078b350
mov ecx, dword [rbp + 0xa0]
mov edx, eax
call sub.kernel32.dll_TerminateProcess
mov ecx, 0x131374
mov edx, 0x131374
call fcn.0078b350
mov ecx, dword [rbp + 0xa8]
cmp rcx, rax
jle 0x7e576b
nop
mov qword [rbp + 0x68], 0
lea rcx, [rbp + 0x68]
lea rdx, [0x007e57d8]
mov r8d, 0x171296
call fcn.0078b4d0
lea rcx, [rbp + 0x48]
mov edx, dword [rbp + 0xa8]
call fcn.004335d0
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x48]
call fcn.00410f70
nop
lea rcx, [rbp + 0x68]
call fcn.0040f650
lea rcx, [rbp + 0x50]
lea rdx, [0x007e5824]
mov r8d, 0x1e72de
call fcn.0078b4d0
lea rcx, [rbp + 0x58]
lea rdx, [0x007e585c]
mov r8d, 0x1a41c4
call fcn.0078b4d0
mov rcx, 0xffffffffffe33f75
mov edx, 0x1cc08b
call fcn.0078b350
mov rbx, rax
mov rcx, qword [rbp + 0x58]
call fcn.00410b10
mov rsi, rax
mov rcx, qword [rbp + 0x50]
call fcn.00410b10
mov rdi, rax
mov rcx, qword [rbp + 0x60]
call fcn.00410b10
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
mov r9, rax
lea rax, [0x007e58a4]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
call sub.shell32.dll_ShellExecuteW
nop
lea rcx, [rbp + 0x48]
mov edx, 4
call fcn.0040f730
lea rsp, [rbp + 0x78]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x7ec140
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0xc0
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x78], rbp
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], rdx
nop
movzx rcx, byte [0x00864e1d]
call fcn.007ec120
mov dword [rbp + 0xb4], eax
movzx rcx, byte [0x00864e1e]
call fcn.007ec120
add dword [rbp + 0xb4], eax
cmp dword [rbp + 0xb4], 0
jge 0x7ec204
movsxd rax, dword [rbp + 0xb4]
mov qword [0x00864e20], rax
nop
mov rcx, 0xffffffffffeb173f
mov edx, 0x14f0c1
call fcn.0078b350
mov ecx, eax
call fcn.004350e0
mov qword [rbp + 0xb8], rax
mov rcx, 0xffffffffffeef62f
mov edx, 0x1111d1
call fcn.0078b350
mov ecx, eax
mov rdx, qword [rbp + 0xb8]
call sub.kernel32.dll_GetTempPathW
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xb8]
call fcn.00410ba0
mov rax, qword [rbp + 0xd0]
mov rcx, qword [rax]
mov dl, 1
call fcn.00434230
test al, al
jne 0x7ec2a7
lea rcx, [rbp + 0x70]
call fcn.005538c0
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0x70]
call fcn.0040fc80
jmp 0x7ec2a7
lea rcx, [rbp + 0x60]
mov rax, qword [rbp + 0xd0]
mov rdx, qword [rax]
call fcn.0043e9b0
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0x60]
call fcn.0040fc80
mov rcx, qword [rbp + 0xd8]
call fcn.0040f650
mov rax, qword [rbp + 0xd8]
mov rcx, qword [rax]
mov dl, 1
call fcn.00434230
test al, al
jne 0x7ec364
lea rcx, [rbp + 0x50]
call fcn.005537d0
lea rcx, [rbp + 0xa8]
mov rdx, qword [rbp + 0x50]
call fcn.0043e9b0
lea rcx, [rbp + 0x48]
lea rdx, [0x007ec490]
mov r8d, 0x131dcf
call fcn.0078b4d0
lea rcx, [rbp + 0x40]
lea rdx, [0x007ec4e0]
mov r8d, 0x129748
call fcn.0078b4d0
lea rcx, [rbp + 0xa8]
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x48]
mov r9, qword [rbp + 0x40]
movzx rax, byte [0x007ec534]
mov byte [rsp + 0x20], al
call fcn.004423c0
mov rcx, qword [rbp + 0xd8]
mov rdx, qword [rbp + 0x58]
call fcn.0040fc80
mov rax, qword [rbp + 0xd8]
mov rcx, qword [rax]
mov dl, 1
call fcn.00434230
test al, al
jne 0x7ec382
mov byte [rbp + 0x8f], 1
jmp 0x7ec3ef
mov rcx, qword [rbp + 0xd8]
lea rdx, [rbp + 0x98]
mov rax, qword [0x008685b0]
mov r8d, dword [rax]
call fcn.00442f50
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x98]
call fcn.0040fd00
lea rcx, [rbp + 0x38]
lea rdx, [0x007ec544]
mov r8d, 0x191a4b
call fcn.0078b4d0
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x90], rax
lea rcx, [rbp + 0xa0]
mov rdx, qword [rbp + 0x90]
xor r8, r8
call fcn.00441bc0
mov byte [rbp + 0x8f], al
cmp byte [rbp + 0x8f], 0
je 0x7ec411
lea rcx, [rbp + 0x30]
call fcn.00799a80
mov rcx, qword [rbp + 0xd8]
mov rdx, qword [rbp + 0x30]
call fcn.0040fc80
nop
lea rcx, [rbp + 0x30]
mov edx, 9
call fcn.0040f730
lea rcx, [rbp + 0x98]
mov edx, 3
call fcn.0040f730
lea rsp, [rbp + 0xc0]
pop rbp
ret
Function at 0x180001904
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xae8
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rax, qword [rsp + 0xb30]
mov rdi, rcx
mov rcx, qword [rsp + 0xb38]
mov qword [rsp + 0x48], rcx
xor ecx, ecx
mov qword [rsp + 0x38], r9
mov rbp, r8
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x40], rax
cmp rdi, rcx
je 0x180001b20
cmp r8, rcx
jne 0x180001964
cmp rax, rcx
je 0x180001b20
cmp word [rdi + 2], 0x3a
je 0x1800019bb
cmp word [rdi + 2], 0x5c
je 0x1800019bb
mov word [rsp + 0x6c0], cx
lea rcx, [rsp + 0x6c2]
xor edx, edx
mov r8d, 0x40e
call fcn.180055bd0
lea rdx, [rsp + 0x6c0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x6c0]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdi, [rsp + 0x6c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180001b20
test al, 0x10
je 0x180001b20
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x18007c19c]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180001b20
mov ebx, 1
lea rdx, [0x18007c1a0]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180001af7
lea rdx, [0x18007c1a4]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x180001af7
cmp dword [rsp + 0x50], 0xffffffff
je 0x180001af7
lea rcx, [rsp + 0x2a0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [rsp + 0x50], 0x10
je 0x180001adf
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180001aac
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x2a0]
call rax
test eax, eax
je 0x180001b0e
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x180001af7
mov rdx, qword [rsp + 0x48]
mov r9, qword [rsp + 0x38]
mov r8, rbp
mov qword [rsp + 0x28], rdx
mov edx, ecx
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
call fcn.180001904
cmp eax, 2
jmp 0x180001af5
test rbp, rbp
je 0x180001af7
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x2a0]
call rbp
test eax, eax
je 0x180001b0e
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x180001b13
jmp 0x180001a20
mov ebx, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x180001b22
xor eax, eax
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.180055580
add rsp, 0xae8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180001b40
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0x740
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x730], rax
mov rbp, rdx
mov rbx, rcx
mov qword [r11 - 0x6c8], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
lea rcx, [rsp + 0x50]
call fcn.1800063b8
nop
cmp rbp, r12
jne 0x180001bcb
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18000641c
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x50]
call fcn.180007ba8
nop
mov rcx, qword [rsp + 0x50]
call fcn.180054958
mov rax, rbx
jmp 0x180001d3e
mov rdx, rbp
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..________.dirty
lea rcx, [rsp + 0x520]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180001d11
lea rdx, [0x18007c1a0]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x180001cee
lea rdx, [0x18007c1a4]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x180001cee
cmp dword [rsp + 0xc0], 0xffffffff
je 0x180001cee
mov rdx, rbp
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xec]
lea rcx, [rsp + 0x310]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x310]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x28]
call fcn.180007250
nop
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.18000649c
nop
cmp qword [rsp + 0x48], 8
jb 0x180001cee
mov rcx, qword [rsp + 0x30]
call fcn.180054958
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r12d
jne 0x180001c14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18000641c
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x50]
call fcn.180007ba8
nop
mov rcx, qword [rsp + 0x50]
call fcn.180054958
mov rax, rbx
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.180055580
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180001de8
Capabilities:
Check if file exists
Clear file content
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x470
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor esi, esi
mov rdi, rdx
mov rbx, rcx
cmp rcx, rsi
je 0x180001f31
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x180001f31
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], si
call fcn.180055bd0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180002fc8
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180001e6f
shr eax, 4
not eax
and eax, 1
jmp 0x180001f33
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x250]
call fcn.180001f58
cmp eax, esi
je 0x180001f31
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rdi, rsi
je 0x180001efe
cmp rax, rsi
je 0x180001f0e
cmp rax, 0xffffffffffffffff
je 0x180001efe
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp rbx, rsi
je 0x180001f0e
mov ecx, 1
cmp rbx, 0xffffffffffffffff
jne 0x180001f10
mov ecx, esi
cmp cl, sil
mov edi, esi
setne dil
cmp rbx, 0xffffffffffffffff
je 0x180001f2d
cmp rbx, rsi
je 0x180001f2d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x180001f33
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180055580
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180002678
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18009a658]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor esi, esi
mov dil, dl
mov rbx, rcx
cmp rcx, rsi
je 0x180002703
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], si
call fcn.180055bd0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
je 0x180002703
lea rcx, [rsp + 0x20]
mov r9, rbx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, esi
jbe 0x180002703
cmp dil, sil
je 0x1800026fc
xor edx, edx
mov rcx, rbx
call fcn.180001de8
jmp 0x180002705
mov eax, 1
jmp 0x180002705
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180055580
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret