joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140124710
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov r13, qword [rsp + 0xb0]
mov rcx, qword [rcx + 0x38]
add rcx, r13
setb dl
movabs rax, 0xfffffffe0
cmp rcx, rax
seta r8b
xor eax, eax
or r8b, dl
jne 0x14012498f
mov r14, r9
lea rbp, [rsi + 0x50]
mov rbx, qword [rsi + 0x160]
mov r15, qword [rsi + 0x150]
mov rax, qword [rsi + 0x158]
mov qword [rsp + 0x30], rax
mov qword [rsi + 0x38], rcx
cmp dword [rsi + 0x174], 0
je 0x14012479f
lea rcx, [rsi + 0x40]
mov rdx, rbp
mov rax, r15
call qword [0x140185010]
mov dword [rsi + 0x174], 0
mov eax, dword [rsi + 0x170]
test eax, eax
je 0x140124806
test r13, r13
je 0x140124984
mov cl, byte [r12]
inc r12
mov edx, eax
mov r8b, byte [rsi + rdx + 0x10]
xor r8b, cl
mov byte [r14], r8b
xor byte [rsi + rdx + 0x40], cl
inc r14
lea r8, [r13 - 1]
inc eax
and eax, 0xf
je 0x1401247e1
cmp r13, 1
mov r13, r8
jne 0x1401247b2
test eax, eax
jne 0x140124984
lea rcx, [rsi + 0x40]
mov qword [rsp + 0x28], rbp
mov rdx, rbp
mov rax, r15
mov r15, r8
call qword [0x140185010]
mov r8, r15
jmp 0x14012480e
mov qword [rsp + 0x28], rbp
mov r8, r13
mov ebp, dword [rsi + 0xc]
bswap ebp
cmp r8, 0xc00
jb 0x1401248cb
lea rax, [rsi + 0x40]
mov qword [rsp + 0x38], rax
lea r13, [rsi + 0x10]
mov rax, r14
mov rcx, r12
mov qword [rsp + 0x40], r8
mov r15, rcx
mov r14, rax
mov r9d, 0xc00
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
mov r8, r15
mov rax, qword [rsp + 0x30]
call qword [0x140185010]
xor r12d, r12d
mov rcx, rsi
mov rdx, r13
mov r8, rdi
mov rax, rbx
call qword [0x140185010]
inc ebp
mov eax, ebp
bswap eax
mov dword [rsi + 0xc], eax
mov rax, qword [rsi + 0x10]
xor rax, qword [r15 + r12]
mov qword [r14 + r12], rax
mov rax, qword [rsi + 0x18]
xor rax, qword [r15 + r12 + 8]
mov qword [r14 + r12 + 8], rax
add r12, 0x10
cmp r12, 0xc00
jne 0x14012485f
mov r8, qword [rsp + 0x40]
add r8, 0xfffffffffffff400
lea rax, [r14 + r12]
lea rcx, [r15 + r12]
cmp r8, 0xbff
ja 0x140124833
add r14, r12
add r15, r12
mov r12, r15
mov r9, r8
and r9, 0xff0
je 0x140124943
lea rcx, [rsi + 0x40]
mov rdx, qword [rsp + 0x28]
mov r15, r8
mov r8, r12
mov rax, qword [rsp + 0x30]
call qword [0x140185010]
mov r8, r15
lea r15, [rsi + 0x10]
mov rcx, rsi
mov rdx, r15
mov r13, r8
mov r8, rdi
mov rax, rbx
call qword [0x140185010]
mov r8, r13
inc ebp
mov eax, ebp
bswap eax
mov dword [rsi + 0xc], eax
mov rax, qword [rsi + 0x10]
xor rax, qword [r12]
mov qword [r14], rax
mov rax, qword [rsi + 0x18]
xor rax, qword [r12 + 8]
mov qword [r14 + 8], rax
add r14, 0x10
add r12, 0x10
add r8, 0xfffffffffffffff0
cmp r8, 0xf
ja 0x1401248f8
test r8, r8
je 0x1401249a0
lea rdx, [rsi + 0x10]
mov rcx, rsi
mov r15, r8
mov r8, rdi
mov rax, rbx
call qword [0x140185010]
mov r8, r15
inc ebp
bswap ebp
mov dword [rsi + 0xc], ebp
xor eax, eax
mov ecx, eax
mov dl, byte [r12 + rcx]
xor byte [rsi + rcx + 0x40], dl
xor dl, byte [rsi + rcx + 0x10]
mov byte [r14 + rcx], dl
inc rax
cmp r8, rax
jne 0x14012496a
mov dword [rsi + 0x170], eax
mov eax, 1
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x140124984
Function at 0x14014ee50
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x14014ee63
cmp dword [0x1401aaf20], ecx
jle 0x14014ee6a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call fcn.14014eeb0
test edi, edi
je 0x14014ee63
cmp byte [rsi + rdi - 1], 0xa
je 0x14014ee63
lea rcx, [0x14016749b]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14014eeb0

Function at 0x14014eeb0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140192040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
lea r14, [rsp + 0x34]
mov r15, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x14014ef27
mov dword [rsp + 0x34], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r15
mov ecx, dword [rsp + 0x34]
test eax, eax
cmovne eax, ecx
je 0x14014ef27
add rdi, rax
test ecx, ecx
jne 0x14014eeed
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b4010
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140157040
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x14015707f
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x14015704f
mov dword [rsi], 7
jmp 0x14015704f
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.14006c5b0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14015705b
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14015705b
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x140157131
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x140157051
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14015704f
Function at 0x140001008
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xa0
xor r9d, r9d
mov rbx, r8
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
nop dword [rax + rax]
and dword [rsp + 0x6c], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop dword [rax + rax]
test byte [rsp + 0x6c], 1
lea r8, str.wordpad.exe
movzx eax, word [rsp + 0x70]
mov ecx, 0xa
cmovne ecx, eax
mov r9, rbx
mov dword [rsp + 0x28], ecx
xor edx, edx
and qword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax + rax]
xor eax, eax
add rsp, 0xa0
pop rbx
ret
Function at 0x180004ff0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x18008e6c4], 0
jne 0x180005027
lea rbx, [0x18008e5c0]
mov edx, 0x104
mov dword [0x18008e6c4], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x18008e5c0]
add rsp, 0x20
pop rbx
ret

Function at 0x1800055f0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x18008f268], 0
jne 0x180005627
lea rbx, [0x18008f060]
mov edx, 0x104
mov dword [0x18008f268], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x18008f060]
add rsp, 0x20
pop rbx
ret

Function at 0x180005d30
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x180090814], 0
jne 0x180005dae
mov dword [0x180090814], 1
call fcn.180028fc0
lea rbx, [0x180090710]
mov edx, 0x104
mov rcx, rbx
test eax, eax
je 0x180005d9f
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x180005da5
mov qword [rsp + 0x30], rdi
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rcx, qword [0x18006fee8]
mov rax, rbx
mov qword [rdi - 1], rcx
movzx ecx, word [0x18006fef0]
mov word [rdi + 7], cx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x180090710]
add rsp, 0x20
pop rbx
ret

Function at 0x1800062c0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x180091198], 0
jne 0x180006348
mov dword [0x180091198], 1
call fcn.180028fc0
lea rbx, [0x180090f90]
mov edx, 0x104
mov rcx, rbx
test eax, eax
je 0x180006339
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x18000633f
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rdi
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
mov rcx, qword [str.SysWow64]
mov rax, rbx
mov qword [rdi - 2], rcx
mov rcx, qword [0x18006ff68]
mov qword [rdi + 6], rcx
mov ecx, dword [0x18006ff70]
mov dword [rdi + 0xe], ecx
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x180090f90]
add rsp, 0x20
pop rbx
ret
Function at 0x1800070a0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, r8
lea r8, [rsp + 0x30]
xor edi, edi
mov rcx, 0xffffffff80000002
mov rbx, r9
mov rsi, rdx
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1800070f3
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180007135
test rbx, rbx
je 0x18000710a
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx + rcx]
mov rcx, qword [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180007150
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
push rdi
sub rsp, 0x40
mov rdi, r8
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
mov rbx, rdx
mov qword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x18000719d
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1800071d1
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
mov r9d, 4
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1800071e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
lea r8, [rsp + 0x38]
xor ebx, ebx
mov rcx, 0xffffffff80000002
mov rsi, rdx
mov qword [rsp + 0x38], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x18000722f
lea r8, [rsp + 0x38]
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1800072c9
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x68]
cmp r11d, 2
jb 0x1800072be
add r11d, 2
mov eax, 2
mov dword [rsp + 0x68], r11d
shr r11d, 1
mov ecx, r11d
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.18002ae9c
mov rbx, rax
test rax, rax
je 0x1800072be
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800072e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000002
mov rbx, rdx
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x180007330
lea r8, [rsp + 0x38]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180007375
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18000bae0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
mov rbx, rdx
repne scasb al, byte [rdi]
mov eax, 0x1f3
not rcx
dec rcx
sub eax, ecx
mov rdi, rcx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rax
mov qword [rsp + 0x28], rax
cmp rax, 0xffffffffffffffff
jne 0x18000bb42
lea eax, [rcx + 2]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
movsxd rdi, edi
mov esi, 1
mov qword [rsp + 0x30], rdi
nop
test byte [rbx], 0x10
je 0x18000bc05
cmp byte [rbx + 0x2c], 0x2e
jne 0x18000bb79
movzx eax, byte [rbx + 0x2d]
cmp al, 0x2e
jne 0x18000bb71
cmp byte [rbx + 0x2e], 0
je 0x18000bc2d
test al, al
je 0x18000bc2d
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbx + 0x2c]
repne scasb al, byte [rdi]
mov eax, dword [rsp + 0x20]
not rcx
cmp rax, rcx
jb 0x18000bc23
mov rax, qword [rsp + 0x30]
or rcx, 0xffffffffffffffff
mov rdi, rbp
mov byte [rax + rbp - 1], 0
xor eax, eax
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rbx + rcx + 0x2c]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18000bbb0
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
mov rdx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x1800705e4]
mov rcx, rbp
mov word [rdi - 1], ax
movzx eax, byte [0x1800705e6]
mov byte [rdi + 1], al
call fcn.18000bae0
mov rdi, qword [rsp + 0x30]
mov word [rdi + rbp - 1], 0x2a
mov esi, eax
jmp 0x18000bc28
mov r8, qword [rsp + 0x78]
lea rdx, [rbx + 0x2c]
mov rcx, rbp
mov byte [rdi + rbp - 1], 0
call qword [rsp + 0x70]
mov byte [rdi + rbp - 1], 0x2a
mov esi, eax
jmp 0x18000bc28
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
test esi, esi
je 0x18000bc47
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov rcx, qword [rsp + 0x28]
test eax, eax
jne 0x18000bb50
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x60]
mov eax, esi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000bc70
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
mov rbx, rdx
repne scasw ax, word [rdi]
mov eax, 0x1f3
not rcx
dec rcx
sub eax, ecx
mov rdi, rcx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
mov qword [rsp + 0x28], rax
cmp rax, 0xffffffffffffffff
jne 0x18000bcd3
lea eax, [rcx + 2]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
movsxd rdi, edi
mov esi, 1
xor r8d, r8d
mov qword [rsp + 0x30], rdi
test byte [rbx], 0x10
je 0x18000bdb2
cmp word [rbx + 0x2c], 0x2e
jne 0x18000bd11
movzx eax, word [rbx + 0x2e]
cmp ax, 0x2e
jne 0x18000bd08
cmp word [rbx + 0x30], 0
je 0x18000bde0
test ax, ax
je 0x18000bde0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbx + 0x2c]
repne scasw ax, word [rdi]
mov eax, dword [rsp + 0x20]
not rcx
cmp rax, rcx
jb 0x18000bdd6
mov rax, qword [rsp + 0x30]
or rcx, 0xffffffffffffffff
mov rdi, rbp
mov word [rbp + rax*2 - 2], r8w
xor eax, eax
repne scasw ax, word [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rbx + rcx + 0x2c]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x18000bd50
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
mov rdx, rbx
repne scasw ax, word [rdi]
mov eax, dword [0x1800705e8]
mov rcx, rbp
mov dword [rdi - 2], eax
movzx eax, word [0x1800705ec]
mov word [rdi + 2], ax
call fcn.18000bc70
mov rdi, qword [rsp + 0x30]
mov esi, eax
mov eax, 0x2a
mov word [rbp + rdi*2 - 2], ax
xor eax, eax
mov word [rbp + rdi*2], ax
jmp 0x18000bddb
mov word [rbp + rdi*2 - 2], r8w
mov r8, qword [rsp + 0x78]
lea rdx, [rbx + 0x2c]
mov rcx, rbp
call qword [rsp + 0x70]
mov esi, eax
mov eax, 0x2a
mov word [rbp + rdi*2 - 2], ax
jmp 0x18000bddb
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
test esi, esi
je 0x18000be00
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rcx, qword [rsp + 0x28]
mov r8d, 0
test eax, eax
jne 0x18000bce3
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x60]
mov eax, esi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000c8a0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x390
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov rbx, rcx
test rcx, rcx
je 0x18000cab9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x18000cab9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, eax
cmp eax, 0xffffffff
je 0x18000cab9
test al, 1
je 0x18000c908
and edi, 0xfffffffe
mov rcx, rbx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test dil, 0x10
je 0x18000caae
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x3a8], rsi
mov byte [rsp + 0x160], 0
call fcn.18002a9c0
lea rcx, [rsp + 0x160]
mov rdx, rbx
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x18000c950
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x160]
repne scasb al, byte [rdi]
movzx eax, word [0x1800705e4]
lea rcx, [rsp + 0x24]
mov word [rdi - 1], ax
movzx eax, byte [0x1800705e6]
xor edx, edx
mov r8d, 0x13c
mov dword [rsp + 0x20], 0
mov byte [rdi + 1], al
call fcn.18002a9c0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000ca9b
nop dword [rax]
lea rdx, [0x180070964]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000ca7c
lea rdx, [0x180070960]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18000ca7c
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x270], 0
call fcn.18002a9c0
lea rcx, [rsp + 0x270]
sub rcx, rbx
mov rdx, rbx
nop
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x18000ca20
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x160]
repne scasb al, byte [rdi]
movzx eax, word [0x1800703d4]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x160]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x4c]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18000ca60
lea rcx, [rsp + 0x270]
call fcn.18000c8a0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18000c9c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rsi, qword [rsp + 0x3a8]
jmp 0x18000cabb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x18000cabb
xor eax, eax
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.18002a990
mov rbx, qword [rsp + 0x3b0]
add rsp, 0x390
pop rdi
ret
Function at 0x18000cae0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x6d0
mov rax, qword [0x18008cb00]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov rbx, rcx
test rcx, rcx
je 0x18000cd67
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x18000cd67
mov qword [rsp + 0x6e8], rbp
xor ebp, ebp
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x20], rbp
call fcn.180009900
test eax, eax
je 0x18000cd63
mov edi, dword [rsp + 0x40]
cmp edi, 0xffffffff
je 0x18000cd63
test dil, 1
je 0x18000cb7c
and edi, 0xfffffffe
mov rcx, rbx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test dil, 0x10
je 0x18000cd58
lea rcx, [rsp + 0x2a2]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x6f0], rsi
mov word [rsp + 0x2a0], bp
call fcn.18002a9c0
lea rcx, [rsp + 0x2a0]
mov rdx, rbx
sub rcx, rbx
nop dword [rax]
movzx eax, word [rdx]
add rdx, 2
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x18000cbc0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2a0]
repne scasw ax, word [rdi]
mov eax, dword [0x1800705e8]
lea rcx, [rsp + 0x54]
mov dword [rdi - 2], eax
movzx eax, word [0x1800705ec]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x50], ebp
mov word [rdi + 2], ax
call fcn.18002a9c0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000cd1e
nop dword [rax]
lea rdx, [0x180070970]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18000ccff
lea rdx, [0x18007096c]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18000ccff
lea rcx, [rsp + 0x4b2]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x4b0], bp
call fcn.18002a9c0
lea rcx, [rsp + 0x4b0]
sub rcx, rbx
mov rdx, rbx
nop
movzx eax, word [rdx]
add rdx, 2
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x18000cc90
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2a0]
repne scasw ax, word [rdi]
mov eax, dword [0x180070968]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x2a0]
repne scasw ax, word [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x7c]
nop word [rax + rax]
movzx eax, word [rdx + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x18000cce0
lea rcx, [rsp + 0x4b0]
call fcn.18000cae0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18000cc30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rsi, qword [rsp + 0x6f0]
mov rbp, qword [rsp + 0x6e8]
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.18002a990
mov rbx, qword [rsp + 0x6f8]
add rsp, 0x6d0
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x18000cd2f
xor eax, eax
jmp 0x18000cd2f
xor eax, eax
jmp 0x18000cd37