joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001570
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x6b0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x6e0], rbx
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rsi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
cmp qword [rdx + 0x18], 0xc8
jbe 0x1800015db
mov qword [rcx + 0x20], 7
mov qword [rcx + 0x18], rbp
mov word [rcx + 8], bp
xor r8d, r8d
lea rdx, [0x18009545c]
call fcn.180006960
mov rax, rbx
jmp 0x1800017af
mov word [rsp + 0x290], bp
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x292]
call fcn.1800729a0
mov r8d, 0x104
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x18000167f
lea rcx, str.cachekvstore
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add edi, eax
cmp edi, 0x104
jge 0x18000167f
lea rdx, [0x18009779c]
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, str.cachekvstore
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov r8d, 0x104
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.1800013c0
cmp qword [rax + 0x20], 8
jb 0x180001699
mov rdx, qword [rax + 8]
jmp 0x18000169d
lea rdx, [rax + 8]
lea rcx, [rsp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp qword [rsp + 0x78], 8
jb 0x1800016bd
mov rcx, qword [rsp + 0x60]
call fcn.18006e998
lea rcx, [rsp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180001774
lea edx, [rax + 2]
lea rcx, [rsp + 0x58]
call fcn.180001540
nop
cmp qword [rsp + 0x70], 0
je 0x180001762
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8d, 0x208
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rdx, str.cachekvstore
lea rcx, [rsp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1800013c0
cmp qword [rax + 0x20], 8
jb 0x18000173d
mov rdx, qword [rax + 8]
jmp 0x180001741
lea rdx, [rax + 8]
lea rcx, [rsp + 0x290]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp qword [rsp + 0x50], 8
jb 0x180001762
mov rcx, qword [rsp + 0x38]
call fcn.18006e998
nop
cmp qword [rsp + 0x78], 8
jb 0x180001774
mov rcx, qword [rsp + 0x60]
call fcn.18006e998
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rbp
mov word [rbx + 8], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x290]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x290]
mov rcx, rbx
call fcn.180006960
mov rax, rbx
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.18006e130
mov rbx, qword [rsp + 0x6e0]
add rsp, 0x6b0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000e0b0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0xe0
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov esi, r9d
mov r10, r8
xor ebp, ebp
mov edi, ebp
mov dword [rax + 0x10], ebp
test r8, r8
je 0x18000e1fe
mov qword [rax - 0x70], 0xf
mov qword [rax - 0x78], rbp
mov byte [rsp + 0x60], dil
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r10
lea rcx, [rsp + 0x58]
call fcn.180006440
nop
mov dword [rsp + 0xf8], 1
mov qword [rsp + 0x50], socket
mov qword [rsp + 0x48], rbp
mov byte [rsp + 0x38], bpl
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.SoftwareWOW6432Nodeprojonepodlpkeyrule_secClass_
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlpkeyrule_secClass_
lea rcx, [rsp + 0x30]
call fcn.180006440
nop
mov dword [rsp + 0xf8], 3
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xa8]
call fcn.18000e020
mov rbx, rax
mov dword [rsp + 0xf8], 7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.18000e020
lea edi, [rbp + 0xf]
cmp qword [rbx + 0x20], 8
jb 0x18000e1b1
mov r8, qword [rbx + 8]
jmp 0x18000e1b5
lea r8, [rbx + 8]
cmp qword [rax + 0x20], 8
jb 0x18000e1c2
mov rdx, qword [rax + 8]
jmp 0x18000e1c6
lea rdx, [rax + 8]
mov dword [rsp + 0xf8], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov r9d, 4
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, ebp
test eax, eax
sete bl
jmp 0x18000e200
mov ebx, ebp
test dil, 8
je 0x18000e23d
and edi, 0xfffffff7
cmp qword [rsp + 0xa0], 8
jb 0x18000e221
mov rcx, qword [rsp + 0x88]
call fcn.18006e998
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], rbp
mov word [rsp + 0x88], bp
test dil, 4
je 0x18000e27a
and edi, 0xfffffffb
cmp qword [rsp + 0xc8], 8
jb 0x18000e25e
mov rcx, qword [rsp + 0xb0]
call fcn.18006e998
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbp
mov word [rsp + 0xb0], bp
test dil, 2
je 0x18000e2a8
and edi, 0xfffffffd
cmp qword [rsp + 0x50], 0x10
jb 0x18000e295
mov rcx, qword [rsp + 0x38]
call fcn.18006e998
mov qword [rsp + 0x50], socket
mov qword [rsp + 0x48], rbp
mov byte [rsp + 0x38], 0
test dil, 1
je 0x18000e2c8
cmp qword [rsp + 0x78], 0x10
jb 0x18000e2c4
mov rcx, qword [rsp + 0x60]
call fcn.18006e998
mov eax, ebx
jmp 0x18000e2ca
mov eax, ebx
jmp 0x18000e2ca
mov eax, ebx
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180014080
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov dword [r11 + 8], 4
lea rax, [r11 + 8]
mov qword [rsp + 0x28], rax
lea rax, [r11 + 0x18]
mov qword [rsp + 0x20], rax
lea r9, [r11 + 0x10]
lea r8, [0x180095c90]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180014264
cmp dword [rsp + 0xc8], 4
jne 0x180014264
cmp dword [rsp + 0xd0], eax
je 0x180014264
mov dword [rsp + 0xc0], 4
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc8]
lea r8, str.PersonMode
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180014153
cmp dword [rsp + 0xc8], 4
jne 0x180014153
cmp dword [rsp + 0xd0], eax
jne 0x180014264
mov dword [rsp + 0xc0], 4
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc8]
lea r8, str.dlpOnline
lea rdx, str.SoftwareWOW6432Nodeprojonepodlpdlpcore_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1800141b6
cmp dword [rsp + 0xc8], 4
jne 0x1800141b6
cmp dword [rsp + 0xd0], eax
je 0x180014264
lea r8, str.SoftwareWOW6432Nodeprojonepodlpkeyrulemain_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x70]
call fcn.180049980
xor ebx, ebx
cmp qword [rax + 0x38], rbx
seta bl
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.180007120
mov rcx, qword [rsp + 0xa0]
call fcn.18006e998
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov rcx, qword [rsp + 0x70]
call fcn.18006e998
test ebx, ebx
je 0x180014264
mov eax, 1
jmp 0x180014266
xor eax, eax
add rsp, 0xb0
pop rbx
ret
Function at 0x18001fc90
Capabilities:
Create thread

Disassembly:
mov eax, 0x1058
call fcn.180082cd0
sub rsp, rax
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x1040], rax
cmp dword [0x1800bcdf4], 0
je 0x18001fd52
lea rax, str._EncLogThread
mov qword [rsp + 0x1050], rbx
lea r9, str..enclog.cpp
mov qword [rsp + 0x28], rax
lea r8, str._s._d:_s
lea rcx, [rsp + 0x40]
xor ebx, ebx
mov edx, 0x800
mov dword [rsp + 0x20], 0x45
mov dword [0x1800bcdf4], ebx
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r8, [0x18001fab0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x18001fd41
mov edx, dword [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rcx, str.thread__d_created:__s
call fcn.18002f1b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x1050]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.18006e130
add rsp, 0x1058
ret
Function at 0x18002dc40
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov r13, rcx
mov r8, rcx
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.18003441c
nop
lea rcx, [0x1800977a8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetTickCount64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002dc9c
call rax
mov r12, rax
jmp 0x18002dca5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r12d, eax
mov rbx, qword [rsp + 0x68]
cmp rbx, qword [rsp + 0x70]
jbe 0x18002dcb6
call fcn.18006e940
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdi, [rbx + 8]
xor r14d, r14d
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x70]
cmp qword [rsp + 0x68], rsi
jbe 0x18002dcf2
call fcn.18006e940
test rbx, rbx
je 0x18002dcfe
cmp rbx, qword [rsp + 0x50]
je 0x18002dd03
call fcn.18006e940
cmp rbp, rsi
je 0x18002de04
test rbx, rbx
jne 0x18002dd1b
call fcn.18006e940
mov r11, r14
jmp 0x18002dd1e
mov r11, qword [rbx]
cmp rbp, qword [r11 + 0x20]
jb 0x18002dd29
call fcn.18006e940
cmp qword [rdi + 0x18], 8
jb 0x18002dd35
mov r8, qword [rdi]
jmp 0x18002dd38
mov r8, rdi
mov dword [rsp + 0xc8], 8
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd0]
mov rdx, r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18002dd8d
cmp dword [rsp + 0xd0], 0xb
jne 0x18002dd8d
mov rcx, qword [rsp + 0xd8]
jmp 0x18002dd90
mov rcx, r14
mov rax, r12
sub rax, rcx
cmp rax, 0x2710
jbe 0x18002ddda
test rbx, rbx
jne 0x18002ddad
call fcn.18006e940
mov r11, r14
jmp 0x18002ddb0
mov r11, qword [rbx]
cmp rbp, qword [r11 + 0x20]
jb 0x18002ddbb
call fcn.18006e940
cmp qword [rdi + 0x18], 8
jb 0x18002ddc7
mov r8, qword [rdi]
jmp 0x18002ddca
mov r8, rdi
mov rdx, r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test rbx, rbx
jne 0x18002dde9
call fcn.18006e940
mov r11, r14
jmp 0x18002ddec
mov r11, qword [rbx]
cmp rbp, qword [r11 + 0x20]
jb 0x18002ddf7
call fcn.18006e940
add rbp, 0x28
add rdi, 0x28
jmp 0x18002dce1
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x18002de56
mov rsi, qword [rsp + 0x70]
cmp rbx, rsi
je 0x18002de4c
add rbx, 0x20
nop dword [rax]
cmp qword [rbx], 8
jb 0x18002de2f
mov rcx, qword [rbx - 0x18]
call fcn.18006e998
mov qword [rbx], 7
mov qword [rbx - 8], r14
mov word [rbx - 0x18], r14w
add rbx, 0x28
lea rax, [rbx - 0x20]
cmp rax, rsi
jne 0x18002de20
mov rcx, qword [rsp + 0x68]
call fcn.18006e998
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov rcx, qword [rsp + 0x50]
call fcn.18006e998
add rsp, 0x80
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800311d4
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xae8
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rax, qword [rsp + 0xb30]
mov rdi, rcx
mov rcx, qword [rsp + 0xb38]
mov qword [rsp + 0x48], rcx
xor ecx, ecx
mov qword [rsp + 0x38], r9
mov rbp, r8
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x40], rax
cmp rdi, rcx
je 0x1800313f0
cmp r8, rcx
jne 0x180031234
cmp rax, rcx
je 0x1800313f0
cmp word [rdi + 2], 0x3a
je 0x18003128b
cmp word [rdi + 2], 0x5c
je 0x18003128b
mov word [rsp + 0x6c0], cx
lea rcx, [rsp + 0x6c2]
xor edx, edx
mov r8d, 0x40e
call fcn.1800729a0
lea rdx, [rsp + 0x6c0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x6c0]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdi, [rsp + 0x6c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800313f0
test al, 0x10
je 0x1800313f0
lea rcx, [rsp + 0x4b0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x180097794]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800313f0
mov ebx, 1
lea rdx, [0x180097798]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1800313c7
lea rdx, [0x18009779c]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1800313c7
cmp dword [rsp + 0x50], 0xffffffff
je 0x1800313c7
lea rcx, [rsp + 0x2a0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test byte [rsp + 0x50], 0x10
je 0x1800313af
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x18003137c
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x2a0]
call rax
test eax, eax
je 0x1800313de
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x1800313c7
mov rdx, qword [rsp + 0x48]
mov r9, qword [rsp + 0x38]
mov r8, rbp
mov qword [rsp + 0x28], rdx
mov edx, ecx
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
call fcn.1800311d4
cmp eax, 2
jmp 0x1800313c5
test rbp, rbp
je 0x1800313c7
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x2a0]
call rbp
test eax, eax
je 0x1800313de
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1800313e3
jmp 0x1800312f0
mov ebx, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
jmp 0x1800313f2
xor eax, eax
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.18006e130
add rsp, 0xae8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180031410
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x740
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x730], rax
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
lea rcx, [rsp + 0x60]
call fcn.180004240
nop
cmp rbp, r12
jne 0x18003148b
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18000b430
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x60]
call fcn.1800042b0
mov rax, rbx
jmp 0x1800315f3
mov rdx, rbp
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..________.dirty
lea rcx, [rsp + 0x520]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800315d1
lea rdx, [0x180097798]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x1800315ae
lea rdx, [0x18009779c]
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, r12d
je 0x1800315ae
cmp dword [rsp + 0xc0], 0xffffffff
je 0x1800315ae
mov rdx, rbp
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0xec]
lea rcx, [rsp + 0x310]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x310]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x28]
call fcn.180006960
nop
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.18000cfd0
nop
cmp qword [rsp + 0x48], 8
jb 0x1800315ae
mov rcx, qword [rsp + 0x30]
call fcn.18006e998
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r12d
jne 0x1800314d4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.18000b430
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x60]
call fcn.1800042b0
mov rax, rbx
mov rcx, qword [rsp + 0x730]
xor rcx, rsp
call fcn.18006e130
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x18003169c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor edi, edi
mov rbx, rcx
cmp rcx, rdi
je 0x1800317aa
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jge 0x1800317aa
lea rcx, [rsp + 0x42]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x40], di
call fcn.1800729a0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180032764
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18003171b
shr eax, 4
not eax
and eax, 1
jmp 0x1800317ac
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rsp + 0x250]
call fcn.1800317d0
cmp eax, edi
je 0x1800317aa
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, rdi
je 0x180031788
mov ecx, 1
cmp rax, 0xffffffffffffffff
jne 0x18003178a
mov ecx, edi
cmp cl, dil
mov ebx, edi
setne bl
cmp rax, 0xffffffffffffffff
je 0x1800317a6
cmp rax, rdi
je 0x1800317a6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x1800317ac
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18006e130
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret
Function at 0x180031f88
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2070
call fcn.180082cd0
sub rsp, rax
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x2060], rax
xor esi, esi
mov rbx, rdx
mov rdi, rcx
cmp rcx, rsi
je 0x180032155
cmp rdx, rsi
je 0x180032155
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
jne 0x180031fe0
mov esi, 1
jmp 0x180032155
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov rdi, rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rdi, rsi
je 0x18003212d
cmp rdi, 0xffffffffffffffff
je 0x18003212d
cmp rax, rsi
je 0x18003212d
cmp rax, 0xffffffffffffffff
je 0x180032141
xor eax, eax
lea rdx, [rsp + 0x50]
mov rcx, rdi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
je 0x180032098
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, esi
je 0x180032098
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x50], rax
je 0x1800320a6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18003214c
mov dword [rsp + 0x40], esi
jmp 0x1800320fc
mov r8d, dword [rsp + 0x40]
cmp r8d, esi
je 0x180032123
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x1060]
mov rcx, rbx
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
je 0x180032098
mov eax, dword [rsp + 0x40]
cmp eax, dword [rsp + 0x44]
jne 0x180032098
lea rdx, [rsp + 0x1060]
lea rcx, [rsp + 0x60]
mov r8, rax
call fcn.1800780a0
cmp eax, esi
jne 0x180032098
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, esi
jne 0x1800320ac
jmp 0x180032098
mov esi, 1
jmp 0x180032098
cmp rax, 0xffffffffffffffff
je 0x180032141
cmp rax, rsi
je 0x180032141
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rdi, 0xffffffffffffffff
je 0x180032155
cmp rdi, rsi
je 0x180032155
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.18006e130
lea r11, [rsp + 0x2070]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18003217c
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18003219f
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800321ba
test al, 1
je 0x1800321b1
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
add rsp, 0x20
pop rbx
ret
Function at 0x1800321c0
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
cmp rcx, rbx
je 0x18003221f
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
je 0x18003221f
lea rax, [0x180032240]
lea r8, [0x18003222c]
lea edx, [rbx + 1]
xor r9d, r9d
mov rcx, rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.1800311d4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, ebx
sete bl
mov eax, ebx
jmp 0x180032221
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180032344
Capabilities:
Check if file exists
Delete file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov ebp, r8d
mov r12, rdx
mov rdi, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
test eax, eax
jne 0x18003237d
xor edx, edx
mov rcx, rdi
call fcn.18003169c
test eax, eax
je 0x180032429
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x180032408
cmp rax, 0xffffffffffffffff
je 0x180032408
and dword [rsp + 0x78], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, ebp
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800323eb
cmp dword [rsp + 0x78], ebp
jne 0x1800323eb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x18003242b
test esi, esi
jne 0x180032415
mov rcx, rbx
or rbx, 0xffffffffffffffff
cmp rcx, rbx
je 0x18003240c
test rcx, rcx
je 0x18003240c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18003240c
test esi, esi
jne 0x180032415
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp rbx, 0xffffffffffffffff
je 0x180032429
test rbx, rbx
je 0x180032429
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret

Function at 0x1800326d4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x21]
xor ebx, ebx
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], bl
call fcn.1800729a0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.1800325c4
mov r11d, 0x179b06cc
movzx edx, byte [rsp + rbx + 0x20]
movzx eax, r11b
mov ecx, r11d
xor rdx, rax
shr ecx, 8
lea rax, [0x1800bcf40]
mov r11d, dword [rax + rdx*4]
inc rbx
xor r11d, ecx
cmp rbx, 0x24
jl 0x18003271c
not r11d
mov eax, r11d
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18006e130
add rsp, 0x140
pop rbx
ret